Can not run Spybot or anyother Malware remover or viewer

hunter61 · Aug 28, 2009

No Matter what I run Spybot Malwarebytes, autoruns, hijack IE it dies during run and then when I try to run again I get “Windows cannot access the specified device, path, or file. You may not have appropriate" Need Help Please, I've tried everything!

Hopefully someone can end my nithmare here are the results:

Found mount point : C:\WINDOWS\system32\GroupPolicy\Machine\Machine
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\GroupPolicy\User\User
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\M
achineKeys
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\sample\sample
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\spool\drivers\w32x86\3\temp\temp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\mof\good\good
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wins\wins
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\xircom\xircom
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\Cookies\Cookies
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\Google Toolbar\Google Toolbar
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\History\History.IE5\History.IE5
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\mca621.tmp\mca621.tmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\mca622.tmp\mca622.tmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\mca623.tmp\mca623.tmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00000\MCE00000
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00001\MCE00001
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00002\MCE00002
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00003\MCE00003
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00004\MCE00004
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00005\MCE00005
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00006\MCE00006
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00007\MCE00007
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00008\MCE00008
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00009\MCE00009
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0000a\MCE0000a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0000b\MCE0000b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0000c\MCE0000c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0000d\MCE0000d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0000e\MCE0000e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0000f\MCE0000f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00010\MCE00010
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00011\MCE00011
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00012\MCE00012
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00013\MCE00013
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00014\MCE00014
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00015\MCE00015
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00016\MCE00016
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00017\MCE00017
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00018\MCE00018
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00019\MCE00019
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0001a\MCE0001a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0001b\MCE0001b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0001c\MCE0001c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0001d\MCE0001d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0001e\MCE0001e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0001f\MCE0001f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00020\MCE00020
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00021\MCE00021
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00022\MCE00022
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00023\MCE00023
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00024\MCE00024
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00025\MCE00025
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00026\MCE00026
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00027\MCE00027
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00028\MCE00028
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00029\MCE00029
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0002a\MCE0002a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0002b\MCE0002b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0002c\MCE0002c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0002d\MCE0002d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0002e\MCE0002e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0002f\MCE0002f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00030\MCE00030
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00031\MCE00031
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00032\MCE00032
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00033\MCE00033
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00034\MCE00034
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00035\MCE00035
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00036\MCE00036
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00037\MCE00037
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00038\MCE00038
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00039\MCE00039
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0003a\MCE0003a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0003b\MCE0003b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0003c\MCE0003c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0003d\MCE0003d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0003e\MCE0003e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0003f\MCE0003f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00040\MCE00040
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00041\MCE00041
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00042\MCE00042
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00043\MCE00043
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00044\MCE00044
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00045\MCE00045
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00046\MCE00046
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00047\MCE00047
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00048\MCE00048
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00049\MCE00049
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0004a\MCE0004a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0004b\MCE0004b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0004c\MCE0004c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0004d\MCE0004d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0004e\MCE0004e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0004f\MCE0004f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00050\MCE00050
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00051\MCE00051
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00052\MCE00052
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00053\MCE00053
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00054\MCE00054
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00055\MCE00055
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00056\MCE00056
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00057\MCE00057
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00058\MCE00058
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00059\MCE00059
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0005a\MCE0005a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0005b\MCE0005b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0005c\MCE0005c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0005d\MCE0005d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0005e\MCE0005e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0005f\MCE0005f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00060\MCE00060
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00061\MCE00061
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00062\MCE00062
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00063\MCE00063
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00064\MCE00064
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00065\MCE00065
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00066\MCE00066
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00067\MCE00067
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00068\MCE00068
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00069\MCE00069
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0006a\MCE0006a
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0006b\MCE0006b
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0006c\MCE0006c
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0006d\MCE0006d
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0006e\MCE0006e
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE0006f\MCE0006f
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MCE00070\MCE00070
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\MPTelemetrySubmit\MPTelemetrySubmit
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\Patcher1504\Patcher1504
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\Patcher2736\Patcher2736
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\Patcher5688\Patcher5688
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\C
ontent.IE5
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\UPD624.tmp\UPD624.tmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\_ISTMP0.DIR\FileGrp\menu\menu
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\Temp\_isTmp_{8675309}\_isTmp_{8675309}
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\twain_32\Mira4_03\Mira4_03
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18
e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.507
27.1433_x-ww_5cf844d2
Mount point destination : \Device\__max++>\^

Finished! Press any key to exit...

Sorry here is the complete output:

Log file is located at: C:\Documents and Settings\Gina\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\$hf_mig$\KB933729\KB933729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2DE3.tmp\ZAP2DE3.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4D72.tmp\ZAP4D72.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4DA1.tmp\ZAP4DA1.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP54E.tmp\ZAP54E.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD83.tmp\ZAPD83.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\atapi\atapi

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Cache\Adobe Reader 6.0.1\Adobe Reader 6.0.1

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d1\d1

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d2\d2

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d3\d3

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d4\d4

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d5\d5

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d6\d6

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d7\d7

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d8\d8

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA330100007706000000000030\8.0.0\8.0.0

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\System\News\News

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\PIF\PIF

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\10

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1025\1025

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1028\1028

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1031\1031

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1037\1037

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1041\1041

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1042\1042

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1054\1054

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\2052\2052

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\3076\3076

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-1343024091-725345543-1003\S-1-5-21-1417001333-1343024091-725345543-1003

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-1343024091-725345543-1004\S-1-5-21-1417001333-1343024091-725345543-1004

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Favorites

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICE

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\dhcp\dhcp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\DirectX\websetup\websetup

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn

Mount point destination : \Device\__max++>\^

Cannot access: C:\WINDOWS\system32\eventlog.dll

[1] 2004-08-04 00:56:44 55808 C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll (Microsoft Corporation)

[1] 2008-04-13 20:11:53 56320 C:\WINDOWS\ServicePackFiles\i386\eventlog.dll (Microsoft Corporation)

[1] 2008-04-13 20:11:53 56320 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll (Microsoft Corporation)

[1] 2008-04-13 20:11:53 62976 C:\WINDOWS\system32\eventlog.dll ()

[2] 2008-04-13 20:11:53 56320 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation)

Found mount point : C:\WINDOWS\system32\EVGA\EVGA

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\export\export

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\GroupPolicy\Machine\Machine

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\GroupPolicy\User\User

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\MachineKeys

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\sample\sample

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\drivers\w32x86\3\temp\temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wbem\mof\good\good

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wins\wins

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\xircom\xircom

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\Cookies\Cookies

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\Google Toolbar\Google Toolbar

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\History\History.IE5\History.IE5

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\mca621.tmp\mca621.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\mca622.tmp\mca622.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\mca623.tmp\mca623.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00000\MCE00000

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00001\MCE00001

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00002\MCE00002

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00003\MCE00003

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00004\MCE00004

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00005\MCE00005

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00006\MCE00006

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00007\MCE00007

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00008\MCE00008

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00009\MCE00009

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0000a\MCE0000a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0000b\MCE0000b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0000c\MCE0000c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0000d\MCE0000d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0000e\MCE0000e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0000f\MCE0000f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00010\MCE00010

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00011\MCE00011

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00012\MCE00012

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00013\MCE00013

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00014\MCE00014

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00015\MCE00015

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00016\MCE00016

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00017\MCE00017

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00018\MCE00018

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00019\MCE00019

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0001a\MCE0001a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0001b\MCE0001b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0001c\MCE0001c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0001d\MCE0001d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0001e\MCE0001e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0001f\MCE0001f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00020\MCE00020

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00021\MCE00021

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00022\MCE00022

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00023\MCE00023

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00024\MCE00024

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00025\MCE00025

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00026\MCE00026

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00027\MCE00027

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00028\MCE00028

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00029\MCE00029

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0002a\MCE0002a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0002b\MCE0002b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0002c\MCE0002c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0002d\MCE0002d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0002e\MCE0002e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0002f\MCE0002f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00030\MCE00030

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00031\MCE00031

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00032\MCE00032

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00033\MCE00033

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00034\MCE00034

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00035\MCE00035

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00036\MCE00036

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00037\MCE00037

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00038\MCE00038

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00039\MCE00039

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0003a\MCE0003a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0003b\MCE0003b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0003c\MCE0003c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0003d\MCE0003d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0003e\MCE0003e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0003f\MCE0003f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00040\MCE00040

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00041\MCE00041

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00042\MCE00042

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00043\MCE00043

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00044\MCE00044

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00045\MCE00045

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00046\MCE00046

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00047\MCE00047

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00048\MCE00048

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00049\MCE00049

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0004a\MCE0004a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0004b\MCE0004b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0004c\MCE0004c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0004d\MCE0004d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0004e\MCE0004e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0004f\MCE0004f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00050\MCE00050

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00051\MCE00051

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00052\MCE00052

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00053\MCE00053

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00054\MCE00054

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00055\MCE00055

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00056\MCE00056

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00057\MCE00057

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00058\MCE00058

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00059\MCE00059

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0005a\MCE0005a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0005b\MCE0005b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0005c\MCE0005c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0005d\MCE0005d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0005e\MCE0005e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0005f\MCE0005f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00060\MCE00060

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00061\MCE00061

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00062\MCE00062

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00063\MCE00063

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00064\MCE00064

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00065\MCE00065

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00066\MCE00066

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00067\MCE00067

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00068\MCE00068

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00069\MCE00069

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0006a\MCE0006a

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0006b\MCE0006b

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0006c\MCE0006c

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0006d\MCE0006d

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0006e\MCE0006e

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE0006f\MCE0006f

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MCE00070\MCE00070

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\MPTelemetrySubmit\MPTelemetrySubmit

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\Patcher1504\Patcher1504

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\Patcher2736\Patcher2736

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\Patcher5688\Patcher5688

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\Content.IE5

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\UPD624.tmp\UPD624.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\_ISTMP0.DIR\FileGrp\menu\menu

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Temp\_isTmp_{8675309}\_isTmp_{8675309}

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\twain_32\Mira4_03\Mira4_03

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2

Mount point destination : \Device\__max++>\^

Finished!

Blade81 · Aug 30, 2009

Hi there,

Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop.
@echo off
copy C:\WINDOWS\system32\logevent.dll c:\

Double-click on fixes.bat file to execute it.

Download The Avenger by Swandog46 from here.
Unzip/extract it to a folder on your desktop.
Double click on avenger.exe to run The Avenger.
Click OK.
Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
Code:
```
Files to move:
c:\logevent.dll | C:\WINDOWS\system32\eventlog.dll
```
In the avenger window, click the Paste Script from Clipboard,

button.
Click the Execute button.
You will be asked Are you sure you want to execute the current script?.
Click Yes.
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
Click Yes.
Your PC will now be rebooted.
Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt).
Please post this log in your next reply.

________

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the Open box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
"%userprofile%\desktop\win32kdiag.exe" -f -r

Download GMER here by clicking download exe -button and then saving it your desktop:

Double-click .exe that you downloaded
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.

_________________

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
Save both reports to your desktop. Post them back to your topic.

hunter61 · Aug 31, 2009

Ran Script and here Avenger.txt

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "c:\logevent.dll|C:\WINDOWS\system32\eventlog.dll" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

hunter61 · Aug 31, 2009

Following log files you requested

Win32kDiag.txt:
Log file is located at: C:\Documents and Settings\Administrator\Desktop\Win32kDiag.txt

Removing all found mount points.

Attempting to reset file permissions.

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168

Found mount point : C:\WINDOWS\$hf_mig$\KB933729\KB933729

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB933729\KB933729

Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460

Found mount point : C:\WINDOWS\$hf_mig$\KB968389\KB968389

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB968389\KB968389

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\addins\addins

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2DE3.tmp\ZAP2DE3.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2DE3.tmp\ZAP2DE3.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4D72.tmp\ZAP4D72.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4D72.tmp\ZAP4D72.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4DA1.tmp\ZAP4DA1.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4DA1.tmp\ZAP4DA1.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP54E.tmp\ZAP54E.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP54E.tmp\ZAP54E.tmp

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD83.tmp\ZAPD83.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD83.tmp\ZAPD83.tmp

Found mount point : C:\WINDOWS\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\temp\temp

Found mount point : C:\WINDOWS\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\tmp\tmp

Found mount point : C:\WINDOWS\atapi\atapi

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\atapi\atapi

Found mount point : C:\WINDOWS\Cache\Adobe Reader 6.0.1\Adobe Reader 6.0.1

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Cache\Adobe Reader 6.0.1\Adobe Reader 6.0.1

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Config\Config

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Found mount point : C:\WINDOWS\CSC\d1\d1

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d1\d1

Found mount point : C:\WINDOWS\CSC\d2\d2

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d2\d2

Found mount point : C:\WINDOWS\CSC\d3\d3

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d3\d3

Found mount point : C:\WINDOWS\CSC\d4\d4

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d4\d4

Found mount point : C:\WINDOWS\CSC\d5\d5

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d5\d5

Found mount point : C:\WINDOWS\CSC\d6\d6

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d6\d6

Found mount point : C:\WINDOWS\CSC\d7\d7

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d7\d7

Found mount point : C:\WINDOWS\CSC\d8\d8

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d8\d8

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imejp\applets\applets

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imejp98\imejp98

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA330100007706000000000030\8.0.0\8.0.0

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA330100007706000000000030\8.0.0\8.0.0

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\java\classes\classes

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\java\trustlib\trustlib

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\msapps\msinfo\msinfo

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Found mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\UserDumps\UserDumps

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Found mount point : C:\WINDOWS\pchealth\helpctr\System\News\News

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\System\News\News

Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM

Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Found mount point : C:\WINDOWS\PIF\PIF

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\PIF\PIF

Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\555558d2c7916b118ad5baef62b18136\backup\backup

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\555558d2c7916b118ad5baef62b18136\backup\backup

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\10

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\10\10

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\52\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\60\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\backup\asms\70\70

Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel

Found mount point : C:\WINDOWS\system32\1025\1025

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1025\1025

Found mount point : C:\WINDOWS\system32\1028\1028

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1028\1028

Found mount point : C:\WINDOWS\system32\1031\1031

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1031\1031

Found mount point : C:\WINDOWS\system32\1037\1037

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1037\1037

Found mount point : C:\WINDOWS\system32\1041\1041

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1041\1041

Found mount point : C:\WINDOWS\system32\1042\1042

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1042\1042

Found mount point : C:\WINDOWS\system32\1054\1054

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\1054\1054

Found mount point : C:\WINDOWS\system32\2052\2052

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\2052\2052

Found mount point : C:\WINDOWS\system32\3076\3076

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\3076\3076

Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi

Found mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE

Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-1343024091-725345543-1003\S-1-5-21-1417001333-1343024091-725345543-1003

