Cannot get rid of files after infection from trojans and malware

dillyyo72 · Aug 27, 2009

My son was surfing and going P2P and he told me he got some viruses. When I scanned my comp with Rising anti virus and Spy bot I got back some nasty stuff, from what I found on the internet. I ran both several times in safe mode and removed as much as I could find and was informed I should online.

Symptoms were freeze ups, lagging, locked policies like no tsk mgr, no back ground etc. It was also diabling my antivirus and not letting me log into programs. I got much of it back, but things are still there. In particular 4 files that show up in spy bot yet the files are not there. I am including an HJT report (renamed to dillyyo72.exe), a spy bot report with some malware (registry errors) and 4 files that are always there even after fixing and what shows up on the microsoft live online scan I am running as we speak.

I don't know if this is related, but my DVD will not read blank discs. I ran a dell diagnostic and all came out good, so dell.s people told me I just have to reformat and reinstall the OS. Not preferable, but might be necessary. Can you tell me if this would get rid of all infections I might have? Is it safe to transfer all my docs, pics and videos to an external drive before reformatting with no risk of virus transfer? I would scan them before transfer.

Well, here is the reports I mentioned. Thansk for the help.

Spy Bot:

AdDestination: [SBI $20815D48] Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d85588fb-8da5-cdab-f31d-6bab71677c02

Win32.FraudLoad.edt: [SBI $0174D446] Settings (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\NordBull

Win32.FraudLoad.edt: [SBI $0174D446] Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-18\Software\NordBull

Win32.TDSS.rtk: [SBI $4568377B] File (File, nothing done)
C:\WINDOWS\system32\drivers\kbiwkmqjuyxwrm.sys
Properties.size=0
Properties.md5=F6A71590FFB7F4816DDBC6F22CFE055C

Win32.TDSS.rtk: [SBI $6BF0B3E5] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmferpxuck.dll
Properties.size=0
Properties.md5=3B4644E78E6DF95C7B6433E4EAE0E7D0

Win32.TDSS.rtk: [SBI $6BF0B3E5] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmmcjsbaet.dll
Properties.size=0
Properties.md5=796E92D2B25B6FB4352674BA449B7393

Win32.TDSS.rtk: [SBI $D8151B64] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmaogspjoc.dat
Properties.size=0
Properties.md5=7D04C2822F4F7536EA0B0AFE6436FF14

Win32.TDSS.rtk: [SBI $D8151B64] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmqpvgppwi.dat
Properties.size=0
Properties.md5=60B665DE07DEFEDCD1107BC6FA549206

--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-08-20 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-07-28 advcheck.dll (1.6.3.17)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-08-25 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-05-19 Includes\Dialer.sbi (*)
2009-08-25 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-08-04 Includes\HijackersC.sbi (*)
2009-06-23 Includes\Keyloggers.sbi (*)
2009-07-30 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-08-19 Includes\Malware.sbi (*)
2009-08-25 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-08-25 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-07-30 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-08-11 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-08-25 Includes\Trojans.sbi (*)
2009-08-26 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

The Win32 files are the ones that keep coming back, but are not where it says they are.

HJK report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:44:42 PM, on 8/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCENTER.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\RavMonD.exe
C:\Program Files\Rising\Rav\rsnetsvr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Rising\Rav\ScanFrm.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\Rising\Rav\RsTray.exe
C:\Program Files\Native Instruments\Audio Kontrol 1\Audio Kontrol 1.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Dillyyo72.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:81
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R3 - URLSearchHook: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: precisead - {bf386b10-fd3b-eed5-2442-8fcb4e6e963e} - C:\WINDOWS\system32\nse80.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [TkBellExe] "realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [RavTray] "C:\Program Files\Rising\Rav\RsTray.exe" -system
O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\gvwf.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Audio Kontrol 1] C:\Program Files\Native Instruments\Audio Kontrol 1\Audio Kontrol 1.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Wireless USB 2.0 WLAN Card Utility.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.beatport.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommon/download/tgctlcm.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145072392000
O16 - DPF: {C7477E5B-9297-4083-A4B3-A6BBC611F7C9} - http://www.blackberry.com/CalendarPatch/patch/desktop/DevicePatchLoaderUSB.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Rav Process Communication Center (RavCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCENTER.EXE
O23 - Service: Rising RavTask Manager (RavTask) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavTask.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: RoxMediaDB9 - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavMonD.exe
O23 - Service: Rising Scan Service (RsScanSrv) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\ScanFrm.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--
End of file - 9809 bytes

The Microsoft online scanner is running still. It shows 4 detections and 3 issues found, so i will include them after it is done.

:sad:

I read about limewire and deleted the program. This is the latest run HJT (no limewire), Spy Bot and info from Microsoft online scanning. I couldn't print a report or copy and paste so I am just typing what is says in the protection part:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:25:20, on 27/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCENTER.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\rsnetsvr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\Rising\Rav\RsTray.exe
C:\Program Files\Native Instruments\Audio Kontrol 1\Audio Kontrol 1.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Rising\Rav\ScanFrm.exe
C:\Program Files\Rising\Rav\RavMonD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\Dillyyo72.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [TkBellExe] "realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [RavTray] "C:\Program Files\Rising\Rav\RsTray.exe" -system
O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\gvwf.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Wireless USB 2.0 WLAN Card Utility.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommon/download/tgctlcm.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145072392000
O16 - DPF: {C7477E5B-9297-4083-A4B3-A6BBC611F7C9} - http://www.blackberry.com/CalendarPatch/patch/desktop/DevicePatchLoaderUSB.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Rav Process Communication Center (RavCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCENTER.EXE
O23 - Service: Rising RavTask Manager (RavTask) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavTask.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: RoxMediaDB9 - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavMonD.exe
O23 - Service: Rising Scan Service (RsScanSrv) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\ScanFrm.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--
End of file - 9392 bytes

AdDestination: [SBI $20815D48] Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\d85588fb-8da5-cdab-f31d-6bab71677c02

Win32.FraudLoad.edt: [SBI $0174D446] Settings (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\NordBull

Win32.FraudLoad.edt: [SBI $0174D446] Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-18\Software\NordBull

Win32.TDSS.rtk: [SBI $4568377B] File (File, nothing done)
C:\WINDOWS\system32\drivers\kbiwkmqjuyxwrm.sys
Properties.size=0
Properties.md5=F6A71590FFB7F4816DDBC6F22CFE055C

Win32.TDSS.rtk: [SBI $6BF0B3E5] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmferpxuck.dll
Properties.size=0
Properties.md5=3B4644E78E6DF95C7B6433E4EAE0E7D0

Win32.TDSS.rtk: [SBI $6BF0B3E5] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmmcjsbaet.dll
Properties.size=0
Properties.md5=796E92D2B25B6FB4352674BA449B7393

Win32.TDSS.rtk: [SBI $D8151B64] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmaogspjoc.dat
Properties.size=0
Properties.md5=7D04C2822F4F7536EA0B0AFE6436FF14

Win32.TDSS.rtk: [SBI $D8151B64] File (File, nothing done)
C:\WINDOWS\system32\kbiwkmqpvgppwi.dat
Properties.size=0
Properties.md5=60B665DE07DEFEDCD1107BC6FA549206

--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-08-20 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-07-28 advcheck.dll (1.6.3.17)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-08-25 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-05-19 Includes\Dialer.sbi (*)
2009-08-25 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-08-04 Includes\HijackersC.sbi (*)
2009-06-23 Includes\Keyloggers.sbi (*)
2009-07-30 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-08-19 Includes\Malware.sbi (*)
2009-08-25 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-08-25 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-07-30 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-08-11 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-08-25 Includes\Trojans.sbi (*)
2009-08-26 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

I had 4 severe and 2 high issues found with the online scanner.

-Trojan:Win32/Alureon.gen!U
-Trojan downloader:Win32/fakeinit
-VirTool:Win32/DelfInject.gen!T
-VirTool:Win32/Obfuscator.ET

Trojan:JS/Agent.FA
TrojanDownloader:Win32/Renos.JM

I have noticed that Outlook has had to reinstall (didn't let it complete) and I can't seem to find my PST files.:sad:
=================================
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Shaba · Aug 29, 2009

Hi dillyyo72

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

dillyyo72 · Aug 29, 2009

ComboFix 09-08-28.05 - Jonathan Malave 29/08/2009 12:08.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2558.2156 [GMT -4:00]
Running from: c:\documents and settings\Jonathan Malave\Desktop\ComboFix.exe
AV: Rising Antivirus *On-access scanning disabled* (Updated) {234E4A88-48FA-4220-A994-5323706FF524}
* Created a new restore point
* Resident AV is active

.
/wow section not completed

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\kbiwkmqjuyxwrm.sys
c:\windows\system32\kbiwkmaogspjoc.dat
c:\windows\system32\kbiwkmferpxuck.dll
c:\windows\system32\kbiwkmmcjsbaet.dll
c:\windows\system32\kbiwkmqpvgppwi.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kbiwkmlnbpjyod
-------\Legacy_kbiwkmlnbpjyod
-------\Legacy_hooksys
-------\Service_hooksys

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-29 )))))))))))))))))))))))))))))))
.

