My computer happen to have winAntiSpyware 2007 4.0.193.0

jamesdang · Jul 13, 2007

Happen to have a lot of popups.
Last time problem: http://forums.spybot.info/showthread.php?t=14314
Please help me.
Thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:44 PM, on 7/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media

Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client

Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual

Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual

Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge]

C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro

Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common

Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom

HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common

Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe

61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [icq.com] rundll32.exe

"C:\WINDOWS\System32\bmjnktrd.dll",forkonce
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program

Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware

2007\uwas7cw.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager]

"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat

7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe"

-vt yazb
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default

user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program

Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Services -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program

Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -

http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) -

http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program

Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support)

- C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeF

ullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/w

uweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/m

uweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) -

http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) -

https://www.web-a-file.com/webafiledownloader.cab
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program

Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. -

C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) -

Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common

Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero

BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec

AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program

Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9000 bytes

Mr_JAk3 · Jul 13, 2007

Hello jamesdang

You're infected.

Rename HijackThis.exe to Scanner.exe

Post a fresh HijacKThis (scanner.exe) log to here.
:bigthumb:

jamesdang · Jul 14, 2007

Renamed: from hijackthis.exe to Scanner.exe

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:56 PM, on 7/13/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\HiJackThis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {30181FF8-D069-F79C-4B17-828DBC2D82EA} - C:\WINDOWS\System32\lxma.dll
O2 - BHO: (no name) - {59322E40-1834-4FEA-B597-942053AF342E} - C:\WINDOWS\System32\ddcyw.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\System32\xavxyyhy.dll
O2 - BHO: (no name) - {941508F8-CCD9-44E0-AC29-4F1E141373F7} - C:\WINDOWS\System32\gebxwxu.dll
O2 - BHO: (no name) - {D45A0DAD-8F83-4B56-A4BB-7F28FB7B87D6} - C:\WINDOWS\System32\ddcyw.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\xdbuajfv.dll",forkonce
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Owner\APPLIC~1\WNSXS~1\spoolsv.exe" -vt yazb
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) - https://www.web-a-file.com/webafiledownloader.cab
O20 - Winlogon Notify: ddcyw - C:\WINDOWS\System32\ddcyw.dll
O20 - Winlogon Notify: gebxwxu - C:\WINDOWS\SYSTEM32\gebxwxu.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 10055 bytes

Mr_JAk3 · Jul 14, 2007

Ok let's start the cleaning...

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

jamesdang · Jul 14, 2007

C:\vundofix.tex

VundoFix V6.5.4

Checking Java version...

Scan started at 9:45:03 AM 7/14/2007

Listing files found while scanning....

C:\windows\system32\bkqkfbsw.ini
C:\windows\system32\bmjnktrd.dll
C:\WINDOWS\System32\ddcyw.dll
C:\windows\system32\drtknjmb.ini
C:\WINDOWS\System32\hdwsbimg.dll
C:\WINDOWS\System32\kwedhxrg.dll
C:\windows\system32\vfjaubdx.ini
C:\windows\system32\wsbfkqkb.dll
C:\WINDOWS\System32\wycdd.bak1
C:\WINDOWS\System32\wycdd.bak2
C:\WINDOWS\System32\wycdd.ini
C:\WINDOWS\System32\wycdd.ini2
C:\WINDOWS\System32\xdbuajfv.dll

Beginning removal...

Attempting to delete C:\windows\system32\bkqkfbsw.ini
C:\windows\system32\bkqkfbsw.ini Has been deleted!

Attempting to delete C:\windows\system32\bmjnktrd.dll
C:\windows\system32\bmjnktrd.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\ddcyw.dll
C:\WINDOWS\System32\ddcyw.dll Has been deleted!

Attempting to delete C:\windows\system32\drtknjmb.ini
C:\windows\system32\drtknjmb.ini Has been deleted!

Attempting to delete C:\windows\system32\vfjaubdx.ini
C:\windows\system32\vfjaubdx.ini Has been deleted!

Attempting to delete C:\windows\system32\wsbfkqkb.dll
C:\windows\system32\wsbfkqkb.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\wycdd.bak1
C:\WINDOWS\System32\wycdd.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\wycdd.bak2
C:\WINDOWS\System32\wycdd.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\wycdd.ini
C:\WINDOWS\System32\wycdd.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\wycdd.ini2
C:\WINDOWS\System32\wycdd.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\xdbuajfv.dll
C:\WINDOWS\System32\xdbuajfv.dll Has been deleted!

Performing Repairs to the registry.
Done!

jamesdang · Jul 14, 2007

"Please post the contents of C:\vundofix.txt and a new HiJackThis log"

This log is created by Scanner.exe (not HiJackThis.exe).