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-1343024091-725345543-1003\S-1-5-21-1417001333-1343024091-725345543-1003

Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-1343024091-725345543-1004\S-1-5-21-1417001333-1343024091-725345543-1004

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-1343024091-725345543-1004\S-1-5-21-1417001333-1343024091-725345543-1004

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs

Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop

Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Favorites

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Favorites

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICE

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICE

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temp

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5AXC2YPE\5AXC2YPE

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5AXC2YPE\5AXC2YPE

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JYWPQLRX\JYWPQLRX

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JYWPQLRX\JYWPQLRX

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KHUF4HM3\KHUF4HM3

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KHUF4HM3\KHUF4HM3

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SHUR8527\SHUR8527

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SHUR8527\SHUR8527

Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents

Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood

Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood

Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent

Found mount point : C:\WINDOWS\system32\dhcp\dhcp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\dhcp\dhcp

Found mount point : C:\WINDOWS\system32\DirectX\websetup\websetup

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\DirectX\websetup\websetup

Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\drivers\disdn\disdn

Found mount point : C:\WINDOWS\system32\EVGA\EVGA

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\EVGA\EVGA

Found mount point : C:\WINDOWS\system32\export\export

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\export\export

Found mount point : C:\WINDOWS\system32\GroupPolicy\Machine\Machine

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\GroupPolicy\Machine\Machine

Found mount point : C:\WINDOWS\system32\GroupPolicy\User\User

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\GroupPolicy\User\User

Found mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\MachineKeys

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\MachineKeys

Cannot access: C:\WINDOWS\system32\MRT.exe

Attempting to restore permissions of : C:\WINDOWS\system32\MRT.exe

GMER log:

GMER 1.0.15.15077 [zwjt0hmb.exe] - http://www.gmer.net
Rootkit quick scan 2009-08-30 20:47:33
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwEnumerateKey [0xF75B05DC]
SSDT a347bus.sys (Plug and Play BIOS Extension/ ) ZwEnumerateValueKey [0xF75BC120]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A62A960

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )
AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

---- Modules - GMER 1.0.15 ----

Module _________ F7472000-F748A000 (98304 bytes)

---- EOF - GMER 1.0.15 ----

DDS.TXT

DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 20:52:01.25 on Sun 08/30/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1797 [GMT -4:00]

AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\sb2\TeaTimer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\ffox\firefox.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.com
uSearch Page =
mSearch Page =
mStart Page = hxxp://www.msn.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\sb2\SDHelper.dll
BHO: &Helper: {a77d3539-581d-450c-9e44-a84c415a6172} - c:\windows\system32\msxmlm.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [SpybotSD TeaTimer] c:\sb2\TeaTimer.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [PCLEPCI] c:\progra~1\pinnacle\ppe\PPE.EXE
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [FBSearch] ; c:\program files\fast browser searchp\FastBrowserSearchProtectionV.exe
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [NWEReboot] ;
mRun: [nod32kui] "c:\program files\eset\nod32kui.exe" /WAITSERVICE
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\sb2\SDHelper.dll
LSP: c:\windows\system32\imon.dll
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/tgctlcm.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxp://www.leaguelineup.com/XUpload.ocx
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: RegCompact - RegCompact.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\o8exscw8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\ffox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);

c:\ffox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");
c:\ffox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);
c:\ffox\greprefs\all.js - pref("advanced.always_load_images", true);
c:\ffox\greprefs\all.js - pref("network.protocol-handler.external.help", false);
c:\ffox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds
c:\ffox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds
c:\ffox\greprefs\all.js - pref("network.IDN_show_punycode", true);
c:\ffox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse
c:\ffox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p
c:\ffox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\ffox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\ffox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");
c:\ffox\defaults\pref\firefox.js - pref("app.version",
c:\ffox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");
c:\ffox\defaults\pref\firefox.js - pref("app.build_id",
c:\ffox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates
c:\ffox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");
c:\ffox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);
c:\ffox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was
c:\ffox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc
c:\ffox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals
c:\ffox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar
c:\ffox\defaults\pref\firefox.js - pref("update.severity", 0);
c:\ffox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "update.mozilla.org,addons.mozilla.org");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",
c:\ffox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days
c:\ffox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");

============= SERVICES / DRIVERS ===============

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-8-28 15424]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2008-5-28 337280]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2008-5-28 54656]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2008-6-24 191848]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2008-6-24 169320]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2008-9-30 1956792]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [2005-8-13 203264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-29 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090828.037\naveng.sys [2009-8-29 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090828.037\navex15.sys [2009-8-29 1323568]
R3 TD3004F60v;TD3004F60v;c:\windows\system32\drivers\TD3004F60v.sys [2009-3-21 24612]
S0 gvlaiid;gvlaiid;c:\windows\system32\drivers\wegn.sys --> c:\windows\system32\drivers\wegn.sys [?]
S2 NOD32krn;NOD32 Kernel Service;c:\program files\eset\nod32krn.exe [2009-8-28 552064]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]
S3 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
S3 EraserUtilDrv10821;EraserUtilDrv10821;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10821.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10821.sys [?]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10920.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10920.sys [?]
S3 GEMPC430;GEMPLUS GemPC430 USB Smart Card Reader;c:\windows\system32\drivers\gemusb.sys [2001-12-4 53568]
S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [2006-9-16 24784]
S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [2006-9-16 25044]
S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [2006-9-16 55936]
S3 mamm9000mi00;mamm9000mi00;c:\windows\system32\drivers\ma9kmi00.sys [2007-1-22 48724]
S3 mamm9000mi01;mamm9000mi01;c:\windows\system32\drivers\ma9kmi01.sys [2007-1-22 48724]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [2008-12-24 107904]
S3 RmAx;RMAXUSB;c:\windows\system32\drivers\RmAx.sys [2008-8-23 40502]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys --> c:\windows\system32\drivers\rootrepeal.sys [?]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2008-9-30 116664]
S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [2007-9-6 10430]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\drivers\sustucam.sys [2006-4-12 47360]
S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\drivers\sustucap.sys [2006-4-12 47360]
S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [2006-4-12 28032]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\webcam\watchdog\dogsvc.exe --> c:\program files\webcam\watchdog\dogsvc.exe [?]

=============== Created Last 30 ================

2009-08-30 20:40 56,320 a------- C:\logevent.dll
2009-08-30 20:31 46,640 a------- c:\windows\system32\msln.exe
2009-08-30 20:22 135,168 a------- C:\zip.exe
2009-08-30 20:22 574 a------- C:\cleanup.bat
2009-08-30 20:13 <DIR> --d----- C:\ffox
2009-08-30 20:13 <DIR> --d----- C:\New Folder
2009-08-29 21:14 335 a------- c:\windows\mozregistry.dat
2009-08-29 20:56 <DIR> --d----- c:\documents and settings\administrator\.housecall6.6
2009-08-29 20:42 <DIR> --d----- C:\sb2
2009-08-29 20:29 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 20:29 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-29 20:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 08:53 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-08-29 08:42 123,952 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-29 08:42 60,800 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-29 08:42 10,671 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-29 08:42 805 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-29 08:42 <DIR> --d----- c:\program files\Symantec AntiVirus
2009-08-29 08:32 <DIR> --d----- C:\sb1
2009-08-28 17:04 <DIR> --d----- C:\mwnew
2009-08-28 15:47 0 a------- c:\windows\system32\mapisvc.inf
2009-08-28 15:47 512,096 a------- c:\windows\system32\drivers\amon.sys
2009-08-28 15:47 298,104 a------- c:\windows\system32\imon.dll
2009-08-28 15:47 15,424 a------- c:\windows\system32\drivers\nod32drv.sys
2009-08-28 15:47 <DIR> --d----- c:\program files\Eset
2009-08-28 14:14 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Desktop Search
2009-08-28 14:12 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Search
2009-08-28 00:55 <DIR> --d----- C:\mw
2009-08-28 00:41 <DIR> --d----- C:\sb
2009-08-28 00:36 <DIR> --d----- c:\program files\EMCO Malware Destroyer
2009-08-28 00:26 <DIR> --d----- c:\program files\CCleaner
2009-08-27 22:03 34,816 a------- c:\windows\system32\drivers\winlogon.sys
2009-08-27 22:02 <DIR> --d----- C:\root
2009-08-27 20:59 <DIR> --d----- C:\Malwarebytes' Anti-Malware
2009-08-27 20:38 389,120 a------- c:\windows\system32\cmd.execf
2009-08-27 19:27 <DIR> --d----- C:\Spybot - Search & Destroy
2009-08-27 18:43 <DIR> --d----- c:\program files\Safer Networking
2009-08-27 17:49 99,965 a------- c:\windows\UninstallFirefox.exe
2009-08-27 17:48 6,052 a------- c:\windows\mozver.dat
2009-08-27 17:24 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-08-27 17:16 <DIR> --dsh--- c:\documents and settings\administrator\IETldCache
2009-08-27 17:03 <DIR> --d----- c:\program files\Enigma Software Group
2009-08-27 12:36 <DIR> --d----- c:\program files\common files\Uninstall
2009-08-27 11:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-12 19:46 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-08-12 19:46 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-08-05 05:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll
2009-08-03 21:21 <DIR> --d----- c:\program files\common files\DivX Shared
2009-08-02 18:04 <DIR> --d----- c:\program files\Scriptocean

==================== Find3M ====================

2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-22 12:11 133,936 a------- c:\windows\~GLC0000.TMP
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2007-08-03 23:10 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT

============= FINISH: 20:52:54.23 ===============

Attached.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume4
Install Date: 9/3/2006 8:54:29 PM
System Uptime: 8/30/2009 8:26:02 PM (0 hours ago)

Motherboard: Dell Computer Corp. | | 0T2408
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 279 GiB total, 69.386 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 153 GiB total, 0.257 GiB free.
G: is FIXED (NTFS) - 37 GiB total, 3.426 GiB free.
H: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

AAC Decoder
ACDSee 6.0 PowerPack
Ad-Aware
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.6 - CPSID_49167
Adobe Acrobat 8.1.6 Professional
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe After Effects CS3 Third Party Content
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Contribute CS3
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS
Adobe Photoshop CS3
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 8.1.6
Adobe Setup
Adobe Shockwave Player 11.5
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
AIM 6
All Occasions EZ Cards
AMUST Registry Cleaner
AOL Instant Messenger
ArcSoft PhotoImpression 4
ArcSoft Software Suite
AutoUpdate
AX Remote Editor 1.1
Battleship
Burpee 3D Garden Designer
Cabela's 4x4 Off-Road Adventure 2
Cabela's Grand Slam
CCleaner (remove only)
Copier
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DataPilot
Delta Force Land Warrior Demo
Dig'nRigs
Digital Voice Recorder
DivX
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
EMCO Malware Destroyer
ERUNT 1.1j
EVGA Display Driver
Family Feud
FileAlyzer
Garmin WebUpdater
Google Earth
Google Toolbar for Internet Explorer
H.264 Decoder
Hanes® T-ShirtMaker® Lite 3.0.0
Hanes® T-ShirtMaker® Lite Upgrade 3.1.0
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hollywood FX 5.5 Additional Effects
Hollywood FX Pack 26 - Extra FX
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 5550 series (Remove only)
iF-22
Intel(R) PRO Network Connections 11.2.0.69
Intel(R) PRO Network Connections Drivers
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 12
Jeopardy! 2nd Edition
LEGO Island
Lernout & Hauspie TruVoice American English TTS Engine
LG LX350 USB - Handset Manager V9.2
LiveUpdate 3.2 (Symantec Corporation)
Macromedia Dreamweaver 4
Macromedia Extension Manager
Macromedia Fireworks 4
Macromedia Flash 5
Malwarebytes' Anti-Malware
Managed DirectX (0901)
MapSource
Matchbox® Caterpillar® Construction Zone 2 Gold Mining CD-ROM
Memorex exPressit Label Design Studio
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Picture It! Photo 2002
Microsoft Plus! for Windows XP
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MioTransfer
MiraScan V4.02
MKV Splitter
Monster Jam
Mozilla Firefox (1.0.2)
MSN
MSN Toolbar
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MVP Baseball 2003
Nero 7 Premium
Nikon Message Center
Nikon View 6
NOD32 antivirus system
NVIDIA Drivers
PDF Settings
Pinnacle Bender 32-bit
Pinnacle Hollywood FX 4.6
Pinnacle Hollywood FX for Studio
Pinnacle Instant DVD Recorder
Pinnacle PCI Performance Enhancer
PM325 USB-Handset Manager
proDAD Heroglyph 1.0
proDAD Heroglyph 2.0
QuickTime
RealPlayer Basic
Reel Deal Casino - Shuffle Master Edition
Reel Deal Slots 2nd Volume
Reel Deal Slots Nickel Alley
RegAlyzer
Renamer 1.1
Rhapsody
Rhapsody Player Engine
RunAlyzer
Sansa Media Converter
Sanyo Katana (SCP-6600) USB - Handset Manager V9.2
Scriptocean Slideshow 1
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SmartSound Quicktracks Plugin
SpecOps US Army Green Berets
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
SpyHunter
Street Atlas USA ® 9.0
Studio 11
Studio 9
Studio 9 Content CD/DVD
SuperDVR
Susteen Launcher
Symantec AntiVirus
The Ultimate Home
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB973815)
USB-IrDA Adapter
VC80CRTRedist - 8.0.50727.762
Verizon Broadband Toolbar
Viewpoint Media Player
Webcam Watchdog
WebFldrs XP
Webshots Desktop
Wheel of Fortune 2nd Edition
Window Washer
Windows Defender Signatures
Windows Driver Package - Camera Maker (MR97310_USB_DUAL_CAMERA) Image (05/02/2006 2.0.1.0)
Windows Driver Package - Pinnacle Systems (BENDER) Media (11/21/2005 2.0.19.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Desktop Login
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

8/30/2009 7:12:33 AM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The system cannot find the path specified.
8/29/2009 9:46:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
8/29/2009 9:38:28 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
8/29/2009 9:38:28 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\basic\setup.exe. Reference error message: The operation completed successfully. .
8/29/2009 9:38:28 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
8/29/2009 9:38:27 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
8/29/2009 8:23:29 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm nod32drv SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/29/2009 8:20:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
8/29/2009 8:19:18 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT nod32drv RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/28/2019 4:10:45 PM, error: Print [19] - Sharing printer failed + 1722, Printer Microsoft XPS Document Writer share name Printer.
8/28/2019 3:51:55 PM, error: Service Control Manager [7031] - The NOD32 Kernel Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
8/28/2019 3:51:55 PM, error: Service Control Manager [7000] - The NOD32 Kernel Service service failed to start due to the following error: Access is denied.
8/28/2009 12:32:45 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
8/28/2009 12:08:37 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/28/2009 10:21:36 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer NEW_BOYS_PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{58ACD3AA-4488-42. The master browser is stopping or an election is being forced.
8/28/2009 1:28:02 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/28/2009 1:24:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD ehdrv epfwtdir Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
8/27/2009 8:53:25 PM, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%5" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
8/27/2009 8:53:04 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
8/27/2009 6:38:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/27/2009 5:56:11 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: Access is denied.
8/27/2009 5:44:33 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the crd service to connect.
8/27/2009 5:44:33 PM, error: Service Control Manager [7000] - The crd service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/27/2009 5:38:47 PM, error: Service Control Manager [7038] - The WinDefend service was unable to log on as .\administrator with the currently configured password due to the following error: Logon failure: unknown user name or bad password. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
8/27/2009 5:38:47 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: The service did not start due to a logon failure.
8/27/2009 4:44:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
8/27/2009 12:34:33 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
8/27/2009 11:56:47 AM, information: Windows File Protection [64007] - The protected system file eventlog.dll could not be verified as valid because the file was in use. Use the SFC utility to verify the integrity of the file at a later time.
8/27/2009 11:01:17 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
8/27/2009 11:01:11 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip
8/27/2009 11:01:11 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
8/27/2009 11:01:11 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
8/27/2009 11:01:11 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/27/2009 11:01:11 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/27/2009 11:01:11 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
8/27/2009 11:01:11 PM, error: Service Control Manager [7001] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/27/2009 11:00:10 PM, error: SRService [104] - The System Restore initialization process failed.
8/27/2009 10:29:19 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
8/27/2009 10:25:35 PM, error: Cdrom [15] - The device, \Device\CdRom2, is not ready for access yet.