2009-08-29 04:22 . 2009-08-29 04:23 -------- dc-h--w- c:\windows\ie8
2009-08-29 04:20 . 2009-08-29 04:20 -------- dc----w- C:\11d6fc14b292ca73a9d0
2009-08-26 23:38 . 2009-08-26 23:38 -------- dc----w- c:\program files\microsoft frontpage
2009-08-26 00:07 . 2009-08-26 15:31 58341 -c--a-w- c:\windows\system32\u_bcetlkvlynfjpjnk.dll.exe
2009-08-25 21:17 . 2009-08-29 15:25 86005 -c--a-w- c:\windows\system32\d85588fb-8da5-cdab-f31d-6bab71677c02.exe
2009-08-25 21:17 . 2009-08-25 21:47 48273 -c--a-w- c:\windows\system32\zwozzmkwrxq.exe
2009-08-25 21:14 . 2009-08-25 21:14 4 -c--a-w- c:\documents and settings\Jonathan Malave\Application Data\NP.sys
2009-08-25 21:13 . 2009-08-25 21:13 134144 -c--a-w- c:\windows\ceids88045.exe
2009-08-25 21:12 . 2009-08-25 21:12 412160 -c--a-w- c:\windows\denc4602.exe
2009-08-25 21:12 . 2009-08-26 17:42 -------- dc----w- c:\program files\runit
2009-08-25 21:12 . 2009-08-25 21:12 69697 -c--a-w- c:\windows\avqhl4521.exe
2009-08-25 21:12 . 2009-08-25 21:12 889078 -c--a-w- c:\windows\avge04557.exe
2009-08-21 23:34 . 2009-08-21 23:35 -------- dc----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-21 23:34 . 2009-08-21 23:34 -------- dc----w- c:\program files\NOS
2009-08-20 20:24 . 2009-08-20 20:25 -------- dc----w- c:\program files\Spybot - Search & Destroy
2009-08-14 19:16 . 2009-08-14 19:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Citrix
2009-08-14 19:16 . 2009-08-14 19:16 -------- dc----w- c:\documents and settings\Jonathan Malave\Local Settings\Application Data\Citrix
2009-08-12 02:25 . 2009-08-12 02:25 152576 -c--a-w- c:\documents and settings\Jonathan Malave\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 15:53 . 2006-04-14 19:57 49072 -c--a-w- c:\documents and settings\Jonathan Malave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 01:30 . 2006-07-26 02:00 -------- dc----w- c:\program files\Web Publish
2009-08-27 21:22 . 2006-12-17 14:55 -------- dc----w- c:\program files\Windows Live Safety Center
2009-08-26 21:58 . 2006-04-14 23:52 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-26 02:38 . 2008-11-14 06:14 -------- dc----w- c:\documents and settings\Jonathan Malave\Application Data\LimeWire
2009-08-12 02:26 . 2007-06-26 06:11 -------- dc----w- c:\program files\Java
2009-08-11 23:05 . 2009-07-08 03:30 34200 -c--a-w- c:\windows\system32\drivers\HookHelp.sys
2009-08-11 23:05 . 2009-07-08 03:30 144024 -c--a-w- c:\windows\system32\drivers\HookSys.sys
2009-08-06 23:52 . 2007-06-10 05:33 -------- dc----w- c:\documents and settings\Jonathan Malave\Application Data\dvdcss
2009-08-05 09:01 . 2004-08-12 13:23 204800 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:29 . 2006-04-14 20:23 -------- dc-h--w- c:\program files\InstallShield Installation Information
2009-07-25 09:23 . 2009-07-16 01:55 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-07-24 04:05 . 2009-07-24 04:06 737280 -c--a-w- c:\windows\iun6002.exe
2009-07-17 19:01 . 2004-08-12 13:17 58880 -c--a-w- c:\windows\system32\atl.dll
2009-07-16 01:54 . 2009-07-16 01:54 152576 -c--a-w- c:\documents and settings\Jonathan Malave\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-07-14 19:40 . 2009-03-11 17:18 -------- dc----w- c:\program files\Google
2009-07-14 19:12 . 2008-07-07 04:41 -------- dc----w- c:\program files\Windows Live
2009-07-14 19:11 . 2008-07-14 19:02 -------- dc----w- c:\program files\Common Files\Apple
2009-07-14 03:43 . 2004-08-12 13:34 286208 -c--a-w- c:\windows\system32\wmpdxm.dll
2009-07-08 03:29 . 2009-07-08 03:30 15216 -c--a-w- c:\windows\system32\drivers\HookCont.sys
2009-07-08 03:28 . 2009-07-08 03:30 238704 -c--a-w- c:\windows\system32\bsmain.exe
2009-07-08 03:28 . 2009-07-08 03:30 10832 -c--a-w- c:\windows\system32\drivers\RsNTGdi.sys
2009-07-08 03:28 . 2009-07-08 03:30 146032 -c--a-w- c:\windows\system32\RavExt.dll
2009-07-08 03:21 . 2006-04-14 19:59 -------- dc----w- c:\program files\Rising
2009-07-08 03:20 . 2009-07-08 03:20 -------- dc----w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
2009-07-08 03:18 . 2006-05-07 06:48 -------- dc----w- c:\program files\Common Files\Adobe
2009-07-02 14:14 . 2009-07-02 14:14 1338368 -c--a-w- c:\windows\system32\nshE.dll
2009-06-29 16:12 . 2004-08-12 13:33 827392 -c----w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-12 13:18 17408 -c----w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2004-08-12 13:32 54272 -c--a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-12 13:28 56832 -c--a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-12 13:27 147456 -c--a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-12 13:23 136192 -c--a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-08-12 13:21 730112 -c--a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-12 13:20 301568 -c--a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-12 13:20 92928 -c--a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-08-12 13:30 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-12 13:19 81920 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-12 13:31 80896 -c--a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-12 13:30 76288 -c--a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-12 13:17 84992 -c--a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2006-04-14 19:48 2066432 -c--a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-12 13:33 132096 -c--a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-12 13:26 1291264 -c--a-w- c:\windows\system32\quartz.dll
2007-09-12 15:19 . 2007-12-01 14:44 8784 -c--a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-09-12 15:22 . 2007-12-01 14:44 245408 -c--a-w- c:\program files\mozilla firefox\plugins\unicows.dll
2007-06-08 06:24 . 2007-06-08 06:24 10856 -csha-w- c:\windows\system32\KGyGaAvL.sys
2006-12-24 13:19 . 2006-12-24 13:19 73 -csha-w- c:\windows\system32\SYSDRVREB.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf386b10-fd3b-eed5-2442-8fcb4e6e963e}]
2009-07-02 14:14 1338368 -c--a-w- c:\windows\system32\nshE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2003-05-15 163840]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2003-05-15 114688]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-10-28 181544]
"RavTray"="c:\program files\Rising\Rav\RsTray.exe" [2009-07-08 141936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-08-03 4493312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2006-4-14 209016]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{32CD708B-60A7-4C00-9377-D73EAA495F0F}"= "c:\windows\system32\RavExt.dll" [2009-07-08 146032]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 bsmain

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"winupdate.exe"=c:\windows\system32\winupdate.exe
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rising\\Rav\\Update\\Setup.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Roxio\\Media Manager 9\\MediaManager9.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP

xpsp2res.dll,-22009

R0 RsNTGDI;RsNTGDI;c:\windows\system32\drivers\RsNTGdi.sys [07/07/2009 23:30 10832]
R1 hookcont;hookcont;c:\windows\system32\drivers\HookCont.sys [07/07/2009 23:30 15216]
R2 BaseTDI;Rising TDI Base Driver;c:\windows\system32\drivers\basetdi.sys [14/04/2006 16:42 13364]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [28/10/2008 16:42 156968]
R2 RavTask;Rising RavTask Manager;c:\program files\Rising\Rav\RavTask.exe [07/07/2009 23:30 129648]
R3 ak1avs;ak1avs;c:\windows\system32\drivers\ak1avs.sys [25/04/2009 23:43 25600]
R3 ak1usb;ak1usb;c:\windows\system32\drivers\ak1usb.sys [25/04/2009 23:43 186368]
S2 RavCCenter;Rav Process Communication Center;c:\program files\Rising\Rav\CCenter.exe [07/07/2009 23:30 113264]
S2 RsRavMon;Rising RealTime Monitor;c:\program files\Rising\Rav\RavMonD.exe [07/07/2009 23:30 133744]
S2 RsScanSrv;Rising Scan Service;c:\program files\Rising\Rav\ScanFrm.exe [07/07/2009 23:30 51824]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [18/10/2006 13:01 16512]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [12/08/2004 09:30 14336]
S4 PRISMSVC;PRISMSVC;c:\windows\system32\PRISMSVC.exe [14/04/2006 16:23 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-TkBellExe - realsched.exe

.
------- Supplementary Scan -------
.
DPF: {C7477E5B-9297-4083-A4B3-A6BBC611F7C9} - hxxp://www.blackberry.com/CalendarPatch/patch/desktop/DevicePatchLoaderUSB.cab
FF - ProfilePath - c:\documents and settings\Jonathan Malave\Application Data\Mozilla\Firefox\Profiles\3ag8935g.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 12:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3224)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Rising\Rav\rsnetsvr.exe
c:\program files\APC\APC PowerChute Personal Edition\mainserv.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\hpzipm12.exe
c:\program files\Analog Devices\SoundMAX\spkrmon.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\PRISMSVR.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\HP\Digital Imaging\bin\hpqtra08.exe
c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
c:\program files\APC\APC PowerChute Personal Edition\apcsystray.exe
.
**************************************************************************
.
Completion time: 2009-08-29 12:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-29 16:38

Pre-Run: 10,348,044,288 bytes free
Post-Run: 10,243,104,768 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

265 --- E O F --- 2009-08-26 00:21

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:54, on 29/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCENTER.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\RavMonD.exe
C:\Program Files\Rising\Rav\rsnetsvr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Rising\Rav\ScanFrm.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Rising\Rav\RsTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\Dillyyo72.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: precisead - {bf386b10-fd3b-eed5-2442-8fcb4e6e963e} - C:\WINDOWS\system32\nshE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [RavTray] "C:\Program Files\Rising\Rav\RsTray.exe" -system
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Wireless USB 2.0 WLAN Card Utility.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommon/download/tgctlcm.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145072392000
O16 - DPF: {C7477E5B-9297-4083-A4B3-A6BBC611F7C9} - http://www.blackberry.com/CalendarPatch/patch/desktop/DevicePatchLoaderUSB.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Rav Process Communication Center (RavCCenter) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCENTER.EXE
O23 - Service: Rising RavTask Manager (RavTask) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavTask.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: RoxMediaDB9 - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavMonD.exe
O23 - Service: Rising Scan Service (RsScanSrv) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Rav\ScanFrm.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--
End of file - 8831 bytes

Shaba · Aug 29, 2009

Please click this link-->Jotti

Copy/paste the first file on the list into the white Upload a file box and click Submit/Send (depends on which one you are using Jotti or VirusTotal).

c:\windows\system32\u_bcetlkvlynfjpjnk.dll.exe
c:\windows\system32\d85588fb-8da5-cdab-f31d-6bab71677c02.exe
c:\windows\system32\zwozzmkwrxq.exe
c:\windows\avqhl4521.exe
c:\windows\avge04557.exe

Repeat steps for all files on the list.