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:13:14 AM, on 7/14/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\HiJackThis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670}

- C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {28E93659-479A-42A7-B8EA-5D4187833ED6} -

C:\WINDOWS\System32\vtsqq.dll
O2 - BHO: Yahoo! IE Services Button -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program

Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} -

C:\WINDOWS\System32\xavxyyhy.dll
O2 - BHO: (no name) - {941508F8-CCD9-44E0-AC29-4F1E141373F7} -

C:\WINDOWS\System32\gebxwxu.dll
O2 - BHO: (no name) - {CD4AD09A-AFE0-45CA-AD31-484A421A329E} -

C:\WINDOWS\System32\ddcyw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media

Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client

Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual

Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual

Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge]

C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro

Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common

Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom

HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common

Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe

61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [WinAntiSpyware 2007 Free] "C:\Program

Files\WinAntiSpyware 2007\was7.exe" /min
O4 - HKLM\..\Run: [uwas7cw] "C:\Program Files\Common Files\WinAntiSpyware

2007\uwas7cw.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager]

"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat

7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default

user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program

Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Services -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program

Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -

http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) -

http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program

Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support)

- C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeF

ullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/w

uweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/m

uweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} -

http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) -

https://www.web-a-file.com/webafiledownloader.cab
O20 - Winlogon Notify: gebxwxu - C:\WINDOWS\SYSTEM32\gebxwxu.dll
O20 - Winlogon Notify: vtsqq - C:\WINDOWS\System32\vtsqq.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program

Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. -

C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) -

Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common

Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero

BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec

AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program

Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9672 bytes

jamesdang · Jul 15, 2007

Hi Mr_JAk3
My computer poped up a lots.
It takes a lot of time

when starting the computer. Look like something running. Icon of Winantivirus is located at everywhere: (1) right bottom corner, (2)right click at Start button, (3) Left click at Start button /Program/Winantivirus. Maybe somewhere else I don't know.
Please help. Thank you very much.

Mr_JAk3 · Jul 15, 2007

Hello

Ok let's get rid of the nasties....

Disable Word Wrap in notepad, that'll make the logs readable.
Notepad -> Format -> Disable Word Wrap

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

jamesdang · Jul 15, 2007

combofix.exe

I saved combofix.exe on Desktop. Double click, it looks like Dos.
After done, it disappeared. I don't know where the log file. I will find (search) and I will post right after this.
Thanks

jamesdang · Jul 15, 2007

OK, I got it. The following post is the log file of ComboFix.

Because it is too long. I have to divide by maybe 3. Thanks

This is part 1

"Owner" - 2007-07-15 14:20:45 - ComboFix 07-07-14.6 - Service Pack 1 NTFS
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\kpjmgxvh.dll
C:\WINDOWS\system32\cesrugfw.dll
C:\WINDOWS\system32\dqspyygx.dll
C:\WINDOWS\system32\ftwugjsi.dll
C:\WINDOWS\system32\ikncfsjo.dll
C:\WINDOWS\system32\rkakknvq.dll
C:\WINDOWS\system32\xavxyyhy.dll
C:\WINDOWS\system32\qqstv.bak1
C:\WINDOWS\system32\qqstv.bak2
C:\WINDOWS\system32\qqstv.ini
C:\WINDOWS\system32\qqstv.ini2
C:\WINDOWS\system32\qqstv.tmp
C:\WINDOWS\system32\hvxgmjpk.ini
C:\WINDOWS\system32\vtsqq.dll
C:\WINDOWS\system32\gebxwxu.dll
C:\WINDOWS\system32\gebxwxu.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\#SharedObjects\EGYWQCEL\www.broadcaster.com
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007 free
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007 free\DownloadUWAS7.url
C:\DOCUME~1\Owner\APPLIC~1.\winantispyware 2007\Logs\update.log
C:\DOCUME~1\Owner\Desktop.\internet explorer.lnk
C:\DOCUME~1\Tuan-Anh\APPLIC~1\WinAntiSpyware 2007
C:\DOCUME~1\Tuan-Anh\APPLIC~1\WinAntiSpyware 2007\Logs\update.log
C:\Documents and Settings\Owner.\err.log
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\poolsv
C:\Program Files\poolsv\k11u72.exe
C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe
C:\Program Files\poolsv\wr-1-0000077.exe
C:\Program Files\poolsv\YazzleBundle-1549.exe
C:\Program Files\winantispyware 2007
C:\Program Files\winantispyware 2007\Activate.dat
C:\Program Files\winantispyware 2007\appupdate.dat
C:\Program Files\winantispyware 2007\AsAgents.dll
C:\Program Files\winantispyware 2007\AsAgents.xml
C:\Program Files\winantispyware 2007\atl71.dll
C:\Program Files\winantispyware 2007\AutoProcess.dat
C:\Program Files\winantispyware 2007\bnlink.dat
C:\Program Files\winantispyware 2007\database\enemies.dat
C:\Program Files\winantispyware 2007\database\knownfiles.dat
C:\Program Files\winantispyware 2007\database\TEBase.dat
C:\Program Files\winantispyware 2007\database\vbpv.dat
C:\Program Files\winantispyware 2007\dbupdate.dat
C:\Program Files\winantispyware 2007\fopnl.dll
C:\Program Files\winantispyware 2007\InstHelp.exe
C:\Program Files\winantispyware 2007\InstUp.exe
C:\Program Files\winantispyware 2007\lapv.dat
C:\Program Files\winantispyware 2007\license.rtf
C:\Program Files\winantispyware 2007\manual.pdf
C:\Program Files\winantispyware 2007\manual.url
C:\Program Files\winantispyware 2007\mfc71.dll
C:\Program Files\winantispyware 2007\monstate.dat
C:\Program Files\winantispyware 2007\msvcp71.dll
C:\Program Files\winantispyware 2007\msvcr71.dll
C:\Program Files\winantispyware 2007\ps.dat
C:\Program Files\winantispyware 2007\pv.dat
C:\Program Files\winantispyware 2007\quaratine.dat\#post_quarantine
C:\Program Files\winantispyware 2007\readme.rtf