==== End Of File ===========================

Thank you so much for assiting me I've been trying to remove this since Thursday, unscuccessfully, thxs again!

Blade81 · Aug 31, 2009

Hi,

That looks better but we still have things left to do there

You seem to have both Nod32 & Symantec Antivirus installed there. Decide which one to keep.

Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:

Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode
On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

hunter61 · Aug 31, 2009

Results after ComboFix

ComboFix

ComboFix 09-08-30.04 - Administrator 08/31/2009 12:43.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1947 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Gina\Application Data\inst.exe
c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\FastBrowserSearchProtection.exe
c:\program files\Fast Browser Search\IE\FBSPlugin.dll
c:\program files\Fast Browser Search\IE\FbsSearchProtectionUnInstall.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.crc
c:\program files\Fast Browser Search\IE\FBStoolbar.inf
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\options.html
c:\program files\Fast Browser Search\IE\searchbutton1.gif
c:\program files\Fast Browser Search\IE\searchbutton2.gif
c:\program files\Fast Browser Search\IE\tbhelper.dll
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\Unreg.dll
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt
c:\program files\SelectRebates
C:\root
c:\root\RootRepeal.exe
c:\root\settings.dat
c:\windows\Installer\1840c093.msi
c:\windows\Installer\39e8485c.msi
c:\windows\jestertb.dll
G:\AUTORUN.INF

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 )))))))))))))))))))))))))))))))
.

2009-08-31 11:45 . 2009-08-31 11:45 -------- d-----w- C:\sb3
2009-08-31 00:40 . 2008-04-14 00:11 56320 ----a-w- C:\logevent.dll
2009-08-31 00:22 . 2009-08-31 00:22 574 ----a-w- C:\cleanup.bat
2009-08-31 00:22 . 2009-08-31 00:22 135168 ----a-w- C:\zip.exe
2009-08-31 00:13 . 2009-08-31 00:14 -------- d-----w- C:\ffox
2009-08-31 00:13 . 2009-08-31 00:13 -------- d-----w- C:\New Folder
2009-08-30 01:14 . 2009-08-30 01:14 335 ----a-w- c:\windows\mozregistry.dat
2009-08-30 00:56 . 2009-08-30 01:19 -------- d-----w- c:\documents and settings\Administrator\.housecall6.6
2009-08-30 00:42 . 2009-08-30 00:51 -------- d-----w- C:\sb2
2009-08-30 00:29 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-30 00:29 . 2009-08-30 00:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-30 00:29 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 12:53 . 2009-08-30 00:56 102664 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-08-29 12:53 . 2009-08-29 12:54 -------- d-----w- c:\documents and settings\Gina\.housecall6.6
2009-08-29 12:42 . 2009-08-29 12:42 60800 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-29 12:42 . 2009-08-29 12:42 123952 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-29 12:42 . 2009-08-31 16:56 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-29 12:32 . 2009-08-29 12:34 -------- d-----w- C:\sb1
2009-08-28 21:04 . 2009-08-28 21:05 -------- d-----w- C:\mwnew
2009-08-28 19:47 . 2009-08-28 19:47 298104 ----a-w- c:\windows\system32\imon.dll
2009-08-28 19:47 . 2009-08-28 19:47 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2009-08-28 19:47 . 2009-08-28 19:47 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2009-08-28 18:14 . 2009-08-28 18:14 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-08-28 18:14 . 2009-08-28 18:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Desktop Search
2009-08-28 18:12 . 2009-08-28 18:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2009-08-28 12:55 . 2009-08-28 12:59 -------- d-----w- c:\program files\ERUNT
2009-08-28 04:55 . 2009-08-28 04:55 -------- d-----w- C:\mw
2009-08-28 04:41 . 2009-08-28 04:42 -------- d-----w- C:\sb
2009-08-28 04:36 . 2009-08-28 04:37 -------- d-----w- c:\program files\EMCO Malware Destroyer
2009-08-28 04:27 . 2009-08-28 04:27 -------- d-----w- c:\documents and settings\Gina\Application Data\Yahoo!
2009-08-28 04:27 . 2009-08-28 04:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-08-28 04:26 . 2009-08-28 04:27 -------- d-----w- c:\program files\CCleaner
2009-08-28 02:03 . 2009-08-28 02:03 34816 ----a-w- c:\windows\system32\drivers\winlogon.sys
2009-08-28 00:59 . 2009-08-28 00:59 -------- d-----w- C:\Malwarebytes' Anti-Malware
2009-08-28 00:20 . 2009-08-28 00:32 -------- d-----w- c:\program files\RegCure
2009-08-27 23:27 . 2009-08-28 02:47 -------- d-----w- C:\Spybot - Search & Destroy
2009-08-27 22:45 . 2009-08-27 22:45 -------- d-----w- c:\documents and settings\Gina\Application Data\Safer Networking
2009-08-27 22:43 . 2009-08-27 22:47 -------- d-----w- c:\program files\Safer Networking
2009-08-27 21:49 . 2009-08-31 00:13 99965 ----a-w- c:\windows\UninstallFirefox.exe
2009-08-27 21:48 . 2009-08-31 00:13 6052 ----a-w- c:\windows\mozver.dat
2009-08-27 21:43 . 2009-08-31 11:56 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-08-27 21:43 . 2009-08-27 21:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Ahead
2009-08-27 21:43 . 2009-08-27 21:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2009-08-27 21:28 . 2009-08-27 21:28 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AMUST
2009-08-27 21:24 . 2009-08-27 21:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-27 21:16 . 2009-08-27 21:16 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-27 21:05 . 2009-08-27 21:07 -------- d-----w- c:\program files\Windows Live Safety Center
2009-08-27 21:03 . 2009-08-27 21:03 -------- d-----w- c:\program files\Enigma Software Group
2009-08-27 16:36 . 2009-08-27 16:36 -------- d-----w- c:\program files\Common Files\Uninstall
2009-08-27 15:55 . 2009-08-27 15:55 -------- d-----w- c:\documents and settings\Gina\Application Data\Malwarebytes
2009-08-27 15:55 . 2009-08-27 15:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-26 12:21 . 2009-08-26 12:38 -------- d-----w- c:\documents and settings\Gina\Application Data\mp3rocket
2009-08-12 23:46 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 01:21 . 2009-08-04 01:22 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-08-02 22:04 . 2009-08-02 22:04 -------- d-----w- c:\documents and settings\Gina\Application Data\scriptocean
2009-08-02 22:04 . 2009-08-02 22:04 -------- d-----w- c:\program files\Scriptocean
2009-08-01 18:12 . 2009-08-01 18:12 -------- d-----w- c:\documents and settings\John\Local Settings\Application Data\Symantec
2009-08-01 18:12 . 2009-08-01 18:12 -------- d-sh--w- c:\documents and settings\John\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 15:01 . 2009-02-04 11:17 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-31 11:46 . 2007-01-11 00:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-29 12:43 . 2009-06-21 15:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-29 12:42 . 2009-06-21 15:35 -------- d-----w- c:\program files\Symantec
2009-08-29 12:42 . 2009-08-29 12:42 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-29 12:42 . 2009-08-29 12:42 10671 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-29 12:42 . 2009-06-21 15:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-08-28 04:27 . 2006-10-06 23:05 -------- d-----w- c:\program files\Yahoo!
2009-08-28 01:18 . 2007-03-15 02:16 -------- d-----w- c:\program files\Windows Defender
2009-08-27 23:18 . 2007-01-11 00:55 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-26 12:19 . 2007-08-17 13:03 -------- d-----w- c:\program files\LimeWire
2009-08-26 12:18 . 2007-06-17 15:30 -------- d-----w- c:\documents and settings\Gina\Application Data\LimeWire
2009-08-25 17:36 . 2007-07-01 12:23 -------- d-----w- c:\program files\DivX
2009-08-14 00:00 . 2007-07-16 11:36 87 ----a-w- c:\windows\Winsus0.dat
2009-08-13 02:09 . 2006-09-10 13:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-13 02:09 . 2007-07-16 11:16 -------- d-----w- c:\program files\Susteen
2009-08-05 20:16 . 2008-09-07 15:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2004-08-04 04:56 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 01:25 . 2006-09-30 02:45 -------- d-----w- c:\program files\Google
2009-07-31 02:58 . 2007-10-12 14:33 -------- d-----w- c:\program files\Coupons
2009-07-22 16:11 . 2009-07-22 16:11 133936 ----a-w- c:\windows\~GLC0000.TMP
2009-07-22 11:03 . 2009-03-28 01:23 -------- d-----w- c:\program files\Fast Browser SearchP
2009-07-17 19:01 . 2004-08-04 04:56 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2004-08-04 04:56 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-04 04:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-01 14:21 . 2006-04-12 14:24 28032 ----a-w- c:\windows\system32\drivers\sustucau.sys
2009-07-01 14:21 . 2006-04-12 17:01 47360 ----a-w- c:\windows\system32\drivers\sustucap.sys
2009-07-01 14:21 . 2006-04-12 17:01 47360 ----a-w- c:\windows\system32\drivers\sustucam.sys
2009-06-18 23:28 . 2007-08-09 16:46 119792 ----a-w- c:\documents and settings\John\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-16 14:36 . 2004-08-07 00:16 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 04:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 04:56 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 04:56 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-12 10:12 . 2009-06-12 10:12 1915520 ----a-w- c:\documents and settings\Gina\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-06-10 14:13 . 2004-08-04 04:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2006-09-04 00:47 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-04 04:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-04 04:56 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 23:50 . 2009-06-02 23:50 536 ----a-w- c:\windows\eReg.dat
2005-03-17 23:02 . 2009-08-30 01:14 44153 ----a-w- c:\program files\mozilla firefox\components\inspector.dll
2005-03-17 23:02 . 2009-08-27 21:48 41573 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2005-03-17 23:02 . 2009-08-27 21:48 48223 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2005-03-17 23:02 . 2009-08-27 21:48 158823 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-27 148888]
"SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2009-04-02 868352]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-04 98304]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"PCLEPCI"="c:\progra~1\Pinnacle\PPE\PPE.EXE" [2004-02-03 49152]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-15 623992]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-06-24 53096]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2008-09-30 125368]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Gina\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2008-7-5 157000]

c:\documents and settings\John\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2008-7-5 157000]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RegCompact]
2005-11-21 23:22 135168 ----a-w- c:\windows\system32\RegCompact.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [8/13/2005 5:18 AM 203264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 8:45 AM 102448]
R3 TD3004F60v;TD3004F60v;c:\windows\system32\drivers\TD3004F60v.sys [3/21/2009 9:32 AM 24612]
S0 gvlaiid;gvlaiid;c:\windows\system32\drivers\wegn.sys --> c:\windows\system32\drivers\wegn.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
S3 EraserUtilDrv10821;EraserUtilDrv10821;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10821.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10821.sys [?]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10920.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10920.sys [?]
S3 GEMPC430;GEMPLUS GemPC430 USB Smart Card Reader;c:\windows\system32\drivers\gemusb.sys [12/4/2001 10:03 AM 53568]
S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [9/16/2006 12:00 AM 24784]
S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [9/16/2006 12:00 AM 25044]
S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [9/16/2006 12:00 AM 55936]
S3 mamm9000mi00;mamm9000mi00;c:\windows\system32\drivers\ma9kmi00.sys [1/22/2007 10:47 AM 48724]
S3 mamm9000mi01;mamm9000mi01;c:\windows\system32\drivers\ma9kmi01.sys [1/22/2007 10:51 AM 48724]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [12/24/2008 4:06 PM 107904]
S3 RmAx;RMAXUSB;c:\windows\system32\drivers\RmAx.sys [8/23/2008 4:31 PM 40502]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/30/2008 5:41 PM 116664]
S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [9/6/2007 9:49 AM 10430]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\drivers\sustucam.sys [4/12/2006 1:01 PM 47360]
S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\drivers\sustucap.sys [4/12/2006 1:01 PM 47360]
S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [4/12/2006 10:24 AM 28032]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\Webcam\Watchdog\dogsvc.exe --> c:\program files\Webcam\Watchdog\dogsvc.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-15 c:\windows\Tasks\Gina backup.job
- c:\program files\AMUST\Registry Cleaner\RegCleaner.exe [2008-09-15 23:22]