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

dillyyo72 · Aug 29, 2009

File u_bcetlkvlynfjpjnk.dll.exe received on 2009.08.29 17:34:02 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.29 -
AhnLab-V3 5.0.0.2 2009.08.29 -
AntiVir 7.9.1.7 2009.08.28 -
Antiy-AVL 2.0.3.7 2009.08.24 -
Authentium 5.1.2.4 2009.08.29 -
Avast 4.8.1335.0 2009.08.28 -
AVG 8.5.0.406 2009.08.29 -
BitDefender 7.2 2009.08.29 -
CAT-QuickHeal 10.00 2009.08.29 -
ClamAV 0.94.1 2009.08.29 -
Comodo 2124 2009.08.29 -
DrWeb 5.0.0.12182 2009.08.29 -
eSafe 7.0.17.0 2009.08.27 -
eTrust-Vet 31.6.6707 2009.08.28 -
F-Prot 4.5.1.85 2009.08.29 -
F-Secure 8.0.14470.0 2009.08.28 -
Fortinet 3.120.0.0 2009.08.29 -
GData 19 2009.08.29 -
Ikarus T3.1.1.68.0 2009.08.29 -
Jiangmin 11.0.800 2009.08.29 -
K7AntiVirus 7.10.831 2009.08.29 -
Kaspersky 7.0.0.125 2009.08.29 -
McAfee 5724 2009.08.29 -
McAfee+Artemis 5724 2009.08.29 Artemis!9FD1B1A23591
McAfee-GW-Edition 6.8.5 2009.08.29 Heuristic.BehavesLike.Win32.Dropper.H
Microsoft 1.5005 2009.08.29 -
NOD32 4379 2009.08.29 -
Norman 2009.08.29 -
nProtect 2009.1.8.0 2009.08.29 -
Panda 10.0.2.2 2009.08.29 -
PCTools 4.4.2.0 2009.08.29 -
Prevx 3.0 2009.08.29 High Risk Cloaked Malware
Rising 21.44.40.00 2009.08.28 -
Sophos 4.45.0 2009.08.29 -
Sunbelt 3.2.1858.2 2009.08.29 -
Symantec 1.4.4.12 2009.08.29 -
TheHacker 6.3.4.3.390 2009.08.28 -
TrendMicro 8.950.0.1094 2009.08.28 -
VBA32 3.12.10.10 2009.08.29 -
ViRobot 2009.8.28.1907 2009.08.28 -
VirusBuster 4.6.5.0 2009.08.29 -
Additional information
File size: 58341 bytes
MD5...: 9fd1b1a23591980ec70e4e097179e41e
SHA1..: 92b512fc76918bf32531f25390cc14b25ed006fb
SHA256: b961caa4f0f564f3881e802fff163af2346410a97d7221f8cf0af5ba6874510a
ssdeep: 768:G4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJDsDfyanoqPtlvugQL+T: JLXB65939tY6HBg4sXJDsmHQurLK 
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x30cb timedatestamp.....: 0x4a2ae29c (Sat Jun 06 21:41:48 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x58d2 0x5a00 6.43 c69726ed422d3dcfdec9731986daa752 .rdata 0x7000 0x1190 0x1200 5.18 a2c7710fa66fcbb43c7ef0ab9eea5e9a .data 0x9000 0x1af78 0x400 4.62 e59cdcb732e4bfbc84cc61dd68354f78 .ndata 0x24000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x2e000 0x4b38 0x4c00 5.31 d5a25e341f03d13a2d364d738fe70742 ( 8 imports ) > KERNEL32.dll: CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA > USER32.dll: EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow > GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject > SHELL32.dll: SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation > ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA > COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create > ole32.dll: CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance > VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA ( 0 exports ) 
RDS...: NSRL Reference Data Set -
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=7D164AD1E5419C2BE33800A28048430037D24C78' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=7D164AD1E5419C2BE33800A28048430037D24C78</a>
packers (F-Prot): NSIS

File d85588fb-8da5-cdab-f31d-6bab71677 received on 2009.08.29 17:39:48 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.29 -
AhnLab-V3 5.0.0.2 2009.08.29 -
AntiVir 7.9.1.7 2009.08.28 -
Antiy-AVL 2.0.3.7 2009.08.24 -
Authentium 5.1.2.4 2009.08.29 -
Avast 4.8.1335.0 2009.08.28 -
AVG 8.5.0.406 2009.08.29 -
BitDefender 7.2 2009.08.29 -
CAT-QuickHeal 10.00 2009.08.29 -
ClamAV 0.94.1 2009.08.29 -
Comodo 2124 2009.08.29 -
DrWeb 5.0.0.12182 2009.08.29 -
eSafe 7.0.17.0 2009.08.27 -
eTrust-Vet 31.6.6707 2009.08.28 -
F-Prot 4.5.1.85 2009.08.29 -
F-Secure 8.0.14470.0 2009.08.28 -
Fortinet 3.120.0.0 2009.08.29 -
GData 19 2009.08.29 -
Ikarus T3.1.1.68.0 2009.08.29 -
Jiangmin 11.0.800 2009.08.29 -
K7AntiVirus 7.10.831 2009.08.29 -
Kaspersky 7.0.0.125 2009.08.29 -
McAfee 5724 2009.08.29 -
McAfee+Artemis 5724 2009.08.29 Suspect-29!D016F3CB79FF
McAfee-GW-Edition 6.8.5 2009.08.29 -
Microsoft 1.5005 2009.08.29 -
NOD32 4379 2009.08.29 -
Norman 2009.08.29 -
nProtect 2009.1.8.0 2009.08.29 -
Panda 10.0.2.2 2009.08.29 -
PCTools 4.4.2.0 2009.08.29 -
Prevx 3.0 2009.08.29 High Risk Cloaked Malware
Rising 21.44.40.00 2009.08.28 -
Sophos 4.45.0 2009.08.29 -
Sunbelt 3.2.1858.2 2009.08.29 -
Symantec 1.4.4.12 2009.08.29 -
TheHacker 6.3.4.3.390 2009.08.28 -
TrendMicro 8.950.0.1094 2009.08.28 -
VBA32 3.12.10.10 2009.08.29 -
ViRobot 2009.8.28.1907 2009.08.28 -
VirusBuster 4.6.5.0 2009.08.29 -
Additional information
File size: 86005 bytes
MD5...: d016f3cb79fff421c32f8208bd5e4027
SHA1..: 4d7c88b61670885043c4616edb0f3b49540659ff
SHA256: 590b3f1089f25f20c91ae16aa35736dfa1dfe5e692d6b4b4ce59027fc1ddd627
ssdeep: 1536:5u4EQalMK/ewGnh0mJPbWUsAbT5u+hwwRVSxg4EMZphZuC/ikZQ7PeQx7ZA 9/wr:5Nyah0mJPSUsApu6rRVSxN+eik0PeUZd 
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x3225 timedatestamp.....: 0x48efcdc9 (Fri Oct 10 21:48:57 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x5976 0x5a00 6.47 335c19bb25cd1d02eec2b0a4eacb979c .rdata 0x7000 0x1190 0x1200 5.18 db16645055619c0cc73276ff5c3adb75 .data 0x9000 0x1af98 0x400 4.69 59710519e577598f785044e4d95261f4 .ndata 0x24000 0xb000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x2f000 0x7d8 0x800 4.29 68b3d02c23844000b5aa5e3fda2096ff ( 8 imports ) > KERNEL32.dll: CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetFileTime, GetTempPathA, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetWindowsDirectoryA > USER32.dll: EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow > GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject > SHELL32.dll: SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation > ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA > COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create > ole32.dll: CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance > VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA ( 0 exports ) 
RDS...: NSRL Reference Data Set -
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=d016f3cb79fff421c32f8208bd5e4027' target='_blank'>http://www.threatexpert.com/report.aspx?md5=d016f3cb79fff421c32f8208bd5e4027</a>
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=8BBFD997F5C3D6E04F1501CEBA529500F8E9C65E' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=8BBFD997F5C3D6E04F1501CEBA529500F8E9C65E</a>
packers (F-Prot): NSIS