jamesdang · Jul 15, 2007

Combofix log file

This is part 2

C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\03ad66abe38c45da6d7abfb5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\03ad66abe38c45da6d7abfb5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\0cff50b831394ebbb2c370b4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\0cff50b831394ebbb2c370b4\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\10bf2922cda34a326ab6639a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\10bf2922cda34a326ab6639a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1c2182852cfe44f3c7e5c79a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1c2182852cfe44f3c7e5c79a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1fc5c945b4b343d8d3bc3c8d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\1fc5c945b4b343d8d3bc3c8d\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\20c647d65d3043d7404c5e94\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\20c647d65d3043d7404c5e94\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\20c647d65d3043d7404c5e94\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\23626a318b8748cd4f49878a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\23626a318b8748cd4f49878a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\32e01566472d4030b669b8a2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\32e01566472d4030b669b8a2\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\37e6204810c74b34328326bd\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\37e6204810c74b34328326bd\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\38ac7218572f401cf9b7c0bb\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\38ac7218572f401cf9b7c0bb\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\397fe9c247d945681cc931b5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\397fe9c247d945681cc931b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\397fe9c247d945681cc931b5\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3a4b0957cc884f4b2c95db8a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3a4b0957cc884f4b2c95db8a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3b3d05285024456eb6800bab\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\3b3d05285024456eb6800bab\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\45a334447e0b4facda6decb9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\45a334447e0b4facda6decb9\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\49f921e0638a4a7da37336b0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\49f921e0638a4a7da37336b0\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\4e4767691b0e4457089eb198\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\4e4767691b0e4457089eb198\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\5fb051e9d5a44c839c65349b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\5fb051e9d5a44c839c65349b\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\641c321d5daf4bb32b327d8e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\641c321d5daf4bb32b327d8e\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\70d7eadbcc9d4c82b4c9dc90\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\70d7eadbcc9d4c82b4c9dc90\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\727ab25b77864cf8a494bbb3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\727ab25b77864cf8a494bbb3\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\75d75f618f194f6e6f6428b7\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\75d75f618f194f6e6f6428b7\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\7a382a67a6a149a722a63c9a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\7a382a67a6a149a722a63c9a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84222500bab9410d4051aaae\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84222500bab9410d4051aaae\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84ebc7ee91eb4efc604a75a6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\84ebc7ee91eb4efc604a75a6\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\88a34a1fb6fd467beee554b2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\88a34a1fb6fd467beee554b2\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8d9ce2f96ef649844b887ea9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8d9ce2f96ef649844b887ea9\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8e7731cb73c142836c11eea4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\8e7731cb73c142836c11eea4\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9171aa56fb384c4bb4950396\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9171aa56fb384c4bb4950396\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9175a13435a54ac3da5a59b2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9175a13435a54ac3da5a59b2\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\92bc9d2d52f34f3367cdaebc\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\92bc9d2d52f34f3367cdaebc\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\947e43f3658f4c85b38c5d86\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\947e43f3658f4c85b38c5d86\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9616fcb4de394fd0fe92b895\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9616fcb4de394fd0fe92b895\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9f7adb1ec8804604a9dbd586\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\9f7adb1ec8804604a9dbd586\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a0a09aa1e81740c8c18abb85\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a0a09aa1e81740c8c18abb85\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a85e2da7c35346a26f1657bf\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a85e2da7c35346a26f1657bf\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a9d82d44e1bc429d37338094\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\a9d82d44e1bc429d37338094\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\ae1eb4d31fa4479677467186\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\ae1eb4d31fa4479677467186\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b0002ad699d14434728483b3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b0002ad699d14434728483b3\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b07d5f120e894623f3047e8a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b07d5f120e894623f3047e8a\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b33a0808c9204fff8bcdfaa8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\b33a0808c9204fff8bcdfaa8\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\cd8fc4284be1477fe63515ac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\cd8fc4284be1477fe63515ac\#settings
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\cd8fc4284be1477fe63515ac\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d0b5e2fcf1024d29c1f1b28d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d0b5e2fcf1024d29c1f1b28d\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d143686a17e14c7996e4ee87\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d143686a17e14c7996e4ee87\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d143686a17e14c7996e4ee87\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d82aa93430204fb7d8003daa\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\d82aa93430204fb7d8003daa\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\dec451b563e14c469cceed94\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\dec451b563e14c469cceed94\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e3a9855a40ad449cbbe44d89\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e3a9855a40ad449cbbe44d89\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e7c7f82a5d4a4b0466818896\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\e7c7f82a5d4a4b0466818896\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\f7aa822d9b174ccd4c011499\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\f7aa822d9b174ccd4c011499\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fb0287d5a66c48cd03a28394\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fb0287d5a66c48cd03a28394\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fd808d37293b453be7d2eb95\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\3593b5112b66471c3fbf96a8\fd808d37293b453be7d2eb95\#startup
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\#internal