2009-08-22 c:\windows\Tasks\Gina scan and fix.job
- c:\program files\AMUST\Registry Cleaner\RegCleaner.exe [2008-09-15 23:22]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-FBSearch - c:\program files\Fast Browser SearchP\FastBrowserSearchProtectionV.exe
HKLM-Run-NWEReboot - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o8exscw8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\ffox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);
c:\ffox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");
c:\ffox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);
c:\ffox\greprefs\all.js - pref("advanced.always_load_images", true);
c:\ffox\greprefs\all.js - pref("network.protocol-handler.external.help", false);
c:\ffox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds
c:\ffox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds
c:\ffox\greprefs\all.js - pref("network.IDN_show_punycode", true);
c:\ffox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse
c:\ffox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p
c:\ffox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\ffox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\ffox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");
c:\ffox\defaults\pref\firefox.js - pref("app.version",
c:\ffox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");
c:\ffox\defaults\pref\firefox.js - pref("app.build_id",
c:\ffox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates
c:\ffox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");
c:\ffox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);
c:\ffox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was
c:\ffox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc
c:\ffox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals
c:\ffox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar
c:\ffox\defaults\pref\firefox.js - pref("update.severity", 0);
c:\ffox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "update.mozilla.org,addons.mozilla.org");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",
c:\ffox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days
c:\ffox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-31 12:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,bc,91,a2,98,33,
ae,be,06,c8,28,51,af,b0,29,a3,98,f6,1d,8f,15,61,39,1d,cb,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,01,b5,0e,03,88,
9f,3d,87,71,3b,04,66,8b,46,0d,96,37,98,f9,cc,6b,9d,51,4a,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,71,5f,51,86,f6,
0d,41,d4,25,da,ec,7e,55,20,c9,26,72,a1,b2,10,da,91,ee,a1,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,45,2b,67,30,56,
47,1f,48,3e,1e,9e,e0,57,5a,93,61,b6,b8,77,d3,4a,34,80,f7,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,2b,cc,27,a2,51,
34,85,16,cd,44,cd,b9,a6,33,6c,cd,88,8a,50,75,09,72,1e,d7,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,43,b6,ce,06,9d,
f9,8a,5b,b0,18,ed,a7,3f,8d,37,a4,e7,32,98,48,45,76,4b,db,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,d5,be,fc,85,97,
d9,4b,ef,31,77,e1,ba,b1,f8,68,02,84,f5,ae,36,b9,d5,af,14,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,9e,9d,fd,1b,41,
a3,68,e6,83,6c,56,8b,a0,85,96,ab,66,7d,c0,bd,a0,b3,da,dd,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,bc,3e,00,46,41,
93,ad,92,51,fa,6e,91,28,9e,14,cc,bb,8f,0a,c3,76,a4,4d,2d,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,0f,93,06,93,15,
21,dd,73,b1,cd,45,5a,a8,c4,f8,b9,39,42,78,a9,a6,49,43,ae,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,c9,af,42,be,49,
2e,f8,1e,e3,0e,66,d5,eb,bc,2f,6b,cd,2d,ef,2d,c0,4b,7b,35,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,62,b9,35,d6,f8,
36,31,fc,fa,ea,66,7f,d4,3b,6b,70,44,0c,4b,84,c9,ac,80,f8,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(808)
c:\windows\system32\RegCompact.dll

- - - - - - - > 'lsass.exe'(864)
c:\windows\system32\imon.dll

- - - - - - - > 'explorer.exe'(3460)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\scardsvr.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wwSecure.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-08-31 13:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-31 17:04

Pre-Run: 74,508,853,248 bytes free
Post-Run: 74,527,375,360 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30

435 --- E O F --- 2009-08-28 00:52

hunter61 · Aug 31, 2009

Results after ComboFix for DDS

DDS.txt

DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 13:10:36.51 on Mon 08/31/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1916 [GMT -4:00]

AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\ffox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\sb3\SDHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [PCLEPCI] c:\progra~1\pinnacle\ppe\PPE.EXE
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\sb3\SDHelper.dll
LSP: c:\windows\system32\imon.dll
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/tgctlcm.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxp://www.leaguelineup.com/XUpload.ocx
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: RegCompact - RegCompact.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\o8exscw8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\ffox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);
c:\ffox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");
c:\ffox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);
c:\ffox\greprefs\all.js - pref("advanced.always_load_images", true);
c:\ffox\greprefs\all.js - pref("network.protocol-handler.external.help", false);
c:\ffox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds
c:\ffox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds
c:\ffox\greprefs\all.js - pref("network.IDN_show_punycode", true);
c:\ffox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse
c:\ffox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p
c:\ffox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\ffox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\ffox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");
c:\ffox\defaults\pref\firefox.js - pref("app.version",
c:\ffox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");
c:\ffox\defaults\pref\firefox.js - pref("app.build_id",
c:\ffox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates
c:\ffox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");
c:\ffox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);
c:\ffox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was
c:\ffox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc
c:\ffox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals
c:\ffox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar
c:\ffox\defaults\pref\firefox.js - pref("update.severity", 0);
c:\ffox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "update.mozilla.org,addons.mozilla.org");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",
c:\ffox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days
c:\ffox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");

============= SERVICES / DRIVERS ===============

R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2008-5-28 337280]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2008-5-28 54656]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2008-6-24 191848]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2008-6-24 169320]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2008-9-30 1956792]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [2005-8-13 203264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-29 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090830.005\naveng.sys [2009-8-31 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090830.005\navex15.sys [2009-8-31 1323568]
R3 TD3004F60v;TD3004F60v;c:\windows\system32\drivers\TD3004F60v.sys [2009-3-21 24612]
S0 gvlaiid;gvlaiid;c:\windows\system32\drivers\wegn.sys --> c:\windows\system32\drivers\wegn.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]
S3 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
S3 EraserUtilDrv10821;EraserUtilDrv10821;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10821.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10821.sys [?]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10920.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10920.sys [?]
S3 GEMPC430;GEMPLUS GemPC430 USB Smart Card Reader;c:\windows\system32\drivers\gemusb.sys [2001-12-4 53568]
S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [2006-9-16 24784]
S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [2006-9-16 25044]
S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [2006-9-16 55936]
S3 mamm9000mi00;mamm9000mi00;c:\windows\system32\drivers\ma9kmi00.sys [2007-1-22 48724]
S3 mamm9000mi01;mamm9000mi01;c:\windows\system32\drivers\ma9kmi01.sys [2007-1-22 48724]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [2008-12-24 107904]
S3 RmAx;RMAXUSB;c:\windows\system32\drivers\RmAx.sys [2008-8-23 40502]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2008-9-30 116664]
S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [2007-9-6 10430]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\drivers\sustucam.sys [2006-4-12 47360]
S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\drivers\sustucap.sys [2006-4-12 47360]
S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [2006-4-12 28032]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\webcam\watchdog\dogsvc.exe --> c:\program files\webcam\watchdog\dogsvc.exe [?]

=============== Created Last 30 ================

2009-08-31 13:02 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-08-31 11:30 <DIR> a-dshr-- C:\cmdcons
2009-08-31 11:27 229,376 a------- c:\windows\PEV.exe
2009-08-31 11:27 161,792 a------- c:\windows\SWREG.exe
2009-08-31 11:27 98,816 a------- c:\windows\sed.exe
2009-08-31 07:45 <DIR> --d----- C:\sb3
2009-08-30 20:40 56,320 a------- C:\logevent.dll
2009-08-30 20:22 135,168 a------- C:\zip.exe
2009-08-30 20:22 574 a------- C:\cleanup.bat
2009-08-30 20:13 <DIR> --d----- C:\ffox
2009-08-30 20:13 <DIR> --d----- C:\New Folder
2009-08-29 21:14 335 a------- c:\windows\mozregistry.dat
2009-08-29 20:56 <DIR> --d----- c:\documents and settings\administrator\.housecall6.6
2009-08-29 20:42 <DIR> --d----- C:\sb2
2009-08-29 20:29 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 20:29 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-29 20:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 08:53 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-08-29 08:42 123,952 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-29 08:42 60,800 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-29 08:42 10,671 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-29 08:42 805 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-29 08:42 <DIR> --d----- c:\program files\Symantec AntiVirus
2009-08-29 08:32 <DIR> --d----- C:\sb1
2009-08-28 17:04 <DIR> --d----- C:\mwnew
2009-08-28 15:47 0 a------- c:\windows\system32\mapisvc.inf
2009-08-28 15:47 512,096 a------- c:\windows\system32\drivers\amon.sys
2009-08-28 15:47 298,104 a------- c:\windows\system32\imon.dll
2009-08-28 15:47 15,424 a------- c:\windows\system32\drivers\nod32drv.sys
2009-08-28 14:14 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Desktop Search
2009-08-28 14:12 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Search
2009-08-28 00:55 <DIR> --d----- C:\mw
2009-08-28 00:41 <DIR> --d----- C:\sb
2009-08-28 00:36 <DIR> --d----- c:\program files\EMCO Malware Destroyer
2009-08-28 00:26 <DIR> --d----- c:\program files\CCleaner
2009-08-27 22:03 34,816 a------- c:\windows\system32\drivers\winlogon.sys
2009-08-27 20:59 <DIR> --d----- C:\Malwarebytes' Anti-Malware
2009-08-27 19:27 <DIR> --d----- C:\Spybot - Search & Destroy
2009-08-27 18:43 <DIR> --d----- c:\program files\Safer Networking
2009-08-27 17:49 99,965 a------- c:\windows\UninstallFirefox.exe
2009-08-27 17:48 6,052 a------- c:\windows\mozver.dat
2009-08-27 17:24 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-08-27 17:16 <DIR> --dsh--- c:\documents and settings\administrator\IETldCache
2009-08-27 17:03 <DIR> --d----- c:\program files\Enigma Software Group
2009-08-27 12:36 <DIR> --d----- c:\program files\common files\Uninstall
2009-08-27 11:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-12 19:46 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-08-12 19:46 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-08-05 05:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll
2009-08-03 21:21 <DIR> --d----- c:\program files\common files\DivX Shared
2009-08-02 18:04 <DIR> --d----- c:\program files\Scriptocean

==================== Find3M ====================

2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-22 12:11 133,936 a------- c:\windows\~GLC0000.TMP
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 -------- c:\windows\system32\wininet.dll
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2007-08-03 23:10 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT

============= FINISH: 13:10:55.29 ===============

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume4
Install Date: 9/3/2006 8:54:29 PM
System Uptime: 8/31/2009 12:53:42 PM (1 hours ago)

Motherboard: Dell Computer Corp. | | 0T2408
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2792/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 279 GiB total, 69.436 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 153 GiB total, 0.257 GiB free.
G: is FIXED (NTFS) - 37 GiB total, 3.426 GiB free.
H: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 8/31/2009 11:27:27 AM - System Checkpoint

==== Installed Programs ======================

AAC Decoder
ACDSee 6.0 PowerPack
Ad-Aware
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.6 - CPSID_49167
Adobe Acrobat 8.1.6 Professional
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe After Effects CS3 Third Party Content
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Contribute CS3
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS
Adobe Photoshop CS3
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 8.1.6
Adobe Setup
Adobe Shockwave Player 11.5
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
AIM 6
All Occasions EZ Cards
AMUST Registry Cleaner
AOL Instant Messenger
ArcSoft PhotoImpression 4
ArcSoft Software Suite
AutoUpdate
AX Remote Editor 1.1
Battleship
Burpee 3D Garden Designer
Cabela's 4x4 Off-Road Adventure 2
Cabela's Grand Slam
CCleaner (remove only)
Copier
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DataPilot
Delta Force Land Warrior Demo
Dig'nRigs
Digital Voice Recorder
DivX
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
EMCO Malware Destroyer
ERUNT 1.1j
EVGA Display Driver
Family Feud
FileAlyzer
Garmin WebUpdater
Google Earth
Google Toolbar for Internet Explorer
H.264 Decoder
Hanes® T-ShirtMaker® Lite 3.0.0
Hanes® T-ShirtMaker® Lite Upgrade 3.1.0
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hollywood FX 5.5 Additional Effects
Hollywood FX Pack 26 - Extra FX
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 5550 series (Remove only)
iF-22
Intel(R) PRO Network Connections 11.2.0.69
Intel(R) PRO Network Connections Drivers
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 12
Jeopardy! 2nd Edition
LEGO Island
Lernout & Hauspie TruVoice American English TTS Engine
LG LX350 USB - Handset Manager V9.2
LiveUpdate 3.2 (Symantec Corporation)
Macromedia Dreamweaver 4
Macromedia Extension Manager
Macromedia Fireworks 4
Macromedia Flash 5
Malwarebytes' Anti-Malware
Managed DirectX (0901)
MapSource
Matchbox® Caterpillar® Construction Zone 2 Gold Mining CD-ROM
Memorex exPressit Label Design Studio
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Picture It! Photo 2002
Microsoft Plus! for Windows XP
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MioTransfer
MiraScan V4.02
MKV Splitter
Monster Jam
Mozilla Firefox (1.0.2)
MSN
MSN Toolbar
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MVP Baseball 2003
Nero 7 Premium
Nikon Message Center
Nikon View 6
NVIDIA Drivers
PDF Settings
Pinnacle Bender 32-bit
Pinnacle Hollywood FX 4.6
Pinnacle Hollywood FX for Studio
Pinnacle Instant DVD Recorder
Pinnacle PCI Performance Enhancer
PM325 USB-Handset Manager
proDAD Heroglyph 1.0
proDAD Heroglyph 2.0
QuickTime
RealPlayer Basic
Reel Deal Casino - Shuffle Master Edition
Reel Deal Slots 2nd Volume
Reel Deal Slots Nickel Alley
RegAlyzer
Renamer 1.1
Rhapsody
Rhapsody Player Engine
RunAlyzer
Sansa Media Converter
Sanyo Katana (SCP-6600) USB - Handset Manager V9.2
Scriptocean Slideshow 1
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SmartSound Quicktracks Plugin
SpecOps US Army Green Berets
Spybot - Search & Destroy
SpyHunter
Street Atlas USA ® 9.0
Studio 11
Studio 9
Studio 9 Content CD/DVD
SuperDVR
Susteen Launcher
Symantec AntiVirus
The Ultimate Home
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB973815)
USB-IrDA Adapter
VC80CRTRedist - 8.0.50727.762
Verizon Broadband Toolbar
Webcam Watchdog
WebFldrs XP
Webshots Desktop
Wheel of Fortune 2nd Edition
Window Washer
Windows Defender Signatures
Windows Driver Package - Camera Maker (MR97310_USB_DUAL_CAMERA) Image (05/02/2006 2.0.1.0)
Windows Driver Package - Pinnacle Systems (BENDER) Media (11/21/2005 2.0.19.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Desktop Login
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