File zwozzmkwrxq.exe received on 2009.08.29 17:42:56 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.29 -
AhnLab-V3 5.0.0.2 2009.08.29 -
AntiVir 7.9.1.7 2009.08.28 -
Antiy-AVL 2.0.3.7 2009.08.24 -
Authentium 5.1.2.4 2009.08.29 -
Avast 4.8.1335.0 2009.08.28 -
AVG 8.5.0.406 2009.08.29 Generic_c.AYKT
BitDefender 7.2 2009.08.29 -
CAT-QuickHeal 10.00 2009.08.29 -
ClamAV 0.94.1 2009.08.29 -
Comodo 2124 2009.08.29 -
DrWeb 5.0.0.12182 2009.08.29 -
eSafe 7.0.17.0 2009.08.27 -
eTrust-Vet 31.6.6707 2009.08.28 -
F-Prot 4.5.1.85 2009.08.29 -
F-Secure 8.0.14470.0 2009.08.28 -
Fortinet 3.120.0.0 2009.08.29 -
GData 19 2009.08.29 -
Ikarus T3.1.1.68.0 2009.08.29 -
Jiangmin 11.0.800 2009.08.29 -
K7AntiVirus 7.10.831 2009.08.29 -
Kaspersky 7.0.0.125 2009.08.29 -
McAfee 5724 2009.08.29 -
McAfee+Artemis 5724 2009.08.29 Suspect-29!0F880461FE32
McAfee-GW-Edition 6.8.5 2009.08.29 Heuristic.LooksLike.Win32.Suspicious.H
Microsoft 1.5005 2009.08.29 -
NOD32 4379 2009.08.29 -
Norman 2009.08.29 -
nProtect 2009.1.8.0 2009.08.29 -
Panda 10.0.2.2 2009.08.29 -
PCTools 4.4.2.0 2009.08.29 -
Prevx 3.0 2009.08.29 High Risk Cloaked Malware
Rising 21.44.40.00 2009.08.28 -
Sophos 4.45.0 2009.08.29 -
Sunbelt 3.2.1858.2 2009.08.29 -
Symantec 1.4.4.12 2009.08.29 -
TheHacker 6.3.4.3.390 2009.08.28 -
TrendMicro 8.950.0.1094 2009.08.28 -
VBA32 3.12.10.10 2009.08.29 -
ViRobot 2009.8.28.1907 2009.08.28 -
VirusBuster 4.6.5.0 2009.08.29 -
Additional information
File size: 48273 bytes
MD5...: 0f880461fe321e9e7edb6a5bd0330e40
SHA1..: b11cafcef75ac60e2a85195203d4f76f9c285281
SHA256: 38045b041b55d55d479afd925787a3ecbb60661b8344ec2fb1d2e6ebe1159cca
ssdeep: 768:CCloVlpQE2MQGc6rDh84nSwN15G4DRF/O71mJ3JRnA6tGTT8u5ML2IeiH+ZN Yds:TYpQtMDc6fnpumJA4GTTDHFZNYds 
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x323c timedatestamp.....: 0x49a05a1a (Sat Feb 21 19:46:34 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x5a56 0x5c00 6.42 7e9e633fd2aedade49bf819fab33d557 .rdata 0x7000 0x1190 0x1200 5.18 db16645055619c0cc73276ff5c3adb75 .data 0x9000 0x1af98 0x400 4.71 a59d6ff4f72ca84cc2dea3b332090bfb .ndata 0x24000 0xd000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x31000 0x908 0xa00 3.85 a6381affa5d795345d320cd0bf75e6d2 ( 8 imports ) > KERNEL32.dll: CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetFileTime, GetTempPathA, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetWindowsDirectoryA > USER32.dll: EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow > GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject > SHELL32.dll: SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation > ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA > COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create > ole32.dll: CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance > VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA ( 0 exports ) 
RDS...: NSRL Reference Data Set -
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=9F2E2D3491F86921BC2E005809A7C5007CD441BD' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=9F2E2D3491F86921BC2E005809A7C5007CD441BD</a>
packers (F-Prot): N

File avqhl4521.exe received on 2009.08.29 17:45:42 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.29 -
AhnLab-V3 5.0.0.2 2009.08.29 -
AntiVir 7.9.1.7 2009.08.28 -
Antiy-AVL 2.0.3.7 2009.08.24 -
Authentium 5.1.2.4 2009.08.29 -
Avast 4.8.1335.0 2009.08.28 -
AVG 8.5.0.406 2009.08.29 -
BitDefender 7.2 2009.08.29 MemScan:Trojan.Agent.ANLP
CAT-QuickHeal 10.00 2009.08.29 Backdoor.Farfli.j
ClamAV 0.94.1 2009.08.29 -
Comodo 2124 2009.08.29 TrojWare.Win32.TrojanDropper.Agent.~RBP
DrWeb 5.0.0.12182 2009.08.29 -
eSafe 7.0.17.0 2009.08.27 Win32.MaliciousSoftw
eTrust-Vet 31.6.6707 2009.08.28 -
F-Prot 4.5.1.85 2009.08.29 -
F-Secure 8.0.14470.0 2009.08.28 -
Fortinet 3.120.0.0 2009.08.29 -
GData 19 2009.08.29 MemScan:Trojan.Agent.ANLP
Ikarus T3.1.1.68.0 2009.08.29 -
Jiangmin 11.0.800 2009.08.29 -
K7AntiVirus 7.10.831 2009.08.29 -
Kaspersky 7.0.0.125 2009.08.29 -
McAfee 5724 2009.08.29 -
McAfee+Artemis 5724 2009.08.29 Suspect-29!71F29A6CE4C9
McAfee-GW-Edition 6.8.5 2009.08.29 -
Microsoft 1.5005 2009.08.29 -
NOD32 4379 2009.08.29 Win32/VB.OAI
Norman 2009.08.29 Smalldrp.AVFP
nProtect 2009.1.8.0 2009.08.29 -
Panda 10.0.2.2 2009.08.29 -
PCTools 4.4.2.0 2009.08.29 -
Prevx 3.0 2009.08.29 Medium Risk Malware
Rising 21.44.40.00 2009.08.28 -
Sophos 4.45.0 2009.08.29 -
Sunbelt 3.2.1858.2 2009.08.29 Trojan.Win32.Agent.asb
Symantec 1.4.4.12 2009.08.29 -
TheHacker 6.3.4.3.390 2009.08.28 -
TrendMicro 8.950.0.1094 2009.08.28 TROJ_AGENT.ASB
VBA32 3.12.10.10 2009.08.29 -
ViRobot 2009.8.28.1907 2009.08.28 Spyware.Lwsta.Do.69697
VirusBuster 4.6.5.0 2009.08.29 -
Additional information
File size: 69697 bytes
MD5...: 71f29a6ce4c9907783301376c7b7a214
SHA1..: 3165aaf5ca7e6f91541794a721c0d235aef432fa
SHA256: c72e5f8b875dc7c83a3ccac924701d4089017227da07add3e6bb95b652aa138c
ssdeep: 1536:jYTmwVUsW7dtJMHy0DxmJXNQdHnydrHIepHaLEYdVN25+QB:US17XJiDxmJ XK1ydrNhsNzQB 
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x30e3 timedatestamp.....: 0x48a737ec (Sat Aug 16 20:26:20 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x5b68 0x5c00 6.49 6bfa289fc453f683cf6ad42723acbb61 .rdata 0x7000 0x129c 0x1400 5.05 165e3e874dc59c8a96748c6f4d0f4207 .data 0x9000 0x25c58 0x400 4.77 78a50275610b8d77577a9aaa1957d1b6 .ndata 0x2f000 0x8000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x37000 0xa68 0xc00 3.47 d211484d2bd0bc7cd9fa8208a56e2ff4 ( 8 imports ) > KERNEL32.dll: CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA > USER32.dll: EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow > GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject > SHELL32.dll: SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation > ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA > COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create > ole32.dll: CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance > VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA ( 0 exports ) 
RDS...: NSRL Reference Data Set -
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=53CB81C141695ED410F40121E4A6000025BCB8E1' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=53CB81C141695ED410F40121E4A6000025BCB8E1</a>
packers (F-Prot): NSIS

File avge04557.exe received on 2009.08.29 17:48:29 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.29 -
AhnLab-V3 5.0.0.2 2009.08.29 -
AntiVir 7.9.1.7 2009.08.28 -
Antiy-AVL 2.0.3.7 2009.08.24 -
Authentium 5.1.2.4 2009.08.29 -
Avast 4.8.1335.0 2009.08.28 -
AVG 8.5.0.406 2009.08.29 -
BitDefender 7.2 2009.08.29 -
CAT-QuickHeal 10.00 2009.08.29 -
ClamAV 0.94.1 2009.08.29 -
Comodo 2124 2009.08.29 -
DrWeb 5.0.0.12182 2009.08.29 Adware.IEHelper.102
eSafe 7.0.17.0 2009.08.27 -
eTrust-Vet 31.6.6707 2009.08.28 -
F-Prot 4.5.1.85 2009.08.29 -
F-Secure 8.0.14470.0 2009.08.28 WebToolbar.Win32.TJ2.a
Fortinet 3.120.0.0 2009.08.29 -
GData 19 2009.08.29 -
Ikarus T3.1.1.68.0 2009.08.29 AdWare.IEToolba
Jiangmin 11.0.800 2009.08.29 -
K7AntiVirus 7.10.831 2009.08.29 -
Kaspersky 7.0.0.125 2009.08.29 not-a-virus:WebToolbar.Win32.TJ2.a
McAfee 5724 2009.08.29 -
McAfee+Artemis 5724 2009.08.29 Artemis!754B51183111
McAfee-GW-Edition 6.8.5 2009.08.29 -
Microsoft 1.5005 2009.08.29 -
NOD32 4379 2009.08.29 -
Norman 2009.08.29 -
nProtect 2009.1.8.0 2009.08.29 -
Panda 10.0.2.2 2009.08.29 Suspicious file
PCTools 4.4.2.0 2009.08.29 -
Prevx 3.0 2009.08.29 High Risk System Back Door
Rising 21.44.40.00 2009.08.28 -
Sophos 4.45.0 2009.08.29 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.08.29 Adware.IEToolbar.TJ.2
Symantec 1.4.4.12 2009.08.29 -
TheHacker 6.3.4.3.390 2009.08.28 -
TrendMicro 8.950.0.1094 2009.08.28 -
VBA32 3.12.10.10 2009.08.29 -
ViRobot 2009.8.28.1907 2009.08.28 Adware.TJ2.To.889078
VirusBuster 4.6.5.0 2009.08.29 Adware.IEToolba.B
Additional information
File size: 889078 bytes
MD5...: 754b51183111422250b118eb7768d164
SHA1..: a862dfebd880aa6699e67ed6ca4e95d7d2a1385e
SHA256: 0895c7a99e119142999b4027e1d7dd5151239d24516581a0a8a228df1a5408be
ssdeep: 24576:JD0btAnTLEr/H8yOZNB6q5d0ckRB4JvpHZlNq:NEtA0bcJ3F5kB4f5lNq 
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x30cc timedatestamp.....: 0x46d055c0 (Sat Aug 25 16:16:00 2007) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x57b6 0x5800 6.46 ec844f25c8cba54542e5a2abcbae5b99 .rdata 0x7000 0x1190 0x1200 5.18 90bd2f87a259e7efae7775fc2ed3f717 .data 0x9000 0x1afd8 0x400 5.00 5f348dc6c4935b046240ccf56120be67 .ndata 0x24000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x2e000 0x4048 0x4200 5.83 3883ce5a9c4120a39fa913cea287e71e ( 8 imports ) > KERNEL32.dll: CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetFileSize, GetModuleFileNameA, GetTickCount, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA > USER32.dll: EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, CreateDialogParamA, DestroyWindow, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow > GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject > SHELL32.dll: SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation > ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA > COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create > ole32.dll: CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance > VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA ( 0 exports ) 
RDS...: NSRL Reference Data Set -
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=88503737F6FF162B90C20D13FDE8B400E1A4A7AD' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=88503737F6FF162B90C20D13FDE8B400E1A4A7AD</a>
packers (F-Prot): NSIS