jamesdang · Jul 15, 2007

Combofix log file

This is part 3

C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\12eab4c2183a4de8883c898f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\12eab4c2183a4de8883c898f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\12eab4c2183a4de8883c898f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\2fd16a0ae5e44161a28ddd9f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\2fd16a0ae5e44161a28ddd9f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\2fd16a0ae5e44161a28ddd9f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\f20eb561cddb42652def99a9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\f20eb561cddb42652def99a9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\f20eb561cddb42652def99a9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\fc1d7251ea7c433c07acb2a3\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\fc1d7251ea7c433c07acb2a3\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\16066bffdd8a448f5454fdb5\fc1d7251ea7c433c07acb2a3\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\2b45ea7b96184b1e26698985\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\2b45ea7b96184b1e26698985\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\2b45ea7b96184b1e26698985\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\8250361803884a4adee821a5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\8250361803884a4adee821a5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\8250361803884a4adee821a5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\9b707620731742926532bfa5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\9b707620731742926532bfa5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\9b707620731742926532bfa5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\cf17b2fc1ffe4a82cb95fcbe\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\cf17b2fc1ffe4a82cb95fcbe\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\65a60d1c95e640fa3373bfa6\cf17b2fc1ffe4a82cb95fcbe\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\02f58ad2a12b4f589c5372be\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\02f58ad2a12b4f589c5372be\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\02f58ad2a12b4f589c5372be\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\03ec5ba96f6f47586dab70ad\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\03ec5ba96f6f47586dab70ad\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\03ec5ba96f6f47586dab70ad\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\09f28183f76b426988ad1e96\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\09f28183f76b426988ad1e96\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\09f28183f76b426988ad1e96\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0a05d532f10f40eef229c796\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0a05d532f10f40eef229c796\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0a05d532f10f40eef229c796\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0c90fcab5b994c7eb0744db0\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0d12302efdca4b7ca49e898e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0d12302efdca4b7ca49e898e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0d12302efdca4b7ca49e898e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0f302b00de7e4cb14361c290\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0f302b00de7e4cb14361c290\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\0f302b00de7e4cb14361c290\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\13090301131141a9680cb98b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\13090301131141a9680cb98b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\13090301131141a9680cb98b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\174731cbc32c4871c174748b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\174731cbc32c4871c174748b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\174731cbc32c4871c174748b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\17bd1a5602224667d5ec7c81\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\219f10cc9e404eac1b629da8\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\219f10cc9e404eac1b629da8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\219f10cc9e404eac1b629da8\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\2592f750764a476da8a9168a\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\2592f750764a476da8a9168a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\2592f750764a476da8a9168a\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\26a21175728d40ecf762f399\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\26a21175728d40ecf762f399\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\26a21175728d40ecf762f399\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\291ca87dff0845257bd30f86\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\31184fe8979b4dfd208231bc\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\3db20b5220734750f5e41cb1\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\3db20b5220734750f5e41cb1\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\3db20b5220734750f5e41cb1\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\476d3e2689e245ace88e23af\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\476d3e2689e245ace88e23af\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\476d3e2689e245ace88e23af\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4b185752577043b8630bdd93\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4b185752577043b8630bdd93\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4b185752577043b8630bdd93\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d0d23aad2db4ae4d8dbdf9a\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4d25e213eebc488a1616e99b\Owner