8/31/2009 8:11:00 AM, error: Service Control Manager [7034] - The Washer Security Access service terminated unexpectedly. It has done this 1 time(s).
8/31/2009 7:38:55 AM, error: Service Control Manager [7000] - The AMON service failed to start due to the following error: The system cannot find the file specified.
8/31/2009 12:52:40 PM, error: PlugPlayManager [11] - The device Root\LEGACY_ROOTREPEAL\0000 disappeared from the system without first being prepared for removal.
8/31/2009 12:43:34 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
8/31/2009 11:29:48 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
8/31/2009 10:35:16 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/30/2009 7:12:33 AM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The system cannot find the path specified.
8/29/2009 9:46:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
8/29/2009 9:38:28 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
8/29/2009 9:38:28 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\basic\setup.exe. Reference error message: The operation completed successfully. .
8/29/2009 9:38:28 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
8/29/2009 9:38:27 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
8/29/2009 8:23:29 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm nod32drv SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/29/2009 8:20:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
8/29/2009 8:19:18 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT nod32drv RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/28/2019 4:10:45 PM, error: Print [19] - Sharing printer failed + 1722, Printer Microsoft XPS Document Writer share name Printer.
8/28/2019 3:51:55 PM, error: Service Control Manager [7031] - The NOD32 Kernel Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
8/28/2019 3:51:55 PM, error: Service Control Manager [7000] - The NOD32 Kernel Service service failed to start due to the following error: Access is denied.
8/28/2009 3:45:04 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
8/28/2009 3:44:55 PM, error: SRService [104] - The System Restore initialization process failed.
8/28/2009 2:27:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/28/2009 2:25:45 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
8/28/2009 2:19:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
8/28/2009 12:32:45 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
8/28/2009 10:21:36 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer NEW_BOYS_PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{58ACD3AA-4488-42. The master browser is stopping or an election is being forced.
8/28/2009 1:24:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD ehdrv epfwtdir Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/27/2009 8:53:25 PM, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%5" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
8/27/2009 8:53:04 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
8/27/2009 6:38:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/27/2009 5:56:11 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: Access is denied.
8/27/2009 5:44:33 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the crd service to connect.
8/27/2009 5:44:33 PM, error: Service Control Manager [7000] - The crd service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/27/2009 5:38:47 PM, error: Service Control Manager [7038] - The WinDefend service was unable to log on as .\administrator with the currently configured password due to the following error: Logon failure: unknown user name or bad password. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
8/27/2009 5:38:47 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: The service did not start due to a logon failure.
8/27/2009 12:34:33 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
8/27/2009 11:56:47 AM, information: Windows File Protection [64007] - The protected system file eventlog.dll could not be verified as valid because the file was in use. Use the SFC utility to verify the integrity of the file at a later time.
8/27/2009 11:01:11 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip
8/27/2009 10:29:19 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
8/27/2009 10:25:35 PM, error: Cdrom [15] - The device, \Device\CdRom2, is not ready for access yet.

==== End Of File ===========================

Just like to say thank you again, I realy appreciate your assistance!

Blade81 · Aug 31, 2009

Hi again,

Open notepad and copy/paste the text in the quotebox below into it:

Code:

Driver::
gvlaiid
File::
c:\windows\system32\drivers\wegn.sys
Folder::
c:\program files\LimeWire
c:\documents and settings\Gina\Application Data\LimeWire
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=-
Regnull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Uninstall Mozilla Firefox (1.0.2). If you still use Firefox then you may get the latest version here.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 16.
Click the
Download
button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log. Run win32kdiag again and post back its report too.

hunter61 · Sep 1, 2009

Results from combfix part 1

ComboFix 09-08-30.04 - Administrator 08/31/2009 14:04.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1977 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\windows\system32\drivers\wegn.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Gina\Application Data\LimeWire
c:\documents and settings\Gina\Application Data\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
c:\documents and settings\Gina\Application Data\LimeWire\412splashfree.png
c:\documents and settings\Gina\Application Data\LimeWire\active.mojito
c:\documents and settings\Gina\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\auth.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\find.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\places.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\update.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\freebl3.chk
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\freebl3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\js3250.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\LICENSE
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\debug.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\utils.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\mozctl.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nspr4.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nss3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\platform.ini
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\plc4.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\plds4.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\README.txt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\designmode.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\forms.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\html.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\language.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\mathml.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\quirk.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\svg.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\ua.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\smime3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\softokn3.chk
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\softokn3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\ssl3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\updater.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\version.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpcom.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpidl.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xul.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
c:\documents and settings\Gina\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Gina\Application Data\LimeWire\data.ser
c:\documents and settings\Gina\Application Data\LimeWire\downloads.dat
c:\documents and settings\Gina\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Gina\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Gina\Application Data\LimeWire\filters.props
c:\documents and settings\Gina\Application Data\LimeWire\installation.props
c:\documents and settings\Gina\Application Data\LimeWire\library.dat
c:\documents and settings\Gina\Application Data\LimeWire\library5.dat
c:\documents and settings\Gina\Application Data\LimeWire\limewire.props
c:\documents and settings\Gina\Application Data\LimeWire\lock
c:\documents and settings\Gina\Application Data\LimeWire\mojito.props
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\.autoreg
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\30B5DE57d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\4C4B6535d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\7BD6A121d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\98E79480d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\AE98BDFBd01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\B7E8F4C3d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\BAFF9A89d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\D5267890d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\cert8.db
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\compreg.dat
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\cookies.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\downloads.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\extensions.cache
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\extensions.ini
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\history.dat
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\key3.db
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\permissions.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\places.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\pluginreg.dat
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\prefs.js
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\secmod.db
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\XPC.mfl
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\xpti.dat
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.log
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\Gina\Application Data\LimeWire\pub1.key
c:\documents and settings\Gina\Application Data\LimeWire\public.key
c:\documents and settings\Gina\Application Data\LimeWire\questions.props
c:\documents and settings\Gina\Application Data\LimeWire\responses.cache
c:\documents and settings\Gina\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Gina\Application Data\LimeWire\simpp.xml
c:\documents and settings\Gina\Application Data\LimeWire\spam.dat
c:\documents and settings\Gina\Application Data\LimeWire\tables.props
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\dir_closed.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\dir_open.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\lime.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\logo.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\notsearching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\dir_open.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\logo.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\notsearching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\search.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\lime.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\logo.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\notsearching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\logo.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\notsearching.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\version.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\ttree.cache
c:\documents and settings\Gina\Application Data\LimeWire\ttrees.cache
c:\documents and settings\Gina\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Gina\Application Data\LimeWire\update.xml
c:\documents and settings\Gina\Application Data\LimeWire\version.key
c:\documents and settings\Gina\Application Data\LimeWire\version.xml
c:\documents and settings\Gina\Application Data\LimeWire\versions.props
c:\documents and settings\Gina\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\video.xsd
c:\program files\LimeWire
c:\program files\LimeWire\hs_err_pid1516.log
c:\program files\LimeWire\hs_err_pid3656.log
c:\program files\LimeWire\hs_err_pid4304.log
c:\program files\LimeWire\hs_err_pid5200.log

hunter61 · Sep 1, 2009

Combfix part 2

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gvlaiid

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 )))))))))))))))))))))))))))))))
.

2009-08-31 11:45 . 2009-08-31 11:45 -------- d-----w- C:\sb3
2009-08-31 00:40 . 2008-04-14 00:11 56320 ----a-w- C:\logevent.dll
2009-08-31 00:22 . 2009-08-31 00:22 574 ----a-w- C:\cleanup.bat
2009-08-31 00:22 . 2009-08-31 00:22 135168 ----a-w- C:\zip.exe
2009-08-31 00:13 . 2009-08-31 00:14 -------- d-----w- C:\ffox
2009-08-31 00:13 . 2009-08-31 00:13 -------- d-----w- C:\New Folder
2009-08-30 01:14 . 2009-08-30 01:14 335 ----a-w- c:\windows\mozregistry.dat
2009-08-30 00:56 . 2009-08-30 01:19 -------- d-----w- c:\documents and settings\Administrator\.housecall6.6
2009-08-30 00:42 . 2009-08-30 00:51 -------- d-----w- C:\sb2
2009-08-30 00:29 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-30 00:29 . 2009-08-30 00:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-30 00:29 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 12:53 . 2009-08-30 00:56 102664 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2009-08-29 12:53 . 2009-08-29 12:54 -------- d-----w- c:\documents and settings\Gina\.housecall6.6
2009-08-29 12:42 . 2009-08-29 12:42 60800 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-29 12:42 . 2009-08-29 12:42 123952 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-29 12:42 . 2009-08-31 18:32 -------- d-----w- c:\program files\Symantec AntiVirus
2009-08-29 12:32 . 2009-08-29 12:34 -------- d-----w- C:\sb1
2009-08-28 21:04 . 2009-08-28 21:05 -------- d-----w- C:\mwnew
2009-08-28 19:47 . 2009-08-28 19:47 298104 ----a-w- c:\windows\system32\imon.dll
2009-08-28 19:47 . 2009-08-28 19:47 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2009-08-28 19:47 . 2009-08-28 19:47 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2009-08-28 18:14 . 2009-08-28 18:14 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-08-28 18:14 . 2009-08-28 18:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Desktop Search
2009-08-28 18:12 . 2009-08-28 18:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2009-08-28 12:55 . 2009-08-28 12:59 -------- d-----w- c:\program files\ERUNT
2009-08-28 04:55 . 2009-08-28 04:55 -------- d-----w- C:\mw
2009-08-28 04:41 . 2009-08-28 04:42 -------- d-----w- C:\sb
2009-08-28 04:36 . 2009-08-28 04:37 -------- d-----w- c:\program files\EMCO Malware Destroyer
2009-08-28 04:27 . 2009-08-28 04:27 -------- d-----w- c:\documents and settings\Gina\Application Data\Yahoo!
2009-08-28 04:27 . 2009-08-28 04:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-08-28 04:26 . 2009-08-28 04:27 -------- d-----w- c:\program files\CCleaner
2009-08-28 02:03 . 2009-08-28 02:03 34816 ----a-w- c:\windows\system32\drivers\winlogon.sys
2009-08-28 00:59 . 2009-08-28 00:59 -------- d-----w- C:\Malwarebytes' Anti-Malware
2009-08-28 00:20 . 2009-08-28 00:32 -------- d-----w- c:\program files\RegCure
2009-08-27 23:27 . 2009-08-28 02:47 -------- d-----w- C:\Spybot - Search & Destroy
2009-08-27 22:45 . 2009-08-27 22:45 -------- d-----w- c:\documents and settings\Gina\Application Data\Safer Networking
2009-08-27 22:43 . 2009-08-27 22:47 -------- d-----w- c:\program files\Safer Networking
2009-08-27 21:49 . 2009-08-31 00:13 99965 ----a-w- c:\windows\UninstallFirefox.exe
2009-08-27 21:48 . 2009-08-31 00:13 6052 ----a-w- c:\windows\mozver.dat
2009-08-27 21:43 . 2009-08-31 11:56 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-08-27 21:43 . 2009-08-27 21:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Ahead
2009-08-27 21:43 . 2009-08-27 21:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2009-08-27 21:28 . 2009-08-27 21:28 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AMUST
2009-08-27 21:24 . 2009-08-27 21:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-27 21:16 . 2009-08-27 21:16 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-27 21:05 . 2009-08-27 21:07 -------- d-----w- c:\program files\Windows Live Safety Center
2009-08-27 21:03 . 2009-08-27 21:03 -------- d-----w- c:\program files\Enigma Software Group
2009-08-27 16:36 . 2009-08-27 16:36 -------- d-----w- c:\program files\Common Files\Uninstall
2009-08-27 15:55 . 2009-08-27 15:55 -------- d-----w- c:\documents and settings\Gina\Application Data\Malwarebytes
2009-08-27 15:55 . 2009-08-27 15:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-26 12:21 . 2009-08-26 12:38 -------- d-----w- c:\documents and settings\Gina\Application Data\mp3rocket
2009-08-12 23:46 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 01:21 . 2009-08-04 01:22 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-08-02 22:04 . 2009-08-02 22:04 -------- d-----w- c:\documents and settings\Gina\Application Data\scriptocean
2009-08-02 22:04 . 2009-08-02 22:04 -------- d-----w- c:\program files\Scriptocean