Shaba · Aug 29, 2009

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

dillyyo72 · Aug 29, 2009

Shaba said:
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0.9
AnswerWorks 5.0 English Runtime
ASAPI
Ascendo Fitness 3.60
BlackBerry Desktop Software 4.5
BlackBerry Desktop Software 4.5
Broadcom Driver Installer
Compatibility Pack for the 2007 Office system
Contextual Tool Precisead
Critical Update for Windows Media Player 11 (KB959772)
Exact Audio Copy 0.99pb4
GdiplusUpgrade
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
HP Image Zone 3.5
HP PSC & OfficeJet 3.5
Intel Matrix Storage Manager
Java(TM) 6 Update 15
Java(TM) 6 Update 5
Logitech QuickCam Software
Logitech® Camera Driver
MetaFrame Presentation Server Web Client for Win32
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access 2003
Microsoft Office Basic Edition 2003
Microsoft Office Standard Edition 2003
Microsoft SQL Server Desktop Engine
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.52
Mozilla Firefox (3.5.2)
MSDE
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
Native Instruments - Audio Kontrol 1 Driver
Native Instruments Audio Kontrol 1
Native Instruments Traktor DJ Studio 3
NI Service Center
overland
Quicken 2008
QuickTime
RealPlayer
Rising Antivirus
Roxio Media Manager
Salon Iris
Salon Iris
Seagate Manager Installer
Seagate Manager Installer
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Service Studio
SoundMAX
Spybot - Search & Destroy
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VLC media player 0.9.9
WaveLab Demo
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver

Shaba · Aug 30, 2009

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code:

File::
c:\windows\system32\u_bcetlkvlynfjpjnk.dll.exe
c:\windows\system32\d85588fb-8da5-cdab-f31d-6bab71677c02.exe
c:\windows\system32\zwozzmkwrxq.exe
c:\windows\avqhl4521.exe
c:\windows\avge04557.exe
c:\windows\system32\nshE.dll

Folder::
c:\documents and settings\Jonathan Malave\Application Data\LimeWire

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

dillyyo72 · Aug 30, 2009

I did everything you stated, but I run into a problem during the scan. It detects Rising AV running. I try to disable all self protect, but one of them I cannot disable (Maliscious activity monitoring) So some form of protection stays on. I even went and checked off everything within the Rising User Interfaces.

I don't ever recall this happening and it didn't happen when I originally ran combofix for you. Should I just let it proceed with that one function enabled or is there some other way to do this?

I don't know exactly what processes are linked with Rising besides the "Rav*" files and I did not see any processes running in "services.msc", although a few were enabled automatically.

FYI: I just found trojans on my laptop which had shared an external hard drive many times. In short there is an XML file that has a rising http: address labled "virusUploader" that scans as a Cloaked Malware and I am not able to remove this file from my temp folder.

Also, within the main screen of the Rising AntiVirus UI I show a "yellow exclamation" mark next to system core. This is on my desktop (which we are working on) and my laptop. Just informing in case that helps.

Shaba · Aug 30, 2009

Please then uninstall Rising and try again.

You can reinstall it when we are done.

dillyyo72 · Aug 30, 2009

ComboFix 09-08-29.01 - Jonathan Malave 08/30/2009 11:54.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2558.2145 [GMT -4:00]
Running from: c:\documents and settings\Jonathan Malave\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jonathan Malave\Desktop\CFScript.txt

FILE ::
"c:\windows\avge04557.exe"
"c:\windows\avqhl4521.exe"
"c:\windows\system32\d85588fb-8da5-cdab-f31d-6bab71677c02.exe"
"c:\windows\system32\nshE.dll"
"c:\windows\system32\u_bcetlkvlynfjpjnk.dll.exe"
"c:\windows\system32\zwozzmkwrxq.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jonathan Malave\Application Data\LimeWire
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\.AppSpecialShare\[2001-05-26] - Carlos Hernandez vs Floyd Mayweather.avi.torrent.bak
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\.AppSpecialShare\Floyd Mayweather Jr vs Henry Bruseles.avi.torrent.bak
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\active.mojito
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\auth.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\find.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\places.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\update.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\freebl3.chk
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\freebl3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\js3250.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\LICENSE
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\debug.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\utils.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\mozctl.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\nspr4.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\nss3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\platform.ini
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\plc4.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\plds4.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\README.txt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\designmode.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\forms.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\html.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\language.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\mathml.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\quirk.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\svg.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\ua.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\smime3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\softokn3.chk
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\softokn3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\ssl3.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\updater.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\version.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xpcom.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xpidl.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xul.dll
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\certificate\limewire.keystore
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\downloads.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\filters.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\gnutella.net
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\installation.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\library.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\library5.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\limewire.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\lock
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mojito.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\.autoreg
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\30B5DE57d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\4C4B6535d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\7BD6A121d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\98E79480d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\AE98BDFBd01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\B7E8F4C3d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\BAFF9A89d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\Cache\D5267890d01
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\cert8.db
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\compreg.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\cookies.sqlite
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\downloads.sqlite
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\extensions.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\extensions.ini
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\history.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\key3.db
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\permissions.sqlite
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\places.sqlite
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\pluginreg.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\prefs.js
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\secmod.db
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\XPC.mfl
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\mozilla-profile\xpti.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\passive.mojito
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\player.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\promotion\promodb.backup
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\questions.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\responses.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\simpp.xml
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\spam.dat
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\tables.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\version.txt
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\ttdata.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\ttrees.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\version.xml
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\versions.props
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\xml\data\audio.sxml2
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\xml\data\audio.sxml3
c:\documents and settings\Jonathan Malave\Application Data\LimeWire\xml\data\video.sxml3
c:\program files\runit
c:\program files\runit\config.txt
C:\Rav18_61_42.exe
c:\windows\avge04557.exe
c:\windows\avqhl4521.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\d85588fb-8da5-cdab-f31d-6bab71677c02.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\FTPx.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\MabryObj.dll
c:\windows\system32\nshE.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\u_bcetlkvlynfjpjnk.dll.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\zwozzmkwrxq.exe

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.