jamesdang · Jul 15, 2007

Combofix log file

This is part 5

C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4e90069959a04d16d30634b5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4e90069959a04d16d30634b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\4e90069959a04d16d30634b5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\526ab164519a41e49392a49f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\526ab164519a41e49392a49f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\526ab164519a41e49392a49f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\561b3cbf0f9041745383ecb8\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\561b3cbf0f9041745383ecb8\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\561b3cbf0f9041745383ecb8\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a383e2757474408e20b9ca4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a383e2757474408e20b9ca4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a383e2757474408e20b9ca4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a3a7cfc7ec44b62f58de98c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a3a7cfc7ec44b62f58de98c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a3a7cfc7ec44b62f58de98c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a6c9ea1ed164b1b740bc89c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a6c9ea1ed164b1b740bc89c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5a6c9ea1ed164b1b740bc89c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5c0531c9c38e41813f84f7a9\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\5e445d1464ff400ccd121f86\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\6312a3695e3e4d0770062a97\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\6312a3695e3e4d0770062a97\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\6312a3695e3e4d0770062a97\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\7f8bd0bf44134d99163a148b\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\7f8bd0bf44134d99163a148b\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\7f8bd0bf44134d99163a148b\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\801bc23e40c1467d44851088\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\801bc23e40c1467d44851088\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\801bc23e40c1467d44851088\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8170a21d69a8412804b1ca85\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8afda875126d4730d99d6a8e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8afda875126d4730d99d6a8e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\8afda875126d4730d99d6a8e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\92529a0f066840f296695da2\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\92529a0f066840f296695da2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\92529a0f066840f296695da2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9bc0d9d433b64a862614fcad\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9e8ac280c7b14eda52397395\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9e8ac280c7b14eda52397395\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\9e8ac280c7b14eda52397395\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a17bfefddc9d46e1e9494d9e\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a17bfefddc9d46e1e9494d9e\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a17bfefddc9d46e1e9494d9e\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a6d37cb33c4742d93074b9b7\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\a7bfd917ba404041d849018d\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ad515cc0221340f5bd8225ac\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ade235fa33c34c91b56f0aa0\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\af735fc9770a4657ea482788\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\af735fc9770a4657ea482788\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\af735fc9770a4657ea482788\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\bcbf0fd22dd64ad736cfd595\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\bcbf0fd22dd64ad736cfd595\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\bcbf0fd22dd64ad736cfd595\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c0b53ecee33943eaa8f095b9\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c1c98000f59946c13171d1b4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c1c98000f59946c13171d1b4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c1c98000f59946c13171d1b4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c2c1611edf3d4a38257fe284\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c3862ab545714913838a3993\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c3862ab545714913838a3993\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\c3862ab545714913838a3993\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\cb15418d360643ba4b7e7a9f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\cb15418d360643ba4b7e7a9f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\cb15418d360643ba4b7e7a9f\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\ccfabf172559411976bcdaac\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d12b001d81e64e51d449ba93\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d16061ab569c4580ade514a5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d16061ab569c4580ade514a5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d16061ab569c4580ade514a5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\d4d10e6a24db4efcc16ce788\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\db19d2aa66a143ddfaf273b6\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e2686755445f45166aba229c\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e2686755445f45166aba229c\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e2686755445f45166aba229c\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\e882c9d6cd2146dc8a94fe98\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f01ba2b44f894c2ed3fc97b5\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f01ba2b44f894c2ed3fc97b5\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f01ba2b44f894c2ed3fc97b5\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f1d93cca32184b49339c9981\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f1d93cca32184b49339c9981\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f1d93cca32184b49339c9981\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f27e110f60934b9192ac81be\Owner
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f2c97edc61174d893be93da1\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f2c97edc61174d893be93da1\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f2c97edc61174d893be93da1\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f392ce0d68d645a806d700b4\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f392ce0d68d645a806d700b4\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f392ce0d68d645a806d700b4\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f656fc2a47404e91352314b2\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f656fc2a47404e91352314b2\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f656fc2a47404e91352314b2\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f9d00726d37c4073ea7f9ead\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f9d00726d37c4073ea7f9ead\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\f9d00726d37c4073ea7f9ead\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fb7250c9e7ae42aaddaac486\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fb7250c9e7ae42aaddaac486\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fb7250c9e7ae42aaddaac486\#name
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fd22e38830714bee4eedf89f\#data
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fd22e38830714bee4eedf89f\#internal
C:\Program Files\winantispyware 2007\RTMonitor.dat\7a270d38798740913f1ed286\7daade9225b541967cb365b5\fd22e38830714bee4eedf89f\#name