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 15:01 . 2009-02-04 11:17 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-08-31 11:46 . 2007-01-11 00:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-29 12:43 . 2009-06-21 15:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-29 12:42 . 2009-06-21 15:35 -------- d-----w- c:\program files\Symantec
2009-08-29 12:42 . 2009-08-29 12:42 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-29 12:42 . 2009-08-29 12:42 10671 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-29 12:42 . 2009-06-21 15:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-08-28 04:27 . 2006-10-06 23:05 -------- d-----w- c:\program files\Yahoo!
2009-08-28 01:18 . 2007-03-15 02:16 -------- d-----w- c:\program files\Windows Defender
2009-08-27 23:18 . 2007-01-11 00:55 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-25 17:36 . 2007-07-01 12:23 -------- d-----w- c:\program files\DivX
2009-08-14 00:00 . 2007-07-16 11:36 87 ----a-w- c:\windows\Winsus0.dat
2009-08-13 02:09 . 2006-09-10 13:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-13 02:09 . 2007-07-16 11:16 -------- d-----w- c:\program files\Susteen
2009-08-05 20:16 . 2008-09-07 15:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2004-08-04 04:56 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 01:25 . 2006-09-30 02:45 -------- d-----w- c:\program files\Google
2009-07-31 02:58 . 2007-10-12 14:33 -------- d-----w- c:\program files\Coupons
2009-07-22 16:11 . 2009-07-22 16:11 133936 ----a-w- c:\windows\~GLC0000.TMP
2009-07-22 11:03 . 2009-03-28 01:23 -------- d-----w- c:\program files\Fast Browser SearchP
2009-07-17 19:01 . 2004-08-04 04:56 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2004-08-04 04:56 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-04 04:56 915456 ------w- c:\windows\system32\wininet.dll
2009-07-01 14:21 . 2006-04-12 14:24 28032 ----a-w- c:\windows\system32\drivers\sustucau.sys
2009-07-01 14:21 . 2006-04-12 17:01 47360 ----a-w- c:\windows\system32\drivers\sustucap.sys
2009-07-01 14:21 . 2006-04-12 17:01 47360 ----a-w- c:\windows\system32\drivers\sustucam.sys
2009-06-18 23:28 . 2007-08-09 16:46 119792 ----a-w- c:\documents and settings\John\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-16 14:36 . 2004-08-07 00:16 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 04:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 04:56 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 04:56 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-12 10:12 . 2009-06-12 10:12 1915520 ----a-w- c:\documents and settings\Gina\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-06-10 14:13 . 2004-08-04 04:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2006-09-04 00:47 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-04 04:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-04 04:56 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-06-02 23:50 . 2009-06-02 23:50 536 ----a-w- c:\windows\eReg.dat
2005-03-17 23:02 . 2009-08-30 01:14 44153 ----a-w- c:\program files\mozilla firefox\components\inspector.dll
2005-03-17 23:02 . 2009-08-27 21:48 41573 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2005-03-17 23:02 . 2009-08-27 21:48 48223 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2005-03-17 23:02 . 2009-08-27 21:48 158823 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-31_16.56.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-31 18:19 . 2009-08-31 18:19 16384 c:\windows\temp\Perflib_Perfdata_390.dat
+ 2004-08-07 00:17 . 2009-08-31 18:40 79074 c:\windows\system32\perfc009.dat
- 2004-08-07 00:17 . 2009-08-31 15:27 79074 c:\windows\system32\perfc009.dat
+ 2004-08-07 00:17 . 2009-08-31 18:40 465380 c:\windows\system32\perfh009.dat
- 2004-08-07 00:17 . 2009-08-31 15:27 465380 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-27 148888]
"SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2009-04-02 868352]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-04 98304]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"PCLEPCI"="c:\progra~1\Pinnacle\PPE\PPE.EXE" [2004-02-03 49152]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-15 623992]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-06-24 53096]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2008-09-30 125368]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Gina\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2008-7-5 157000]

c:\documents and settings\John\Start Menu\Programs\Startup\
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2008-7-5 157000]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RegCompact]
2005-11-21 23:22 135168 ----a-w- c:\windows\system32\RegCompact.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [8/13/2005 5:18 AM 203264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 8:45 AM 102448]
R3 TD3004F60v;TD3004F60v;c:\windows\system32\drivers\TD3004F60v.sys [3/21/2009 9:32 AM 24612]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
S3 EraserUtilDrv10821;EraserUtilDrv10821;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10821.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10821.sys [?]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10920.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10920.sys [?]
S3 GEMPC430;GEMPLUS GemPC430 USB Smart Card Reader;c:\windows\system32\drivers\gemusb.sys [12/4/2001 10:03 AM 53568]
S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [9/16/2006 12:00 AM 24784]
S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [9/16/2006 12:00 AM 25044]
S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [9/16/2006 12:00 AM 55936]
S3 mamm9000mi00;mamm9000mi00;c:\windows\system32\drivers\ma9kmi00.sys [1/22/2007 10:47 AM 48724]
S3 mamm9000mi01;mamm9000mi01;c:\windows\system32\drivers\ma9kmi01.sys [1/22/2007 10:51 AM 48724]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [12/24/2008 4:06 PM 107904]
S3 RmAx;RMAXUSB;c:\windows\system32\drivers\RmAx.sys [8/23/2008 4:31 PM 40502]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/30/2008 5:41 PM 116664]
S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [9/6/2007 9:49 AM 10430]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\drivers\sustucam.sys [4/12/2006 1:01 PM 47360]
S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\drivers\sustucap.sys [4/12/2006 1:01 PM 47360]
S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [4/12/2006 10:24 AM 28032]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\Webcam\Watchdog\dogsvc.exe --> c:\program files\Webcam\Watchdog\dogsvc.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-15 c:\windows\Tasks\Gina backup.job
- c:\program files\AMUST\Registry Cleaner\RegCleaner.exe [2008-09-15 23:22]

2009-08-22 c:\windows\Tasks\Gina scan and fix.job
- c:\program files\AMUST\Registry Cleaner\RegCleaner.exe [2008-09-15 23:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o8exscw8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\ffox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);
c:\ffox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
c:\ffox\greprefs\all.js - pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");
c:\ffox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);
c:\ffox\greprefs\all.js - pref("advanced.always_load_images", true);
c:\ffox\greprefs\all.js - pref("network.protocol-handler.external.help", false);
c:\ffox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds
c:\ffox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds
c:\ffox\greprefs\all.js - pref("network.IDN_show_punycode", true);
c:\ffox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse
c:\ffox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p
c:\ffox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\ffox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\ffox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");
c:\ffox\defaults\pref\firefox.js - pref("app.version",
c:\ffox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");
c:\ffox\defaults\pref\firefox.js - pref("app.build_id",
c:\ffox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates
c:\ffox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");
c:\ffox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);
c:\ffox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was
c:\ffox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme
c:\ffox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc
c:\ffox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals
c:\ffox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar
c:\ffox\defaults\pref\firefox.js - pref("update.severity", 0);
c:\ffox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "update.mozilla.org,addons.mozilla.org");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");
c:\ffox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",
c:\ffox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);
c:\ffox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days
c:\ffox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);
c:\ffox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-31 14:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\RegCompact.dll

- - - - - - - > 'lsass.exe'(864)
c:\windows\system32\imon.dll

- - - - - - - > 'explorer.exe'(3504)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\system32\scardsvr.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wwSecure.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-08-31 14:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-31 18:46
ComboFix2.txt 2009-08-31 17:04

Pre-Run: 74,541,031,424 bytes free
Post-Run: 74,456,211,456 bytes free

857 --- E O F --- 2009-08-28 00:52

hunter61 · Sep 1, 2009

Kapersky & win32Kdiag results

Kapersky results:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, August 31, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, August 31, 2009 20:54:15
Records in database: 2732386
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\

Scan statistics:
Objects scanned: 392936
Threats found: 6
Infected objects found: 8
Suspicious objects found: 10
Scan duration: 07:38:41

File name / Threat / Threats count
C:\Documents and Settings\All Users\Documents\highjack\new\backup-20060208-194131-831.dll.XXX Infected: not-a-virus:AdWare.Win32.Coupons 1
C:\Documents and Settings\Gina\.housecall6.6\Quarantine\setup.exe.bac_a02568 Infected: not-a-virus

SWTool.Win32.OEPass.l 1
C:\Documents and Settings\Gina\Local Settings\Application Data\Microsoft\Outlook\archive1.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 10
C:\downloads\highjack\new\backup-20060208-194131-831.dll.XXX Infected: not-a-virus:AdWare.Win32.Coupons 1
C:\downloads\Vnc\vnc-3.3.6-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c 1
C:\downloads\Vnc\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.333 1
C:\downloads\Vnc\vncviewer1.exe\vnc_x86_win32\vncviewer\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.333 1
C:\downloads\Vnc\vnc_x86_win32\vncviewer\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.333 1
F:\Documents and Settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1

Selected area has been scanned.

Win32kDiag

Starting up...
Log file is located at: C:\Documents and Settings\Administrator\Desktop\Win32kDi
ag.txt
WARNING: Could not get backup privileges!
Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\oobe\sample\sample
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\spool\drivers\w32x86\3\temp\temp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\mof\good\good
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\wins\wins
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\system32\xircom\xircom
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\twain_32\Mira4_03\Mira4_03
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
Mount point destination : \Device\__max++>\^
Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18
e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.507
27.1433_x-ww_5cf844d2
Mount point destination : \Device\__max++>\^

Finished! Press any key to exit...

hunter61 · Sep 1, 2009

CombFix part1

ComboFix 09-08-30.04 - Administrator 08/31/2009 14:04.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1977 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\windows\system32\drivers\wegn.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Gina\Application Data\LimeWire
c:\documents and settings\Gina\Application Data\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
c:\documents and settings\Gina\Application Data\LimeWire\412splashfree.png
c:\documents and settings\Gina\Application Data\LimeWire\active.mojito
c:\documents and settings\Gina\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\auth.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\find.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\places.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\update.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\freebl3.chk
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\freebl3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\js3250.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\LICENSE
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\debug.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\utils.js
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\mozctl.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nspr4.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nss3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\platform.ini
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\plc4.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\plds4.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\README.txt
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\designmode.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\forms.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\html.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\language.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\mathml.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\quirk.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\svg.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\ua.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\smime3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\softokn3.chk
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\softokn3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\ssl3.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\updater.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\version.properties
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpcom.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpidl.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xul.dll
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
c:\documents and settings\Gina\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
c:\documents and settings\Gina\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Gina\Application Data\LimeWire\data.ser
c:\documents and settings\Gina\Application Data\LimeWire\downloads.dat
c:\documents and settings\Gina\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Gina\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Gina\Application Data\LimeWire\filters.props
c:\documents and settings\Gina\Application Data\LimeWire\installation.props
c:\documents and settings\Gina\Application Data\LimeWire\library.dat
c:\documents and settings\Gina\Application Data\LimeWire\library5.dat
c:\documents and settings\Gina\Application Data\LimeWire\limewire.props
c:\documents and settings\Gina\Application Data\LimeWire\lock
c:\documents and settings\Gina\Application Data\LimeWire\mojito.props
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\.autoreg
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\30B5DE57d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\4C4B6535d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\7BD6A121d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\98E79480d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\AE98BDFBd01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\B7E8F4C3d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\BAFF9A89d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\Cache\D5267890d01
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\cert8.db
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\compreg.dat
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\cookies.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\downloads.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\extensions.cache
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\extensions.ini
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\history.dat
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\key3.db
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\permissions.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\places.sqlite
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\pluginreg.dat
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\prefs.js
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\secmod.db
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\XPC.mfl
c:\documents and settings\Gina\Application Data\LimeWire\mozilla-profile\xpti.dat
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.log
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\Gina\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\Gina\Application Data\LimeWire\pub1.key
c:\documents and settings\Gina\Application Data\LimeWire\public.key
c:\documents and settings\Gina\Application Data\LimeWire\questions.props
c:\documents and settings\Gina\Application Data\LimeWire\responses.cache
c:\documents and settings\Gina\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Gina\Application Data\LimeWire\simpp.xml
c:\documents and settings\Gina\Application Data\LimeWire\spam.dat
c:\documents and settings\Gina\Application Data\LimeWire\tables.props
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\dir_closed.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\dir_open.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\lime.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\logo.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\notsearching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\black_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\dir_open.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\logo.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\notsearching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\search.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\classic_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\lime.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\logo.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\notsearching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\limewire_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\logo.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\notsearching.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\other_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\version.txt
c:\documents and settings\Gina\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Gina\Application Data\LimeWire\ttree.cache
c:\documents and settings\Gina\Application Data\LimeWire\ttrees.cache
c:\documents and settings\Gina\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Gina\Application Data\LimeWire\update.xml
c:\documents and settings\Gina\Application Data\LimeWire\version.key
c:\documents and settings\Gina\Application Data\LimeWire\version.xml
c:\documents and settings\Gina\Application Data\LimeWire\versions.props
c:\documents and settings\Gina\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Gina\Application Data\LimeWire\xml\schemas\video.xsd
c:\program files\LimeWire
c:\program files\LimeWire\hs_err_pid1516.log
c:\program files\LimeWire\hs_err_pid3656.log
c:\program files\LimeWire\hs_err_pid4304.log
c:\program files\LimeWire\hs_err_pid5200.log

Blade81 · Sep 1, 2009

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the Open box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
"%userprofile%\desktop\win32kdiag.exe" -f -r

hunter61 · Sep 1, 2009

Results from win32kdiag

Starting up...
Log file is located at: C:\Documents and Settings\Administrator\Desktop\Win32kDi
ag.txt
Removing all found mount points.
Attempting to reset file permissions.
WARNING: Could not get backup privileges!
Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\mui\dispspec\dispspec
Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
Found mount point : C:\WINDOWS\system32\oobe\sample\sample
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\oobe\sample\sample
Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\ShellExt\ShellExt
Found mount point : C:\WINDOWS\system32\spool\drivers\w32x86\3\temp\temp
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\spool\drivers\w32x86\3\temp\temp
Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\wbem\mof\bad\bad
Found mount point : C:\WINDOWS\system32\wbem\mof\good\good
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\wbem\mof\good\good
Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\wbem\snmp\snmp
Found mount point : C:\WINDOWS\system32\wins\wins
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\wins\wins
Found mount point : C:\WINDOWS\system32\xircom\xircom
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\system32\xircom\xircom
Found mount point : C:\WINDOWS\twain_32\Mira4_03\Mira4_03
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\twain_32\Mira4_03\Mira4_03
Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp
Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18
e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.507
27.1433_x-ww_5cf844d2
Mount point destination : \Device\__max++>\^
Removing mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b
_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.
1433_x-ww_5cf844d2

Finished! Press any key to exit...

This may sound funny but this virus is smart, last night it seems that it might of corupted my Firefox app and I had to reload it. Thanks again for all your hard work

Blade81 · Sep 1, 2009

This may sound funny but this virus is smart, last night it seems that it might of corupted my Firefox app and I had to reload it.

Hi,

Was the issue in Firefox that some sites appeared wrong? That may be result of temporary items cleaning. In those cases Firefox cache cleaning usually helps

Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Delete these files if found:
C:\Documents and Settings\All Users\Documents\highjack\new\backup-20060208-194131-831.dll.XXX
C:\Documents and Settings\Gina\.housecall6.6\Quarantine\setup.exe.bac_a02568
C:\downloads\highjack\new\backup-20060208-194131-831.dll.XXX

Post a fresh dds.txt log and let me know how's the system running.

hunter61 · Sep 1, 2009

DDS results

I believe you are correct with Firefox. Things look so much better. I was able to run Malwarebytes without it stopping. Running spybot too now. Here are the logs:

DDS.txt:

DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 13:24:26.79 on Tue 09/01/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1900 [GMT -4:00]

AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\sb3\SpybotSD.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\sb3\SDHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [PCLEPCI] c:\progra~1\pinnacle\ppe\PPE.EXE
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\sb3\SDHelper.dll
LSP: c:\windows\system32\imon.dll
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/tgctlcm.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxp://www.leaguelineup.com/XUpload.ocx
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: RegCompact - RegCompact.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\9pbdnab7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2008-5-28 337280]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2008-5-28 54656]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2008-6-24 191848]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2008-6-24 169320]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2008-9-30 1956792]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [2005-8-13 203264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-29 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090830.005\naveng.sys [2009-8-31 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090830.005\navex15.sys [2009-8-31 1323568]
R3 TD3004F60v;TD3004F60v;c:\windows\system32\drivers\TD3004F60v.sys [2009-3-21 24612]
S0 shsx;shsx;c:\windows\system32\drivers\uukimh.sys --> c:\windows\system32\drivers\uukimh.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]
S3 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
S3 EraserUtilDrv10821;EraserUtilDrv10821;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10821.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10821.sys [?]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10920.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10920.sys [?]
S3 GEMPC430;GEMPLUS GemPC430 USB Smart Card Reader;c:\windows\system32\drivers\gemusb.sys [2001-12-4 53568]
S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [2006-9-16 24784]
S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [2006-9-16 25044]
S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [2006-9-16 55936]
S3 mamm9000mi00;mamm9000mi00;c:\windows\system32\drivers\ma9kmi00.sys [2007-1-22 48724]
S3 mamm9000mi01;mamm9000mi01;c:\windows\system32\drivers\ma9kmi01.sys [2007-1-22 48724]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [2008-12-24 107904]
S3 RmAx;RMAXUSB;c:\windows\system32\drivers\RmAx.sys [2008-8-23 40502]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2008-9-30 116664]
S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [2007-9-6 10430]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\drivers\sustucam.sys [2006-4-12 47360]
S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\drivers\sustucap.sys [2006-4-12 47360]
S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [2006-4-12 28032]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\webcam\watchdog\dogsvc.exe --> c:\program files\webcam\watchdog\dogsvc.exe [?]

=============== Created Last 30 ================

2009-08-31 15:10 73,728 a------- c:\windows\system32\javacpl.cpl
2009-08-31 14:53 <DIR> --d----- c:\documents and settings\administrator\.SunDownloadManager
2009-08-31 13:02 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-08-31 11:30 <DIR> a-dshr-- C:\cmdcons
2009-08-31 11:27 229,376 a------- c:\windows\PEV.exe
2009-08-31 11:27 161,792 a------- c:\windows\SWREG.exe
2009-08-31 11:27 98,816 a------- c:\windows\sed.exe
2009-08-31 07:45 <DIR> --d----- C:\sb3
2009-08-30 20:40 56,320 a------- C:\logevent.dll
2009-08-30 20:22 135,168 a------- C:\zip.exe
2009-08-30 20:22 574 a------- C:\cleanup.bat
2009-08-30 20:13 <DIR> --d----- C:\ffox
2009-08-30 20:13 <DIR> --d----- C:\New Folder
2009-08-29 21:14 335 a------- c:\windows\mozregistry.dat
2009-08-29 20:56 <DIR> --d----- c:\documents and settings\administrator\.housecall6.6
2009-08-29 20:42 <DIR> --d----- C:\sb2
2009-08-29 20:29 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 20:29 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-29 20:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 08:53 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-08-29 08:42 123,952 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-29 08:42 60,800 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-29 08:42 10,671 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-29 08:42 805 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-29 08:42 <DIR> --d----- c:\program files\Symantec AntiVirus
2009-08-29 08:32 <DIR> --d----- C:\sb1
2009-08-28 17:04 <DIR> --d----- C:\mwnew
2009-08-28 15:47 0 a------- c:\windows\system32\mapisvc.inf
2009-08-28 15:47 512,096 a------- c:\windows\system32\drivers\amon.sys
2009-08-28 15:47 298,104 a------- c:\windows\system32\imon.dll
2009-08-28 15:47 15,424 a------- c:\windows\system32\drivers\nod32drv.sys
2009-08-28 14:14 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Desktop Search
2009-08-28 14:12 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Search
2009-08-28 00:55 <DIR> --d----- C:\mw
2009-08-28 00:41 <DIR> --d----- C:\sb
2009-08-28 00:26 <DIR> --d----- c:\program files\CCleaner
2009-08-27 20:59 <DIR> --d----- C:\Malwarebytes' Anti-Malware
2009-08-27 19:27 <DIR> --d----- C:\Spybot - Search & Destroy
2009-08-27 18:43 <DIR> --d----- c:\program files\Safer Networking
2009-08-27 17:49 99,965 a------- c:\windows\UninstallFirefox.exe
2009-08-27 17:48 6,052 a------- c:\windows\mozver.dat
2009-08-27 17:24 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-08-27 17:16 <DIR> --dsh--- c:\documents and settings\administrator\IETldCache
2009-08-27 17:03 <DIR> --d----- c:\program files\Enigma Software Group
2009-08-27 12:36 <DIR> --d----- c:\program files\common files\Uninstall
2009-08-27 11:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-12 19:46 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-08-12 19:46 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-08-05 05:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll
2009-08-03 21:21 <DIR> --d----- c:\program files\common files\DivX Shared
2009-08-02 18:04 <DIR> --d----- c:\program files\Scriptocean

==================== Find3M ====================

2009-08-31 15:09 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-22 12:11 133,936 a------- c:\windows\~GLC0000.TMP
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 -------- c:\windows\system32\wininet.dll
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2007-08-03 23:10 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT

============= FINISH: 13:25:14.54 ===============

Attach.txt:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume4
Install Date: 9/3/2006 8:54:29 PM
System Uptime: 9/1/2009 1:08:35 PM (0 hours ago)

Motherboard: Dell Computer Corp. | | 0T2408
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2792/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 279 GiB total, 69.878 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 153 GiB total, 0.257 GiB free.
G: is FIXED (NTFS) - 37 GiB total, 3.426 GiB free.
H: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP6: 9/1/2009 8:43:08 AM - Installed Java(TM) 6 Update 16
RP7: 9/1/2009 9:36:24 AM - Removed Hanes® T-ShirtMaker® Lite 3.0.0

==== Installed Programs ======================

AAC Decoder
ACDSee 6.0 PowerPack
Ad-Aware
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.6 - CPSID_49167
Adobe Acrobat 8.1.6 Professional
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe After Effects CS3 Third Party Content
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Contribute CS3
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS
Adobe Photoshop CS3
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 8.1.6
Adobe Setup
Adobe Shockwave Player 11.5
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
AIM 6
All Occasions EZ Cards
AMUST Registry Cleaner
AOL Instant Messenger
ArcSoft PhotoImpression 4
ArcSoft Software Suite
AutoUpdate
AX Remote Editor 1.1
Battleship
Burpee 3D Garden Designer
Cabela's 4x4 Off-Road Adventure 2
Cabela's Grand Slam
CCleaner (remove only)
Copier
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DataPilot
Delta Force Land Warrior Demo
Dig'nRigs
Digital Voice Recorder
DivX
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
EVGA Display Driver
Family Feud
FileAlyzer
Garmin WebUpdater
Google Earth
Google Toolbar for Internet Explorer
H.264 Decoder
Hanes® T-ShirtMaker® Lite Upgrade 3.1.0
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hollywood FX 5.5 Additional Effects
Hollywood FX Pack 26 - Extra FX
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 5550 series (Remove only)
iF-22
Intel(R) PRO Network Connections 11.2.0.69
Intel(R) PRO Network Connections Drivers
Java(TM) 6 Update 16
Jeopardy! 2nd Edition
LEGO Island
Lernout & Hauspie TruVoice American English TTS Engine
LG LX350 USB - Handset Manager V9.2
LiveUpdate 3.2 (Symantec Corporation)
Macromedia Dreamweaver 4
Macromedia Extension Manager
Macromedia Fireworks 4
Macromedia Flash 5
Malwarebytes' Anti-Malware
Managed DirectX (0901)
MapSource
Matchbox® Caterpillar® Construction Zone 2 Gold Mining CD-ROM
Memorex exPressit Label Design Studio
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Picture It! Photo 2002
Microsoft Plus! for Windows XP
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MioTransfer
MiraScan V4.02
MKV Splitter
Monster Jam
Mozilla Firefox (3.5.2)
MSN
MSN Toolbar
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MVP Baseball 2003
Nero 7 Premium
Nikon Message Center
Nikon View 6
NVIDIA Drivers
PDF Settings
Pinnacle Bender 32-bit
Pinnacle Hollywood FX 4.6
Pinnacle Hollywood FX for Studio
Pinnacle Instant DVD Recorder
Pinnacle PCI Performance Enhancer
PM325 USB-Handset Manager
proDAD Heroglyph 1.0
proDAD Heroglyph 2.0
QuickTime
RealPlayer Basic
Reel Deal Casino - Shuffle Master Edition
Reel Deal Slots 2nd Volume
Reel Deal Slots Nickel Alley
RegAlyzer
Renamer 1.1
Rhapsody
Rhapsody Player Engine
RunAlyzer
Sansa Media Converter
Sanyo Katana (SCP-6600) USB - Handset Manager V9.2
Scriptocean Slideshow 1
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SmartSound Quicktracks Plugin
SpecOps US Army Green Berets
Spybot - Search & Destroy
SpyHunter
Street Atlas USA ® 9.0
Studio 11
Studio 9
Studio 9 Content CD/DVD
SuperDVR
Susteen Launcher
Symantec AntiVirus
The Ultimate Home
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB973815)
USB-IrDA Adapter
VC80CRTRedist - 8.0.50727.762
Verizon Broadband Toolbar
Webcam Watchdog
WebFldrs XP
Webshots Desktop
Wheel of Fortune 2nd Edition
Window Washer
Windows Defender Signatures
Windows Driver Package - Camera Maker (MR97310_USB_DUAL_CAMERA) Image (05/02/2006 2.0.1.0)
Windows Driver Package - Pinnacle Systems (BENDER) Media (11/21/2005 2.0.19.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Desktop Login
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

9/1/2009 8:43:00 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000003A' while processing the file 'dispspec' on the volume 'HarddiskVolume4'. It has stopped monitoring the volume.
8/31/2009 8:11:00 AM, error: Service Control Manager [7034] - The Washer Security Access service terminated unexpectedly. It has done this 1 time(s).
8/31/2009 7:38:55 AM, error: Service Control Manager [7000] - The AMON service failed to start due to the following error: The system cannot find the file specified.
8/31/2009 12:52:40 PM, error: PlugPlayManager [11] - The device Root\LEGACY_ROOTREPEAL\0000 disappeared from the system without first being prepared for removal.
8/31/2009 12:43:34 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
8/31/2009 11:29:48 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
8/31/2009 10:35:16 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/30/2009 7:12:33 AM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The system cannot find the path specified.
8/29/2009 9:46:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
8/29/2009 9:38:28 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
8/29/2009 9:38:28 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\basic\setup.exe. Reference error message: The operation completed successfully. .
8/29/2009 9:38:28 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
8/29/2009 9:38:27 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
8/29/2009 8:23:29 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm nod32drv SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/29/2009 8:20:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
8/29/2009 8:19:18 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT nod32drv RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/28/2019 4:10:47 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
8/28/2019 4:10:47 PM, error: Service Control Manager [7000] - The NOD32 Kernel Service service failed to start due to the following error: Access is denied.
8/28/2019 4:10:45 PM, error: SRService [104] - The System Restore initialization process failed.
8/28/2019 4:10:45 PM, error: Print [19] - Sharing printer failed + 1722, Printer Microsoft XPS Document Writer share name Printer.
8/28/2019 3:59:36 PM, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%5" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
8/28/2019 3:51:55 PM, error: Service Control Manager [7031] - The NOD32 Kernel Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
8/28/2009 2:27:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/28/2009 2:25:45 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
8/28/2009 2:19:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
8/28/2009 12:32:45 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
8/28/2009 10:21:36 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer NEW_BOYS_PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{58ACD3AA-4488-42. The master browser is stopping or an election is being forced.
8/28/2009 1:24:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD ehdrv epfwtdir Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/27/2009 8:53:04 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
8/27/2009 6:38:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/27/2009 5:56:11 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: Access is denied.
8/27/2009 5:44:33 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the crd service to connect.
8/27/2009 5:44:33 PM, error: Service Control Manager [7000] - The crd service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/27/2009 5:38:47 PM, error: Service Control Manager [7038] - The WinDefend service was unable to log on as .\administrator with the currently configured password due to the following error: Logon failure: unknown user name or bad password. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
8/27/2009 5:38:47 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: The service did not start due to a logon failure.
8/27/2009 12:34:33 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
8/27/2009 11:56:47 AM, information: Windows File Protection [64007] - The protected system file eventlog.dll could not be verified as valid because the file was in use. Use the SFC utility to verify the integrity of the file at a later time.
8/27/2009 11:01:11 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip
8/27/2009 10:29:19 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
8/27/2009 10:25:35 PM, error: Cdrom [15] - The device, \Device\CdRom2, is not ready for access yet.

==== End Of File ===========================

Thnak you agin for all you assistance!!

Blade81 · Sep 1, 2009

Hi,

Seems that Nod32 wasn't earlier completely removed. Please try removal tool available here. When done, post a fresh dds.txt log.

I was able to run Malwarebytes without it stopping. Running spybot too now.

Did you run scan with these? Any bad items found?

hunter61 · Sep 1, 2009

Results

Yes Mlalware found a few issues see log below. I ran the nod32 removal tool. And here are the new dds logs.

Malwarebytes Log

Malwarebytes' Anti-Malware 1.40
Database version: 2725
Windows 5.1.2600 Service Pack 3

9/1/2009 1:06:29 PM
mbam-log-2009-09-01 (13-06-29).txt

Scan type: Full Scan (C:\|F:\|G:\|H:\|)
Objects scanned: 502369
Time elapsed: 2 hour(s), 45 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Common Files\Uninstall\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Common Files\Uninstall\PersonalAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\winlogon.sys (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

DDT.txt:

DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 15:27:41.15 on Tue 09/01/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1885 [GMT -4:00]

AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\sb3\SDHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [PCLEPCI] c:\progra~1\pinnacle\ppe\PPE.EXE
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\sb3\SDHelper.dll
LSP: c:\windows\system32\imon.dll
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/tgctlcm.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BDEE1959-AB6B-4745-A29B-F492861102CC}
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxp://www.leaguelineup.com/XUpload.ocx
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: RegCompact - RegCompact.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\9pbdnab7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US

fficial
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2008-5-28 337280]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2008-5-28 54656]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2008-6-24 191848]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2008-6-24 169320]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2008-9-30 1956792]
R3 BENDER;Pinnacle AV/DV2 Capture;c:\windows\system32\drivers\bender.sys [2005-8-13 203264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-29 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090830.005\naveng.sys [2009-8-31 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090830.005\navex15.sys [2009-8-31 1323568]
R3 TD3004F60v;TD3004F60v;c:\windows\system32\drivers\TD3004F60v.sys [2009-3-21 24612]
S0 shsx;shsx;c:\windows\system32\drivers\uukimh.sys --> c:\windows\system32\drivers\uukimh.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]
S3 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
S3 EraserUtilDrv10821;EraserUtilDrv10821;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10821.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10821.sys [?]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10920.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10920.sys [?]
S3 GEMPC430;GEMPLUS GemPC430 USB Smart Card Reader;c:\windows\system32\drivers\gemusb.sys [2001-12-4 53568]
S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [2006-9-16 24784]
S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [2006-9-16 25044]
S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [2006-9-16 55936]
S3 mamm9000mi00;mamm9000mi00;c:\windows\system32\drivers\ma9kmi00.sys [2007-1-22 48724]
S3 mamm9000mi01;mamm9000mi01;c:\windows\system32\drivers\ma9kmi01.sys [2007-1-22 48724]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [2008-12-24 107904]
S3 RmAx;RMAXUSB;c:\windows\system32\drivers\RmAx.sys [2008-8-23 40502]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2008-9-30 116664]
S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [2007-9-6 10430]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\drivers\sustucam.sys [2006-4-12 47360]
S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\drivers\sustucap.sys [2006-4-12 47360]
S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [2006-4-12 28032]
S4 Webcam Corp. Service Starter;Webcam Corp. Service Starter;c:\program files\webcam\watchdog\dogsvc.exe --> c:\program files\webcam\watchdog\dogsvc.exe [?]

=============== Created Last 30 ================

2009-08-31 15:10 73,728 a------- c:\windows\system32\javacpl.cpl
2009-08-31 14:53 <DIR> --d----- c:\documents and settings\administrator\.SunDownloadManager
2009-08-31 13:02 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-08-31 11:30 <DIR> a-dshr-- C:\cmdcons
2009-08-31 11:27 229,376 a------- c:\windows\PEV.exe
2009-08-31 11:27 161,792 a------- c:\windows\SWREG.exe
2009-08-31 11:27 98,816 a------- c:\windows\sed.exe
2009-08-31 07:45 <DIR> --d----- C:\sb3
2009-08-30 20:40 56,320 a------- C:\logevent.dll
2009-08-30 20:22 135,168 a------- C:\zip.exe
2009-08-30 20:22 574 a------- C:\cleanup.bat
2009-08-30 20:13 <DIR> --d----- C:\ffox
2009-08-30 20:13 <DIR> --d----- C:\New Folder
2009-08-29 21:14 335 a------- c:\windows\mozregistry.dat
2009-08-29 20:56 <DIR> --d----- c:\documents and settings\administrator\.housecall6.6
2009-08-29 20:42 <DIR> --d----- C:\sb2
2009-08-29 20:29 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 20:29 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-29 20:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 08:53 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-08-29 08:42 123,952 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-29 08:42 60,800 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-29 08:42 10,671 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-29 08:42 805 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-29 08:42 <DIR> --d----- c:\program files\Symantec AntiVirus
2009-08-29 08:32 <DIR> --d----- C:\sb1
2009-08-28 17:04 <DIR> --d----- C:\mwnew
2009-08-28 15:47 0 a------- c:\windows\system32\mapisvc.inf
2009-08-28 15:47 512,096 a------- c:\windows\system32\drivers\amon.sys
2009-08-28 15:47 298,104 a------- c:\windows\system32\imon.dll
2009-08-28 15:47 15,424 a------- c:\windows\system32\drivers\nod32drv.sys
2009-08-28 14:14 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Desktop Search
2009-08-28 14:12 <DIR> --d----- c:\docume~1\admini~1\applic~1\Windows Search
2009-08-28 00:55 <DIR> --d----- C:\mw
2009-08-28 00:41 <DIR> --d----- C:\sb
2009-08-28 00:26 <DIR> --d----- c:\program files\CCleaner
2009-08-27 20:59 <DIR> --d----- C:\Malwarebytes' Anti-Malware
2009-08-27 19:27 <DIR> --d----- C:\Spybot - Search & Destroy
2009-08-27 18:43 <DIR> --d----- c:\program files\Safer Networking
2009-08-27 17:49 99,965 a------- c:\windows\UninstallFirefox.exe
2009-08-27 17:48 6,052 a------- c:\windows\mozver.dat
2009-08-27 17:24 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-08-27 17:16 <DIR> --dsh--- c:\documents and settings\administrator\IETldCache
2009-08-27 17:03 <DIR> --d----- c:\program files\Enigma Software Group
2009-08-27 12:36 <DIR> --d----- c:\program files\common files\Uninstall
2009-08-27 11:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-12 19:46 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
2009-08-12 19:46 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
2009-08-05 05:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll
2009-08-03 21:21 <DIR> --d----- c:\program files\common files\DivX Shared
2009-08-02 18:04 <DIR> --d----- c:\program files\Scriptocean

==================== Find3M ====================

2009-08-31 15:09 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-22 12:11 133,936 a------- c:\windows\~GLC0000.TMP
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 -------- c:\windows\system32\wininet.dll
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2007-08-03 23:10 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT

============= FINISH: 15:28:09.14 ===============

Attach.txt:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume4
Install Date: 9/3/2006 8:54:29 PM
System Uptime: 9/1/2009 1:08:35 PM (2 hours ago)

Motherboard: Dell Computer Corp. | | 0T2408
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2792/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 279 GiB total, 69.976 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 153 GiB total, 0.257 GiB free.
G: is FIXED (NTFS) - 37 GiB total, 3.426 GiB free.
H: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP6: 9/1/2009 8:43:08 AM - Installed Java(TM) 6 Update 16
RP7: 9/1/2009 9:36:24 AM - Removed Hanes® T-ShirtMaker® Lite 3.0.0

==== Installed Programs ======================

AAC Decoder
ACDSee 6.0 PowerPack
Ad-Aware
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.6 - CPSID_49167
Adobe Acrobat 8.1.6 Professional
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe After Effects CS3 Third Party Content
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Contribute CS3
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS
Adobe Photoshop CS3
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 8.1.6
Adobe Setup
Adobe Shockwave Player 11.5
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
AIM 6
All Occasions EZ Cards
AMUST Registry Cleaner
AOL Instant Messenger
ArcSoft PhotoImpression 4
ArcSoft Software Suite
AutoUpdate
AX Remote Editor 1.1
Battleship
Burpee 3D Garden Designer
Cabela's 4x4 Off-Road Adventure 2
Cabela's Grand Slam
CCleaner (remove only)
Copier
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DataPilot
Delta Force Land Warrior Demo
Dig'nRigs
Digital Voice Recorder
DivX
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
EVGA Display Driver
Family Feud
FileAlyzer
Garmin WebUpdater
Google Earth
Google Toolbar for Internet Explorer
H.264 Decoder
Hanes® T-ShirtMaker® Lite Upgrade 3.1.0
High Definition Audio Driver Package - KB888111
HijackThis 1.99.1
Hollywood FX 5.5 Additional Effects
Hollywood FX Pack 26 - Extra FX
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
hp deskjet 5550 series (Remove only)
iF-22
Intel(R) PRO Network Connections 11.2.0.69
Intel(R) PRO Network Connections Drivers
Java(TM) 6 Update 16
Jeopardy! 2nd Edition
LEGO Island
Lernout & Hauspie TruVoice American English TTS Engine
LG LX350 USB - Handset Manager V9.2
LiveUpdate 3.2 (Symantec Corporation)
Macromedia Dreamweaver 4
Macromedia Extension Manager
Macromedia Fireworks 4
Macromedia Flash 5
Malwarebytes' Anti-Malware
Managed DirectX (0901)
MapSource
Matchbox® Caterpillar® Construction Zone 2 Gold Mining CD-ROM
Memorex exPressit Label Design Studio
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Picture It! Photo 2002
Microsoft Plus! for Windows XP
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MioTransfer
MiraScan V4.02
MKV Splitter
Monster Jam
Mozilla Firefox (3.5.2)
MSN
MSN Toolbar
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MVP Baseball 2003
Nero 7 Premium
Nikon Message Center
Nikon View 6
NVIDIA Drivers
PDF Settings
Pinnacle Bender 32-bit
Pinnacle Hollywood FX 4.6
Pinnacle Hollywood FX for Studio
Pinnacle Instant DVD Recorder
Pinnacle PCI Performance Enhancer
PM325 USB-Handset Manager
proDAD Heroglyph 1.0
proDAD Heroglyph 2.0
QuickTime
RealPlayer Basic
Reel Deal Casino - Shuffle Master Edition
Reel Deal Slots 2nd Volume
Reel Deal Slots Nickel Alley
RegAlyzer
Renamer 1.1
Rhapsody
Rhapsody Player Engine
RunAlyzer
Sansa Media Converter
Sanyo Katana (SCP-6600) USB - Handset Manager V9.2
Scriptocean Slideshow 1
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SmartSound Quicktracks Plugin
SpecOps US Army Green Berets
Spybot - Search & Destroy
SpyHunter
Street Atlas USA ® 9.0
Studio 11
Studio 9
Studio 9 Content CD/DVD
SuperDVR
Susteen Launcher
Symantec AntiVirus
The Ultimate Home
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB973815)
USB-IrDA Adapter
VC80CRTRedist - 8.0.50727.762
Verizon Broadband Toolbar
Webcam Watchdog
WebFldrs XP
Webshots Desktop
Wheel of Fortune 2nd Edition
Window Washer
Windows Defender Signatures
Windows Driver Package - Camera Maker (MR97310_USB_DUAL_CAMERA) Image (05/02/2006 2.0.1.0)
Windows Driver Package - Pinnacle Systems (BENDER) Media (11/21/2005 2.0.19.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Desktop Login
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

9/1/2009 8:43:00 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000003A' while processing the file 'dispspec' on the volume 'HarddiskVolume4'. It has stopped monitoring the volume.
8/31/2009 8:11:00 AM, error: Service Control Manager [7034] - The Washer Security Access service terminated unexpectedly. It has done this 1 time(s).
8/31/2009 7:38:55 AM, error: Service Control Manager [7000] - The AMON service failed to start due to the following error: The system cannot find the file specified.
8/31/2009 12:52:40 PM, error: PlugPlayManager [11] - The device Root\LEGACY_ROOTREPEAL\0000 disappeared from the system without first being prepared for removal.
8/31/2009 12:43:34 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
8/31/2009 11:29:48 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
8/31/2009 10:35:16 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/30/2009 7:12:33 AM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The system cannot find the path specified.
8/29/2009 9:46:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
8/29/2009 9:38:28 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
8/29/2009 9:38:28 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\basic\setup.exe. Reference error message: The operation completed successfully. .
8/29/2009 9:38:28 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
8/29/2009 9:38:27 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
8/29/2009 8:23:29 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm nod32drv SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/29/2009 8:20:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
8/29/2009 8:19:18 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT nod32drv RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip WS2IFSL
8/28/2019 4:10:47 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
8/28/2019 4:10:47 PM, error: Service Control Manager [7000] - The NOD32 Kernel Service service failed to start due to the following error: Access is denied.
8/28/2019 4:10:45 PM, error: SRService [104] - The System Restore initialization process failed.
8/28/2019 4:10:45 PM, error: Print [19] - Sharing printer failed + 1722, Printer Microsoft XPS Document Writer share name Printer.
8/28/2019 3:59:36 PM, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%5" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
8/28/2019 3:51:55 PM, error: Service Control Manager [7031] - The NOD32 Kernel Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
8/28/2009 2:27:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/28/2009 2:25:45 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
8/28/2009 2:19:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
8/28/2009 12:32:45 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
8/28/2009 10:21:36 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer NEW_BOYS_PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{58ACD3AA-4488-42. The master browser is stopping or an election is being forced.
8/28/2009 1:24:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD ehdrv epfwtdir Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:51 PM, error: Service Control Manager [7001] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/28/2009 1:24:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/27/2009 8:53:04 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
8/27/2009 6:38:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl Fips intelppm SAVRT SAVRTPEL SPBBCDrv SYMTDI
8/27/2009 5:56:11 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: Access is denied.
8/27/2009 5:44:33 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the crd service to connect.
8/27/2009 5:44:33 PM, error: Service Control Manager [7000] - The crd service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/27/2009 5:38:47 PM, error: Service Control Manager [7038] - The WinDefend service was unable to log on as .\administrator with the currently configured password due to the following error: Logon failure: unknown user name or bad password. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
8/27/2009 5:38:47 PM, error: Service Control Manager [7000] - The Windows Defender service failed to start due to the following error: The service did not start due to a logon failure.
8/27/2009 12:34:33 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
8/27/2009 11:56:47 AM, information: Windows File Protection [64007] - The protected system file eventlog.dll could not be verified as valid because the file was in use. Use the SFC utility to verify the integrity of the file at a later time.
8/27/2009 11:01:11 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip
8/27/2009 10:29:19 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
8/27/2009 10:25:35 PM, error: Cdrom [15] - The device, \Device\CdRom2, is not ready for access yet.

==== End Of File ===========================

Thank you Again!

Blade81 · Sep 2, 2009

Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.

THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis

We need to re hide system files. To do so, please follow the steps below:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Put a check by
Hide file extensions for known file types.
Under the
Hidden files
folder, select
Show hidden files and folders.
Check
Hide protected operating system files.
Click Apply, and then click OK.

Now lets uninstall ComboFix:

Click START then RUN
Now copy-paste Combofix /u in the runbox and click OK

Next we remove all used tools.

Please download OTC and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

DDS can be deleted too.

UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

hosts file:
- Every version of windows has a hosts file as part of them.
- In a very basic sense, they are used to locate webpages.
- We can customize a hosts file so that it blocks certain webpages.
- However, it can slow down certain computers.
- This is why using a hosts file is optional!!
Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
1. [*]Click the start button (at the lower left hand corner of your screen) [*]Click run [*]In the dialog box, type services.msc [*]hit enter, then locate dns client [*]Highlight it, then double-click it. [*]On the dropdown box, change the setting from automatic to manual. [*]Click ok
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free or Comodo Firewall Pro (If you choose Comodo: Uncheck during installation "Install Comodo HopSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and install firewall ONLY!). Both providers have support forums that help with configuration related questions.

Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade

hunter61 · Sep 4, 2009

Thank you so much for all your assistance!

Blade,

I really appreciate all you hard work, I can't thank you enough/ My system is working great and all scan software has been coming back clean now. Thank you again !!

Regards

Hunter61

Can not run Spybot or anyother Malware remover or viewer

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

New member

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member