2009-08-29 21:39 . 2009-08-29 21:39 -------- dcsh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-29 21:39 . 2009-08-29 21:39 -------- dcsh--w- c:\documents and settings\Jonathan Malave\IETldCache
2009-08-29 20:53 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-08-29 20:53 . 2009-08-29 20:53 -------- dc----w- c:\windows\ie8updates
2009-08-29 20:53 . 2009-07-03 17:09 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-29 20:53 . 2009-07-03 17:09 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-29 16:54 . 2009-08-29 16:54 -------- dc----w- c:\program files\Microsoft Works
2009-08-29 04:22 . 2009-08-29 20:52 -------- dc-h--w- c:\windows\ie8
2009-08-29 04:20 . 2009-08-29 04:20 -------- dc----w- C:\11d6fc14b292ca73a9d0
2009-08-26 23:38 . 2009-08-26 23:38 -------- dc----w- c:\program files\microsoft frontpage
2009-08-25 21:14 . 2009-08-25 21:14 4 -c--a-w- c:\documents and settings\Jonathan Malave\Application Data\NP.sys
2009-08-25 21:13 . 2009-08-25 21:13 134144 -c--a-w- c:\windows\ceids88045.exe
2009-08-25 21:12 . 2009-08-25 21:12 412160 -c--a-w- c:\windows\denc4602.exe
2009-08-21 23:34 . 2009-08-21 23:35 -------- dc----w- c:\documents and settings\All Users\Application Data\NOS
2009-08-21 23:34 . 2009-08-21 23:34 -------- dc----w- c:\program files\NOS
2009-08-20 20:24 . 2009-08-20 20:25 -------- dc----w- c:\program files\Spybot - Search & Destroy
2009-08-14 19:16 . 2009-08-14 19:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Citrix
2009-08-14 19:16 . 2009-08-14 19:16 -------- dc----w- c:\documents and settings\Jonathan Malave\Local Settings\Application Data\Citrix
2009-08-12 02:25 . 2009-08-12 02:25 152576 -c--a-w- c:\documents and settings\Jonathan Malave\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-30 15:51 . 2006-04-14 19:57 49072 -c--a-w- c:\documents and settings\Jonathan Malave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 01:30 . 2006-07-26 02:00 -------- dc----w- c:\program files\Web Publish
2009-08-27 21:22 . 2006-12-17 14:55 -------- dc----w- c:\program files\Windows Live Safety Center
2009-08-26 21:58 . 2006-04-14 23:52 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-12 02:26 . 2007-06-26 06:11 -------- dc----w- c:\program files\Java
2009-08-06 23:52 . 2007-06-10 05:33 -------- dc----w- c:\documents and settings\Jonathan Malave\Application Data\dvdcss
2009-08-05 09:01 . 2004-08-12 13:23 204800 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 01:29 . 2006-04-14 20:23 -------- dc-h--w- c:\program files\InstallShield Installation Information
2009-07-25 09:23 . 2009-07-16 01:55 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-07-24 04:05 . 2009-07-24 04:06 737280 -c--a-w- c:\windows\iun6002.exe
2009-07-17 19:01 . 2004-08-12 13:17 58880 -c--a-w- c:\windows\system32\atl.dll
2009-07-16 01:54 . 2009-07-16 01:54 152576 -c--a-w- c:\documents and settings\Jonathan Malave\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-07-14 19:40 . 2009-03-11 17:18 -------- dc----w- c:\program files\Google
2009-07-14 19:12 . 2008-07-07 04:41 -------- dc----w- c:\program files\Windows Live
2009-07-14 19:11 . 2008-07-14 19:02 -------- dc----w- c:\program files\Common Files\Apple
2009-07-14 03:43 . 2004-08-12 13:34 286208 -c--a-w- c:\windows\system32\wmpdxm.dll
2009-07-08 03:21 . 2006-04-14 19:59 -------- dc----w- c:\program files\Rising
2009-07-08 03:20 . 2009-07-08 03:20 -------- dc----w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
2009-07-08 03:18 . 2006-05-07 06:48 -------- dc----w- c:\program files\Common Files\Adobe
2009-07-03 17:09 . 2004-08-12 13:33 915456 -c--a-w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 2004-08-12 13:32 54272 -c--a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-12 13:28 56832 -c--a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-12 13:27 147456 -c--a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-12 13:23 136192 -c--a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2004-08-12 13:21 730112 -c--a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-12 13:20 301568 -c--a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2004-08-12 13:20 92928 -c--a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-08-12 13:30 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-12 13:19 81920 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-12 13:31 80896 -c--a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-12 13:30 76288 -c--a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-12 13:17 84992 -c--a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2006-04-14 19:48 2066432 -c--a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-12 13:33 132096 -c--a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-12 13:26 1291264 -c--a-w- c:\windows\system32\quartz.dll
2007-09-12 15:19 . 2007-12-01 14:44 8784 -c--a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-09-12 15:22 . 2007-12-01 14:44 245408 -c--a-w- c:\program files\mozilla firefox\plugins\unicows.dll
2007-06-08 06:24 . 2007-06-08 06:24 10856 -csha-w- c:\windows\system32\KGyGaAvL.sys
2006-12-24 13:19 . 2006-12-24 13:19 73 -csha-w- c:\windows\system32\SYSDRVREB.SYS
.

(CONTINUED.........)