jamesdang · Jul 15, 2007

End of log
C:\Program Files\winantispyware 2007\scanlog.xml
C:\Program Files\winantispyware 2007\settings.ini
C:\Program Files\winantispyware 2007\shellext.dll
C:\Program Files\winantispyware 2007\shellext.xml
C:\Program Files\winantispyware 2007\sr.log
C:\Program Files\winantispyware 2007\Summary.dat
C:\Program Files\winantispyware 2007\support.url
C:\Program Files\winantispyware 2007\tasks.dat
C:\Program Files\winantispyware 2007\threatnet.dat
C:\Program Files\winantispyware 2007\threatnet.ini
C:\Program Files\winantispyware 2007\unins000.dat
C:\Program Files\winantispyware 2007\unins000.exe
C:\Program Files\winantispyware 2007\uninstall.ico
C:\Program Files\winantispyware 2007\UnWizard.exe
C:\Program Files\winantispyware 2007\unwizard.xml
C:\Program Files\winantispyware 2007\up.dat
C:\Program Files\winantispyware 2007\updater.dat
C:\Program Files\winantispyware 2007\was7.exe
C:\Program Files\winantispyware 2007\WAS7.url
C:\Program Files\winantispyware 2007\WAS7.xml
C:\temp\0b9
C:\temp\iee
C:\WINDOWS\b136.exe
C:\WINDOWS\poolsv.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\SmFtZXMgRGFuZw\asappsrv.dll
C:\WINDOWS\SmFtZXMgRGFuZw\command.exe
C:\WINDOWS\system32\acbfqtex.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\drivers\ApiMon.sys
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\fsymagie.exe
C:\WINDOWS\system32\ifnarpju.exe
C:\WINDOWS\system32\jie.dll
C:\WINDOWS\system32\jkgbjyox.exe
C:\WINDOWS\system32\kxyvomvf.exe
C:\WINDOWS\system32\ndamjddn.exe
C:\WINDOWS\system32\o09PrEz
C:\WINDOWS\system32\rwbepnza.dll
C:\WINDOWS\system32\sstem~1
C:\WINDOWS\system32\sstem~1\rundll.exe
C:\WINDOWS\system32\stera.exe
C:\WINDOWS\system32\wnstssv.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\wr.txt

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_CMDSERVICE
-------\LEGACY_IPRIP
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\Network Monitor

((((((((((((((((((((((((( Files Created from 2007-06-15 to 2007-07-15 )))))))))))))))))))))))))))))))

2007-07-15 14:48 616,448 --ah----- C:\StashIMAPI.bin
2007-07-15 14:19 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-14 18:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Yahoo!
2007-07-14 18:16 <DIR> d--hs---- C:\WINDOWS\SmFtZXMgRGFuZw
2007-07-14 18:16 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-07-14 09:45 <DIR> d-------- C:\VundoFix Backups
2007-07-13 13:09 <DIR> d-------- C:\DOCUME~1\Tuan-Anh\APPLIC~1\DivX
2007-07-10 20:04 24,576 --------- C:\WINDOWS\SvcCon.exe
2007-06-22 02:07 <DIR> d-------- C:\DOCUME~1\UNCLET~1\APPLIC~1\DivX
2007-06-21 16:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-06-21 13:56 <DIR> d-------- C:\DOCUME~1\UNCLEQ~1\APPLIC~1\DivX
2007-06-19 20:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2007-06-18 19:55 <DIR> d-------- C:\Program Files\TomTom HOME

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 21:34:50 -------- d-----w C:\Program Files\Symantec AntiVirus
2007-07-14 17:14:12 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\SolidWorks
2007-07-10 14:11:26 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-06-22 04:25:27 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Yahoo!
2007-06-21 22:31:50 -------- d-----w C:\Program Files\Yahoo!
2007-06-19 02:55:39 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-10 17:38:28 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\DivX
2007-06-08 01:09:14 -------- d-----w C:\Program Files\DivX
2007-06-01 16:01:16 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-01 16:00:45 -------- d-----w C:\Program Files\Symantec
2007-06-01 15:54:00 -------- d-----w C:\Program Files\SBC Self Support Tool
2007-06-01 15:53:31 -------- d-----w C:\Program Files\Common Files\Motive
2007-06-01 15:48:00 -------- d-----w C:\Program Files\Common Files\Scanner
2007-06-01 01:13:37 -------- d-----w C:\Program Files\Messenger
2007-06-01 01:07:28 1,542,513 --sha-w C:\WINDOWS\system32\ijllm.ini2
2007-06-01 01:06:08 1,541,681 --sha-w C:\WINDOWS\system32\ijllm.bak2
2007-05-31 01:52:22 444 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-05-30 20:30:27 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-30 20:30:24 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-05-30 20:30:21 36,624 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-05-30 20:30:21 2,560 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-05-30 20:30:21 2,432 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-05-30 20:30:21 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-05-30 20:30:21 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-05-30 20:30:21 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-05-30 20:30:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-05-30 20:30:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-05-30 20:27:55 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-05-30 20:27:55 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-05-30 20:27:54 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-05-30 20:27:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-05-30 20:27:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-05-30 20:27:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-30 20:27:51 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-30 20:27:51 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-30 20:27:23 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-05-30 20:27:23 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-05-24 01:33:08 -------- d-----w C:\Program Files\Computrainer
2007-05-24 00:04:10 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Error Safe Free
2007-05-22 04:06:42 1,498,299 --sha-w C:\WINDOWS\system32\ijllm.bak1
2007-05-19 00:32:29 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Vso
2007-05-19 00:32:28 87,608 ----a-w C:\DOCUME~1\Owner\APPLIC~1\ezpinst.exe
2007-05-19 00:32:28 47,360 ----a-w C:\DOCUME~1\Owner\APPLIC~1\pcouffin.sys
2007-05-19 00:30:46 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\SmFtZXMgRGFuZw\mAIQtrg0l3IRtT.vbs

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-03-20 14:39 803864 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2006-10-31 13:33 198136 --a------ C:\Program Files\Yahoo!\Common\yiesrvc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{641914A9-D968-F69C-1217-828DBC2D80BC}]
C:\WINDOWS\System32\jie.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD4AD09A-AFE0-45CA-AD31-484A421A329E}]
C:\WINDOWS\System32\ddcyw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 C:\WINDOWS\BCMSMMSG.exe]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"IPInSightLAN 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 02:52]
"IPInSightMonitor 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 02:52]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" []
"InstantAccess"="C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe" [2000-01-19 16:43]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 16:52]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-07-16 13:26]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4567AB12-B980-44A5-B259-9B09EBEA6331}"="C:\Program Files\WinAntiSpyware 2007\shellext.dll" []

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-15 14:48:08
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-07-15 14:50:01 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-15 14:49

--- E O F ---

jamesdang · Jul 15, 2007

Corrected

post # 13 should be This is part 4 not part 5
Thanks.

Mr_JAk3 · Jul 16, 2007

OK let's see...

Look in your control panels add/remove programs for any of these and uninstall them:

WinAntivirus
Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
or anything similar with Oin or Outerinfo in it.
Zolero
Tizzletalk
MediaTickets
Cowabanga
and any other programs you didn't install or don't recognize - if your not sure please ask first

Download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Then run ComboFix again and post it's fresh log to here (it should be a bit shorter than the last one). Also please post a fresh HijackThis log :bigthumb:

jamesdang · Jul 18, 2007

ComboFix 07-17-2007 @ 8:51 PM

"Owner" - 2007-07-17 20:40:58 - ComboFix 07-07-14.6 - Service Pack 1 NTFS

((((((((((((((((((((((((( Files Created from 2007-06-18 to 2007-07-18 )))))))))))))))))))))))))))))))

2007-07-15 14:19 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-14 18:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Yahoo!
2007-07-14 18:16 <DIR> d--hs---- C:\WINDOWS\SmFtZXMgRGFuZw
2007-07-14 18:16 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-07-14 09:45 <DIR> d-------- C:\VundoFix Backups
2007-07-13 13:09 <DIR> d-------- C:\DOCUME~1\Tuan-Anh\APPLIC~1\DivX
2007-07-10 20:04 24,576 --------- C:\WINDOWS\SvcCon.exe
2007-06-22 02:07 <DIR> d-------- C:\DOCUME~1\UNCLET~1\APPLIC~1\DivX
2007-06-21 13:56 <DIR> d-------- C:\DOCUME~1\UNCLEQ~1\APPLIC~1\DivX
2007-06-19 20:02 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2007-06-18 19:55 <DIR> d-------- C:\Program Files\TomTom HOME

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-18 03:22:11 -------- d-----w C:\Program Files\Symantec AntiVirus
2007-07-18 03:21:14 -------- d-----w C:\Program Files\Yahoo!
2007-07-14 17:14:12 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\SolidWorks
2007-07-10 14:11:26 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-06-22 04:25:27 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Yahoo!
2007-06-19 02:55:39 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-10 17:38:28 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\DivX
2007-06-08 01:09:14 -------- d-----w C:\Program Files\DivX
2007-06-01 16:01:16 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-01 16:00:45 -------- d-----w C:\Program Files\Symantec
2007-06-01 15:54:00 -------- d-----w C:\Program Files\SBC Self Support Tool
2007-06-01 15:53:31 -------- d-----w C:\Program Files\Common Files\Motive
2007-06-01 15:48:00 -------- d-----w C:\Program Files\Common Files\Scanner
2007-06-01 01:13:37 -------- d-----w C:\Program Files\Messenger
2007-06-01 01:07:28 1,542,513 --sha-w C:\WINDOWS\system32\ijllm.ini2
2007-06-01 01:06:08 1,541,681 --sha-w C:\WINDOWS\system32\ijllm.bak2
2007-05-31 01:52:22 444 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-05-30 20:30:27 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-30 20:30:24 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-05-30 20:30:21 36,624 ----a-w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-05-30 20:30:21 2,560 ----a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-05-30 20:30:21 2,432 ----a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-05-30 20:30:21 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2007-05-30 20:30:21 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2007-05-30 20:30:21 116,472 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2007-05-30 20:30:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-05-30 20:30:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-05-30 20:27:55 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-05-30 20:27:55 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-05-30 20:27:54 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-05-30 20:27:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-05-30 20:27:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-05-30 20:27:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-05-30 20:27:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-30 20:27:51 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-30 20:27:51 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-30 20:27:51 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-05-30 20:27:23 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-05-30 20:27:23 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-05-24 01:33:08 -------- d-----w C:\Program Files\Computrainer
2007-05-24 00:04:10 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Error Safe Free
2007-05-22 04:06:42 1,498,299 --sha-w C:\WINDOWS\system32\ijllm.bak1
2007-05-19 00:32:29 -------- d-----w C:\DOCUME~1\Owner\APPLIC~1\Vso
2007-05-19 00:32:28 87,608 ----a-w C:\DOCUME~1\Owner\APPLIC~1\ezpinst.exe
2007-05-19 00:32:28 47,360 ----a-w C:\DOCUME~1\Owner\APPLIC~1\pcouffin.sys
2007-05-19 00:30:46 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\SmFtZXMgRGFuZw\mAIQtrg0l3IRtT.vbs

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{641914A9-D968-F69C-1217-828DBC2D80BC}]
C:\WINDOWS\System32\jie.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD4AD09A-AFE0-45CA-AD31-484A421A329E}]
C:\WINDOWS\System32\ddcyw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 05:59 C:\WINDOWS\BCMSMMSG.exe]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 22:26]
"IPInSightLAN 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 02:52]
"IPInSightMonitor 02"="C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 02:52]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" []
"InstantAccess"="C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe" [2000-01-19 16:43]
"NWEReboot"="" []
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 16:44]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 15:18]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 16:52]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-07-16 13:26]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 14:32]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4567AB12-B980-44A5-B259-9B09EBEA6331}"="C:\Program Files\WinAntiSpyware 2007\shellext.dll" []

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-17 20:47:55
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-17 20:48:42
C:\ComboFix-quarantined-files.txt ... 2007-07-17 20:48
C:\ComboFix2.txt ... 2007-07-15 14:50

--- E O F ---

jamesdang · Jul 18, 2007

Fresh HiJackThis log after Combofix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:23 PM, on 7/17/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\HiJackThis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {641914A9-D968-F69C-1217-828DBC2D80BC} - C:\WINDOWS\System32\jie.dll (file missing)
O2 - BHO: (no name) - {CD4AD09A-AFE0-45CA-AD31-484A421A329E} - C:\WINDOWS\System32\ddcyw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\TextBridge Pro Millennium\Bin\InstantAccess.exe /h
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.gioitre.org/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137299390562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137299378734
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D1792F99-AA90-4D46-8B73-2CE45DADDD3C} (WAFDownloader Class) - https://www.web-a-file.com/webafiledownloader.cab
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Fuse Service - Intuit - C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 7909 bytes

Mr_JAk3 · Jul 18, 2007

Hi again, we'll continue

You should print these instructions or save these to a text file. Follow these instructions carefully.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Download ATF Cleaner by Atribune to your desktop.
Do NOT run yet.

Make your hidden files visible:

Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.

==================

Open Control Panel -> Add/Remove programs -> Remove all the of the following or similar entries if found:

Error Safe Free

and any other programs you didn't install or don't recognize - if your not sure please ask first

Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {641914A9-D968-F69C-1217-828DBC2D80BC} - C:\WINDOWS\System32\jie.dll (file missing)
O2 - BHO: (no name) - {CD4AD09A-AFE0-45CA-AD31-484A421A329E} - C:\WINDOWS\System32\ddcyw.dll (file missing)

Restart your computer to the safe mode:

Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.

Go to the My Computer and delete the following files (if present):
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.bak2
C:\WINDOWS\system32\ijllm.bak1

Go to the My Computer and delete the following folders (if present):
C:\Documents and Settings\Owner\Application Data\Error Safe Free
C:\WINDOWS\SmFtZXMgRGFuZw
C:\Documents and Settings\Local Settings\Application Data\NetMon

Run ATF Cleaner

Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Restart the computer to the normal mode.

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

================

When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log

jamesdang · Jul 19, 2007

I did step by step by your instruction

First step: from download AVG anti-Syyware to Show hidden files and folder, unchecked "hide protected operating system files".

Run HijackThis and fix checked. Ok.

There is no problems here.

The problem at: "Restart your computer to the safe mode".

My computer happen to have winAntiSpyware 2007 4.0.193.0

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

New member

New member

Security Expert-Emeritus

New member

New member

New member

New member

New member

New member

New member

Security Expert-Emeritus

New member

New member

Security Expert-Emeritus

New member