dillyyo72 · Aug 30, 2009

.....CONTINUED

((((((((((((((((((((((((((((( SnapShot@2009-08-29_16.34.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-12 13:26 . 2009-03-08 08:31 46592 c:\windows\system32\pngfilt.dll
+ 2004-08-12 13:23 . 2009-03-08 08:31 48128 c:\windows\system32\mshtmler.dll
- 2004-08-12 13:23 . 2007-08-13 22:01 48128 c:\windows\system32\mshtmler.dll
+ 2004-08-12 13:23 . 2009-03-08 08:31 66560 c:\windows\system32\mshtmled.dll
+ 2004-08-12 13:23 . 2009-03-08 08:31 45568 c:\windows\system32\mshta.exe
- 2004-08-12 13:23 . 2007-08-13 22:32 45568 c:\windows\system32\mshta.exe
+ 2006-10-17 16:58 . 2009-03-08 08:31 13312 c:\windows\system32\msfeedssync.exe
+ 2006-11-08 02:03 . 2009-07-03 17:09 55296 c:\windows\system32\msfeedsbs.dll
+ 2004-08-12 13:21 . 2009-03-08 08:34 43008 c:\windows\system32\licmgr10.dll
+ 2004-08-12 13:20 . 2009-07-03 17:09 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-12 13:20 . 2009-03-08 08:32 94720 c:\windows\system32\inseng.dll
+ 2004-08-12 13:20 . 2009-03-08 08:31 34816 c:\windows\system32\imgutil.dll
+ 2004-08-12 13:19 . 2009-03-08 08:32 71680 c:\windows\system32\iesetup.dll
+ 2004-08-12 13:19 . 2009-03-08 08:32 55808 c:\windows\system32\iernonce.dll
+ 2006-10-17 16:58 . 2009-03-08 08:31 59904 c:\windows\system32\icardie.dll
+ 2004-08-12 13:26 . 2009-03-08 08:31 46592 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-12 13:23 . 2009-03-08 08:31 48128 c:\windows\system32\dllcache\mshtmler.dll
- 2004-08-12 13:23 . 2007-08-13 22:01 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2004-08-12 13:23 . 2009-03-08 08:31 66560 c:\windows\system32\dllcache\mshtmled.dll
- 2004-08-12 13:23 . 2007-08-13 22:32 45568 c:\windows\system32\dllcache\mshta.exe
+ 2004-08-12 13:23 . 2009-03-08 08:31 45568 c:\windows\system32\dllcache\mshta.exe
+ 2007-05-09 02:30 . 2009-07-03 17:09 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2004-08-12 13:21 . 2009-03-08 08:34 43008 c:\windows\system32\dllcache\licmgr10.dll
+ 2004-08-12 13:20 . 2009-07-03 17:09 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-12 13:20 . 2009-03-08 08:32 94720 c:\windows\system32\dllcache\inseng.dll
+ 2004-08-12 13:20 . 2009-03-08 08:31 34816 c:\windows\system32\dllcache\imgutil.dll
+ 2004-08-12 13:19 . 2009-03-08 08:32 71680 c:\windows\system32\dllcache\iesetup.dll
+ 2004-08-12 13:19 . 2009-03-08 08:32 55808 c:\windows\system32\dllcache\iernonce.dll
+ 2007-08-20 10:04 . 2009-03-08 08:31 59904 c:\windows\system32\dllcache\icardie.dll
+ 2007-08-13 22:18 . 2009-03-08 08:24 68608 c:\windows\system32\dllcache\hmmapi.dll
+ 2004-08-12 13:18 . 2009-03-08 08:33 18944 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-12 13:17 . 2009-03-08 08:32 72704 c:\windows\system32\dllcache\admparse.dll
+ 2004-08-12 13:18 . 2009-03-08 08:33 18944 c:\windows\system32\corpol.dll
- 2006-04-14 19:55 . 2009-08-29 16:16 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-04-14 19:55 . 2009-08-30 15:47 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-04-14 19:55 . 2009-08-30 15:47 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-04-14 19:55 . 2009-08-29 16:16 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2006-04-14 19:55 . 2009-08-30 15:47 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-04-14 19:55 . 2009-08-29 16:16 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-12 13:17 . 2009-03-08 08:32 72704 c:\windows\system32\admparse.dll
- 2006-04-14 22:19 . 2009-08-11 23:35 23040 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 23040 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 27136 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 27136 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 11264 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 11264 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 12288 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 12288 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-08-29 20:53 . 2009-03-08 08:33 12288 c:\windows\ie8updates\KB972260-IE8\xpshims.dll
+ 2009-08-29 20:53 . 2009-03-08 08:31 55296 c:\windows\ie8updates\KB972260-IE8\msfeedsbs.dll
+ 2009-08-29 20:53 . 2009-03-08 08:33 25600 c:\windows\ie8updates\KB972260-IE8\jsproxy.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 44544 c:\windows\ie8\pngfilt.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 44544 c:\windows\ie8\pngfilt.dll
- 2009-08-29 04:23 . 2007-08-13 22:01 48128 c:\windows\ie8\mshtmler.dll
+ 2009-08-29 20:52 . 2007-08-13 22:01 48128 c:\windows\ie8\mshtmler.dll
+ 2009-08-29 20:52 . 2007-08-13 22:32 45568 c:\windows\ie8\mshta.exe
- 2009-08-29 04:23 . 2007-08-13 22:32 45568 c:\windows\ie8\mshta.exe
- 2009-08-29 04:23 . 2007-08-13 22:36 12288 c:\windows\ie8\msfeedssync.exe
+ 2009-08-29 20:52 . 2007-08-13 22:36 12288 c:\windows\ie8\msfeedssync.exe
+ 2009-08-29 20:52 . 2009-06-29 16:12 52224 c:\windows\ie8\msfeedsbs.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 52224 c:\windows\ie8\msfeedsbs.dll
+ 2009-08-29 20:52 . 2007-08-13 22:44 40960 c:\windows\ie8\licmgr10.dll
- 2009-08-29 04:23 . 2007-08-13 22:44 40960 c:\windows\ie8\licmgr10.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 27648 c:\windows\ie8\jsproxy.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 27648 c:\windows\ie8\jsproxy.dll
- 2009-08-29 04:23 . 2007-08-13 22:39 92672 c:\windows\ie8\inseng.dll
+ 2009-08-29 20:52 . 2007-08-13 22:39 92672 c:\windows\ie8\inseng.dll
- 2009-08-29 04:23 . 2007-08-13 22:36 36352 c:\windows\ie8\imgutil.dll
+ 2009-08-29 20:52 . 2007-08-13 22:36 36352 c:\windows\ie8\imgutil.dll
+ 2009-08-29 20:52 . 2007-08-13 22:39 55296 c:\windows\ie8\iesetup.dll
- 2009-08-29 04:23 . 2007-08-13 22:39 55296 c:\windows\ie8\iesetup.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 44544 c:\windows\ie8\iernonce.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 44544 c:\windows\ie8\iernonce.dll
- 2009-08-29 04:22 . 2009-06-29 11:07 70656 c:\windows\ie8\ie4uinit.exe
+ 2009-08-29 20:52 . 2009-06-29 11:07 70656 c:\windows\ie8\ie4uinit.exe
+ 2009-08-29 20:52 . 2009-06-29 16:12 63488 c:\windows\ie8\icardie.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 63488 c:\windows\ie8\icardie.dll
+ 2009-08-29 20:52 . 2007-08-13 22:18 60416 c:\windows\ie8\hmmapi.dll
- 2009-08-29 04:22 . 2007-08-13 22:18 60416 c:\windows\ie8\hmmapi.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 17408 c:\windows\ie8\corpol.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 17408 c:\windows\ie8\corpol.dll
- 2009-08-29 04:22 . 2007-08-13 22:39 71680 c:\windows\ie8\admparse.dll
+ 2009-08-29 20:52 . 2007-08-13 22:39 71680 c:\windows\ie8\admparse.dll
+ 2006-04-14 22:19 . 2009-08-29 16:55 4096 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 4096 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-08-29 20:53 . 2009-03-08 08:35 2048 c:\windows\ie8updates\KB973874-IE8\iecompat.dll
+ 2006-10-17 17:05 . 2009-03-08 08:34 208384 c:\windows\system32\WinFXDocObj.exe
+ 2004-08-12 13:33 . 2009-03-08 08:34 236544 c:\windows\system32\webcheck.dll
+ 2004-08-12 13:32 . 2009-03-08 08:33 420352 c:\windows\system32\vbscript.dll
+ 2004-08-12 13:31 . 2009-03-08 08:34 105984 c:\windows\system32\url.dll
- 2004-08-12 13:31 . 2009-06-29 16:12 105984 c:\windows\system32\url.dll
+ 2004-08-12 13:25 . 2009-07-03 17:09 206848 c:\windows\system32\occache.dll
+ 2004-08-12 13:23 . 2009-03-08 08:32 611840 c:\windows\system32\mstime.dll
+ 2004-08-12 13:23 . 2009-03-08 08:34 193536 c:\windows\system32\msrating.dll
+ 2004-08-12 13:23 . 2009-03-08 08:22 156160 c:\windows\system32\msls31.dll
- 2004-08-12 13:23 . 2007-08-13 22:54 156160 c:\windows\system32\msls31.dll
+ 2006-11-08 02:03 . 2009-07-03 17:09 594432 c:\windows\system32\msfeeds.dll
+ 2004-08-12 13:20 . 2009-03-08 08:33 726528 c:\windows\system32\jscript.dll
+ 2006-11-08 02:03 . 2009-03-08 08:22 164352 c:\windows\system32\ieui.dll
+ 2004-08-12 13:19 . 2009-07-03 17:09 184320 c:\windows\system32\iepeers.dll
+ 2004-08-12 13:19 . 2009-07-03 17:09 386048 c:\windows\system32\iedkcs32.dll
+ 2006-10-17 16:27 . 2009-03-08 08:11 445952 c:\windows\system32\ieapfltr.dll
+ 2004-08-12 13:19 . 2009-03-08 08:32 163840 c:\windows\system32\ieakui.dll
+ 2004-08-12 13:19 . 2009-03-08 08:33 229376 c:\windows\system32\ieaksie.dll
+ 2004-08-12 13:19 . 2009-03-08 08:33 125952 c:\windows\system32\ieakeng.dll
+ 2004-08-12 13:19 . 2009-07-03 11:01 173056 c:\windows\system32\ie4uinit.exe
- 2006-04-14 15:44 . 2009-08-14 13:20 213360 c:\windows\system32\FNTCACHE.DAT
+ 2006-04-14 15:44 . 2009-08-29 21:38 213360 c:\windows\system32\FNTCACHE.DAT
+ 2004-08-12 13:18 . 2009-03-08 08:31 216064 c:\windows\system32\dxtrans.dll
+ 2004-08-12 13:18 . 2009-03-08 08:31 348160 c:\windows\system32\dxtmsft.dll
+ 2004-08-12 13:33 . 2009-07-03 17:09 915456 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-12 13:33 . 2009-03-08 08:34 236544 c:\windows\system32\dllcache\webcheck.dll
+ 2006-04-14 19:50 . 2009-03-08 08:33 759296 c:\windows\system32\dllcache\VGX.dll
+ 2004-08-12 13:32 . 2009-03-08 08:33 420352 c:\windows\system32\dllcache\vbscript.dll
- 2004-08-12 13:31 . 2009-06-29 16:12 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-12 13:31 . 2009-03-08 08:34 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-12 13:25 . 2009-07-03 17:09 206848 c:\windows\system32\dllcache\occache.dll
+ 2004-08-12 13:23 . 2009-03-08 08:32 611840 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-12 13:23 . 2009-03-08 08:34 193536 c:\windows\system32\dllcache\msrating.dll
+ 2004-08-12 13:23 . 2009-03-08 08:22 156160 c:\windows\system32\dllcache\msls31.dll
- 2004-08-12 13:23 . 2007-08-13 22:54 156160 c:\windows\system32\dllcache\msls31.dll
+ 2007-05-09 02:30 . 2009-07-03 17:09 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2004-08-12 13:20 . 2009-03-08 08:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2007-08-13 22:43 . 2009-03-08 18:09 638816 c:\windows\system32\dllcache\iexplore.exe
+ 2004-08-12 13:19 . 2009-07-03 17:09 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2004-08-12 13:19 . 2009-07-03 17:09 386048 c:\windows\system32\dllcache\iedkcs32.dll
+ 2007-05-09 02:30 . 2009-03-08 08:11 445952 c:\windows\system32\dllcache\ieapfltr.dll
+ 2004-08-12 13:19 . 2009-03-08 08:32 163840 c:\windows\system32\dllcache\ieakui.dll
+ 2004-08-12 13:19 . 2009-03-08 08:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2004-08-12 13:19 . 2009-03-08 08:33 125952 c:\windows\system32\dllcache\ieakeng.dll
+ 2004-08-12 13:19 . 2009-07-03 11:01 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2004-08-12 13:18 . 2009-03-08 08:31 216064 c:\windows\system32\dllcache\dxtrans.dll
+ 2004-08-12 13:18 . 2009-03-08 08:31 348160 c:\windows\system32\dllcache\dxtmsft.dll
+ 2004-08-12 13:17 . 2009-03-08 08:32 128512 c:\windows\system32\dllcache\advpack.dll
+ 2009-08-29 21:39 . 2009-08-30 04:56 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2004-08-12 13:17 . 2009-03-08 08:32 128512 c:\windows\system32\advpack.dll
- 2006-04-14 22:19 . 2009-08-11 23:35 409600 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 409600 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 286720 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 286720 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 794624 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 794624 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-04-14 22:19 . 2009-08-29 16:55 135168 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2006-04-14 22:19 . 2009-08-11 23:35 135168 c:\windows\Installer\{91130409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-08-29 20:53 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB973874-IE8\spuninst\updspapi.dll
+ 2009-08-29 20:53 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB973874-IE8\spuninst\spuninst.exe
+ 2009-08-29 20:53 . 2009-03-08 08:34 914944 c:\windows\ie8updates\KB972260-IE8\wininet.dll
+ 2009-08-29 20:53 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB972260-IE8\spuninst\updspapi.dll
+ 2009-08-29 20:53 . 2009-05-26 11:40 231288 c:\windows\ie8updates\KB972260-IE8\spuninst\spuninst.exe
+ 2009-08-29 20:53 . 2009-03-08 08:34 109568 c:\windows\ie8updates\KB972260-IE8\occache.dll
+ 2009-08-29 20:53 . 2009-03-08 08:32 594432 c:\windows\ie8updates\KB972260-IE8\msfeeds.dll
+ 2009-08-29 20:53 . 2009-03-08 08:33 246784 c:\windows\ie8updates\KB972260-IE8\ieproxy.dll
+ 2009-08-29 20:53 . 2009-03-08 08:31 183808 c:\windows\ie8updates\KB972260-IE8\iepeers.dll
+ 2009-08-29 20:53 . 2009-03-08 18:09 391536 c:\windows\ie8updates\KB972260-IE8\iedkcs32.dll
+ 2009-08-29 20:53 . 2009-03-08 08:32 173056 c:\windows\ie8updates\KB972260-IE8\ie4uinit.exe
- 2009-08-29 04:23 . 2009-06-29 16:12 102912 c:\windows\ie8\occache.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 102912 c:\windows\ie8\occache.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 671232 c:\windows\ie8\mstime.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 671232 c:\windows\ie8\mstime.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 193024 c:\windows\ie8\msrating.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 193024 c:\windows\ie8\msrating.dll
+ 2009-08-29 20:52 . 2007-08-13 22:54 156160 c:\windows\ie8\msls31.dll
- 2009-08-29 04:23 . 2007-08-13 22:54 156160 c:\windows\ie8\msls31.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 477696 c:\windows\ie8\mshtmled.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 477696 c:\windows\ie8\mshtmled.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 459264 c:\windows\ie8\msfeeds.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 459264 c:\windows\ie8\msfeeds.dll
- 2009-08-29 04:23 . 2008-05-09 10:53 512000 c:\windows\ie8\jscript.dll
+ 2009-08-29 20:52 . 2008-05-09 10:53 512000 c:\windows\ie8\jscript.dll
- 2009-08-29 04:23 . 2009-06-29 08:35 634632 c:\windows\ie8\iexplore.exe
+ 2009-08-29 20:52 . 2009-06-29 08:35 634632 c:\windows\ie8\iexplore.exe
- 2009-08-29 04:23 . 2007-08-13 22:54 180736 c:\windows\ie8\ieui.dll
+ 2009-08-29 20:52 . 2007-08-13 22:54 180736 c:\windows\ie8\ieui.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 268288 c:\windows\ie8\iertutil.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 268288 c:\windows\ie8\iertutil.dll
- 2009-08-29 04:23 . 2007-08-13 22:54 287744 c:\windows\ie8\ieproxy.dll
+ 2009-08-29 20:52 . 2007-08-13 22:54 287744 c:\windows\ie8\ieproxy.dll
- 2009-08-29 04:23 . 2007-08-13 22:54 191488 c:\windows\ie8\iepeers.dll
+ 2009-08-29 20:52 . 2007-08-13 22:54 191488 c:\windows\ie8\iepeers.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 385024 c:\windows\ie8\iedkcs32.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 385024 c:\windows\ie8\iedkcs32.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 380928 c:\windows\ie8\ieapfltr.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 380928 c:\windows\ie8\ieapfltr.dll
- 2009-08-29 04:23 . 2009-06-29 08:33 161792 c:\windows\ie8\ieakui.dll
+ 2009-08-29 20:52 . 2009-06-29 08:33 161792 c:\windows\ie8\ieakui.dll
- 2009-08-29 04:23 . 2009-06-29 16:12 230400 c:\windows\ie8\ieaksie.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 230400 c:\windows\ie8\ieaksie.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 153088 c:\windows\ie8\ieakeng.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 153088 c:\windows\ie8\ieakeng.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 214528 c:\windows\ie8\dxtrans.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 214528 c:\windows\ie8\dxtrans.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 347136 c:\windows\ie8\dxtmsft.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 347136 c:\windows\ie8\dxtmsft.dll
+ 2009-08-29 20:52 . 2009-06-29 16:12 124928 c:\windows\ie8\advpack.dll
- 2009-08-29 04:22 . 2009-06-29 16:12 124928 c:\windows\ie8\advpack.dll
+ 2004-08-12 13:31 . 2009-07-03 17:09 1208832 c:\windows\system32\urlmon.dll
+ 2004-08-12 13:23 . 2009-07-19 13:18 5937152 c:\windows\system32\mshtml.dll
+ 2006-10-17 16:57 . 2009-07-03 17:09 1985536 c:\windows\system32\iertutil.dll
+ 2006-09-06 04:01 . 2009-02-07 01:07 3698584 c:\windows\system32\ieapfltr.dat
+ 2004-08-12 13:31 . 2009-07-03 17:09 1208832 c:\windows\system32\dllcache\urlmon.dll
+ 2004-08-12 13:23 . 2009-07-19 13:18 5937152 c:\windows\system32\dllcache\mshtml.dll
+ 2007-05-09 02:30 . 2009-07-03 17:09 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2007-05-09 02:30 . 2009-02-07 01:07 3698584 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-08-29 20:53 . 2009-03-08 08:34 1206784 c:\windows\ie8updates\KB972260-IE8\urlmon.dll
+ 2009-08-29 20:53 . 2009-03-08 08:41 5937152 c:\windows\ie8updates\KB972260-IE8\mshtml.dll
+ 2009-08-29 20:53 . 2009-03-08 08:32 1985024 c:\windows\ie8updates\KB972260-IE8\iertutil.dll
+ 2009-08-29 20:52 . 2009-07-19 13:33 3597824 c:\windows\ie8\mshtml.dll
- 2009-08-29 04:23 . 2009-07-19 13:33 3597824 c:\windows\ie8\mshtml.dll
- 2009-08-29 04:22 . 2009-07-19 13:32 6067200 c:\windows\ie8\ieframe.dll
+ 2009-08-29 20:52 . 2009-07-19 13:32 6067200 c:\windows\ie8\ieframe.dll
- 2009-08-29 04:22 . 2009-06-29 08:33 2452872 c:\windows\ie8\ieapfltr.dat
+ 2009-08-29 20:52 . 2009-06-29 08:33 2452872 c:\windows\ie8\ieapfltr.dat
+ 2006-11-08 02:03 . 2009-07-19 22:48 11067392 c:\windows\system32\ieframe.dll
+ 2007-05-09 02:30 . 2009-07-19 22:48 11067392 c:\windows\system32\dllcache\ieframe.dll
+ 2009-08-29 20:53 . 2009-03-08 08:39 11063808 c:\windows\ie8updates\KB972260-IE8\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2003-05-15 163840]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2003-05-15 114688]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-10-28 181544]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-08-03 4493312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2006-4-14 209016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"winupdate.exe"=c:\windows\system32\winupdate.exe
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Roxio\\Media Manager 9\\MediaManager9.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP

xpsp2res.dll,-22009

R2 BaseTDI;Rising TDI Base Driver;c:\windows\system32\drivers\basetdi.sys [4/14/2006 4:42 PM 13364]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [10/28/2008 4:42 PM 156968]
R3 ak1avs;ak1avs;c:\windows\system32\drivers\ak1avs.sys [4/25/2009 11:43 PM 25600]
R3 ak1usb;ak1usb;c:\windows\system32\drivers\ak1usb.sys [4/25/2009 11:43 PM 186368]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [10/18/2006 1:01 PM 16512]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/12/2004 9:30 AM 14336]
S4 PRISMSVC;PRISMSVC;c:\windows\system32\PRISMSVC.exe [4/14/2006 4:23 PM 57344]

--- Other Services/Drivers In Memory ---

*Deregistered* - hookcont
*Deregistered* - RsNTGDI

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

BHO-{bf386b10-fd3b-eed5-2442-8fcb4e6e963e} - c:\windows\system32\nshE.dll
HKCU-Run-HijackThis startup scan - c:\program files\Trend Micro\HijackThis\HijackThis.exe
ShellExecuteHooks-{32CD708B-60A7-4C00-9377-D73EAA495F0F} - c:\windows\system32\RavExt.dll

.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: {C7477E5B-9297-4083-A4B3-A6BBC611F7C9} - hxxp://www.blackberry.com/CalendarPatch/patch/desktop/DevicePatchLoaderUSB.cab
FF - ProfilePath - c:\documents and settings\Jonathan Malave\Application Data\Mozilla\Firefox\Profiles\3ag8935g.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\documents and settings\Jonathan Malave\Application Data\Mozilla\Firefox\Profiles\3ag8935g.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 12:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-08-30 12:03
ComboFix-quarantined-files.txt 2009-08-30 16:02
ComboFix2.txt 2009-08-29 16:38

Pre-Run: 10,120,871,936 bytes free
Post-Run: 10,059,796,480 bytes free

844 --- E O F --- 2009-08-29 20:53

Shaba · Aug 30, 2009

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

dillyyo72 · Aug 31, 2009

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, August 30, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, August 30, 2009 22:10:39
Records in database: 2730279
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 68228
Threats found: 2
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 01:18:49

File name / Threat / Threats count
C:\Qoobox\Quarantine\[4]-Submit_2009-08-30_11.53.45.zip Infected: not-a-virus:WebToolbar.Win32.TJ2.a 1
C:\WINDOWS\system32\gvwf.exe Infected: Trojan-Downloader.Win32.Pher.ij 1

Selected area has been scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:11:02 PM, on 8/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\Dillyyo72.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Wireless USB 2.0 WLAN Card Utility.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommon/download/tgctlcm.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145072392000
O16 - DPF: {C7477E5B-9297-4083-A4B3-A6BBC611F7C9} - http://www.blackberry.com/CalendarPatch/patch/desktop/DevicePatchLoaderUSB.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: RoxMediaDB9 - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--
End of file - 7779 bytes

Shaba · Aug 31, 2009

Empty this folder:

C:\Qoobox\Quarantine

Delete this:

C:\WINDOWS\system32\gvwf.exe

Empty Recycle Bin.

Still problems?

dillyyo72 · Aug 31, 2009

Did as you said and all seems well so far. Can you tell me how I should go about cleaning an external USB hard drive? I used it with this desk top and I think that's how my lap top got infected (different thread). I just don't want to hook it back up and infect again.

Also, I use rising AV (free edition) and spy bot for protection. Can you tell me any particular recommended programs I can put on my computer, free or pay, that doesn't hog down the system? I also read that windows firewall is not accurate, is this true?

Again, appreciate the time and effort you put towards resolving my problem. You guys are invaluable

:

Shaba · Aug 31, 2009

You will need to disable autorun first. See [http://support.microsoft.com/kb/967715]here[/url] how to do it.

Then you can just attach it, go to my computer, right-click drive and choose format (unless there is nothing you want to save).

dillyyo72 · Aug 31, 2009

I'm sorry, but I think I still have an issue. I downloaded Malwarebytes because I saw that is was a commonly used program and figured it would be good. I scanned my system with it and it is showing objects as infections. It currently shows 4. It is still scanning so I will post what is found when it is done. Just didn't want you to close the file. thanks:red:

dillyyo72 · Aug 31, 2009

Ok, here is the Malwarebytes report:

Malwarebytes' Anti-Malware 1.40
Database version: 2722
Windows 5.1.2600 Service Pack 3

8/31/2009 1:03:06 PM
mbam-log-2009-08-31 (13-02-58).txt

Scan type: Full Scan (C:\|)
Objects scanned: 186849
Time elapsed: 48 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{60088CA5-9B3D-41A3-83E7-E94BC8BF7640}\RP0\A0000002.dll (Rootkit.TDSS) -> No action taken.
C:\System Volume Information\_restore{60088CA5-9B3D-41A3-83E7-E94BC8BF7640}\RP0\A0000003.dll (Rootkit.TDSS) -> No action taken.
C:\System Volume Information\_restore{60088CA5-9B3D-41A3-83E7-E94BC8BF7640}\RP2\A0002669.exe (Trojan.Dropper) -> No action taken.
C:\System Volume Information\_restore{60088CA5-9B3D-41A3-83E7-E94BC8BF7640}\RP2\A0002670.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Jonathan Malave\Application Data\NP.sys (Malware.Trace) -> No action taken.

I also wanted to note that my browsers (Mozzila and IE) tend to be opening up slowly and I have noticed flickering, some on desptop, but moreso in browsers.

Shaba · Aug 31, 2009

Four of those are in system restore. Did you let mbam to remove all?

Cannot get rid of files after infection from trojans and malware

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus