Virtumonde.prx

Dante711 · Jan 29, 2009

I was asked to help a family friend with this infected computer. Downloaded, installed, updated SS&D. After finding out to keep the pointer off of the program I was able to run it. Spybot listed Virtumonde.prx as the only problem it couldn't fix. After some research I decided this was the place to be for more help. A backup has been made with ERUNT and I read through the stickies. I uninstalled Java 1.4.2 after my first attempt to clean this machine but before I looked into this forum for help. No, they won't get there computer back until I've gone through the safer surfing tips listed here with possibly a test after. Thanking you in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:00:44 PM, on 1/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINDOWS\system32\ntdll64.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theanimalrescuesite.com/...eId=4&link=ctg_trs_home_from_ars_home_sitenav
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: NetAssistantBHO Class - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\My.Freeze.com Toolbar\NetAssistant.dll (file missing)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Gamevance - {0ED403E8-470A-4a8a-85A4-D7688CFE39A3} - (no file)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5bd74d3f-8f1b-496d-8014-8eff8a4fdcf2} - C:\WINDOWS\system32\tuhinibo.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\uywcluwb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: NetAssistantBHO - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files\My.Freeze.com Toolbar\NetAssistant.dll (file missing)
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
O3 - Toolbar: My.Freeze.com Toolbar - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Mmevomebuf] rundll32.exe "C:\WINDOWS\orulifetahefozuj.dll",e
O4 - HKLM\..\Run: [Vmafuqis] rundll32.exe "C:\WINDOWS\Mpojoziyije.dll",e
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [CPMab233c29] Rundll32.exe "c:\windows\system32\fuwofapi.dll",a
O4 - HKLM\..\Run: [jahebikode] Rundll32.exe "C:\WINDOWS\system32\torazovi.dll",s
O4 - HKLM\..\Run: [a8100fb5] rundll32.exe "C:\WINDOWS\system32\ihglnvwy.dll",b
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" /start /minimize
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Doctor Virus Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" /start /minimize
O4 - HKCU\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZUman000
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\docume~1\owner\locals~1\temp\ntdll64.dll
O15 - Trusted Zone: *.salesnexus.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218328767890
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218462079718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: luzggk.dll bgrbhr.dll c:\windows\system32\beromavu.dll jrjlnr.dll cbpvyb.dll c:\windows\system32\fuwofapi.dll,C:\WINDOWS\system32\bobajitu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\fuwofapi.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\fuwofapi.dll (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 13887 bytes

Bio-Hazard · Jan 30, 2009

Hello and Welcome to forums!

My name is Bio-Hazard and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

I will be working on your Malware issues this may or may not solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
I f you don't know or understand something please don't hesitate to ask.
Please DO NOT run any other tools or scans whilst I am helping you.
It is important that you reply to this thread. Do not start a new topic.
Absence of symptoms does not mean that everything is clear.

NOTE: Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe

Bio-Hazard · Jan 30, 2009

Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

Alternate download link 1
Alternate download link 2

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
- Make sure the Perform Full Scan option is selected.
- Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and Scan in progress will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say The scan completed successfully. Click 'Show Results' to display all objects found.
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download and Run ComboFix

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

HOW TO USE COMBOFIX

IMPORTANT: combofix.exe MUST be on your Desktop for us to proceed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Double click on ComboFix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

NOTE: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Combofix should never take more that 20 minutes including the reboot if malware is detected.

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
Malwarebytes Antimalware Log
New HijackThis log

Dante711 · Jan 31, 2009

Stage 1 complete

Followed the directions with one deviation: After combofix produced the log I was left with a blank desktop (no icons, toolbar, etc.) and no activity. Ctrl-Alt-Del to restart and the computer seemed to restart normally. Here are the logs and thank you very much for your time.

ComboFix 09-01-21.04 - Owner 2009-01-30 20:45:02.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.211 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\dobe~1
c:\program files\mantec~1
c:\program files\mantec~1\??mantec\
c:\program files\scurit~1
c:\program files\ssembl~1
c:\program files\wintouch
c:\program files\wintouch\wintouch.cfg
c:\windows\IA
c:\windows\IA\KE.vbs
c:\windows\stem32~1
c:\windows\system32\test.ttt
c:\windows\system32\uniq.tll
c:\windows\system32\win32hlp.cnf
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-31 )))))))))))))))))))))))))))))))
.

2009-01-30 20:37 . 2009-01-30 20:37 86,528 --a------ c:\windows\system32\pfdvqaxj.dll
2009-01-30 20:37 . 2009-01-30 20:37 120 ---hs---- c:\windows\system32\jxaqvdfp.ini
2009-01-30 18:41 . 2009-01-30 20:33 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-30 18:41 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-29 14:59 . 2009-01-29 14:59 <DIR> d-------- c:\program files\Trend Micro
2009-01-29 14:57 . 2009-01-29 14:58 <DIR> d-------- c:\program files\ERUNT
2009-01-28 22:08 . 2009-01-30 20:45 276,416 --ahs---- c:\windows\system32\XFfMlUtv.ini2
2009-01-28 22:08 . 2009-01-30 20:45 276,416 --ahs---- c:\windows\system32\XFfMlUtv.ini
2009-01-28 20:05 . 2009-01-28 20:05 133,255 --ahs---- c:\windows\system32\cbpvyb.dll
2009-01-28 20:05 . 2009-01-28 20:05 120 ---hs---- c:\windows\system32\ibitawum.ini
2009-01-28 19:22 . 2003-10-11 04:30 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\WINDOWS
2009-01-28 19:22 . 2008-09-14 17:52 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Yahoo!
2009-01-28 19:22 . 2003-10-14 05:31 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Symantec
2009-01-28 19:22 . 2003-10-11 04:06 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Sonic
2009-01-28 19:22 . 2003-10-11 05:03 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\SampleView
2009-01-28 19:22 . 2003-10-14 05:35 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\interMute
2009-01-28 19:22 . 2009-01-28 19:22 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT
2009-01-28 18:12 . 2009-01-28 20:13 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-28 18:12 . 2009-01-28 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a------ c:\windows\system32\hidserv.dll
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-01-28 15:40 . 2009-01-28 15:40 125,440 --a--c--- c:\windows\system32\dllcache\userinit.exe
2009-01-27 15:05 . 2009-01-27 15:05 133,191 --ahs---- c:\windows\system32\bgrbhr.dll
2009-01-27 08:08 . 2009-01-27 08:08 475 --a------ c:\windows\ojegevus.dll
2009-01-26 13:09 . 2009-01-26 13:09 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-25 22:58 . 2009-01-25 22:58 <DIR> d-------- C:\temp
2009-01-25 22:57 . 2009-01-25 22:57 827,392 --a------ c:\windows\system32\FLASH.OCX
2009-01-25 13:25 . 2009-01-25 13:25 1,434,061 ---hs---- c:\windows\system32\unoeixqj.tmp
2009-01-25 13:01 . 2009-01-25 13:01 129,536 --a------ c:\windows\system32\lhcndy.dll
2009-01-25 13:00 . 2009-01-25 13:01 129,536 --a------ c:\windows\system32\cfxckdvg.dll
2009-01-25 12:59 . 2009-01-30 20:35 1,104 --a------ c:\windows\qragyjdm
2009-01-24 16:02 . 2009-01-24 16:02 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Gamelab
2009-01-24 11:07 . 2009-01-24 11:08 <DIR> d-------- c:\documents and settings\Everette\Application Data\BeachPartyCraze
2009-01-21 22:23 . 2009-01-26 12:51 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-01-20 19:28 . 2009-01-20 19:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Winferno
2009-01-20 19:25 . 2009-01-20 19:25 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper
2009-01-20 19:23 . 2009-01-20 19:23 <DIR> d-------- c:\program files\Winferno
2009-01-19 15:22 . 2009-01-19 15:22 <DIR> d-------- c:\documents and settings\Owner\Application Data\iWin
2009-01-19 15:22 . 2009-01-19 15:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\iWin
2009-01-18 09:01 . 2009-01-18 09:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\NeptunesAdve
2009-01-16 17:16 . 2009-01-16 17:16 <DIR> d-------- c:\documents and settings\Owner\Application Data\Talkback
2009-01-16 17:02 . 2009-01-16 17:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\FreshGames
2009-01-16 15:45 . 2009-01-16 15:45 <DIR> d-------- c:\documents and settings\Owner\Application Data\Gamelab
2009-01-15 16:15 . 2009-01-15 16:15 <DIR> d-------- c:\documents and settings\Owner\Application Data\GameInvest
2009-01-11 14:18 . 2009-01-11 14:24 <DIR> d-------- c:\program files\Typing Test TQ
2009-01-10 20:00 . 2009-01-10 20:00 <DIR> d-------- c:\documents and settings\Owner\Application Data\My Games
2009-01-09 21:28 . 2009-01-09 21:28 <DIR> d-------- c:\documents and settings\Owner\Application Data\Amazon
2009-01-09 21:27 . 2009-01-09 21:27 <DIR> d-------- c:\program files\Amazon
2009-01-08 10:39 . 2009-01-08 10:39 <DIR> d-------- c:\documents and settings\Everette\Application Data\My Games
2009-01-07 13:44 . 2009-01-07 13:44 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\PlayFirst
2009-01-05 14:47 . 2009-01-05 14:47 <DIR> d-------- c:\program files\DivX
2009-01-03 15:03 . 2009-01-03 15:03 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Common Files
2009-01-03 14:58 . 2009-01-03 14:58 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Gaijin Ent
2009-01-01 09:42 . 2009-01-27 15:17 40 --a------ c:\windows\RSoftInfo.dat
2009-01-01 09:40 . 2009-01-01 09:40 <DIR> d-------- c:\program files\Raptisoft
2009-01-01 09:40 . 2009-01-01 09:40 352,256 --a------ c:\windows\eSellerateEngine.dll
2009-01-01 09:30 . 2009-01-01 09:30 <DIR> d-------- c:\documents and settings\Everette\Application Data\Gaijin Ent
2008-12-30 19:19 . 2008-12-30 19:19 <DIR> d-------- c:\documents and settings\Owner\Application Data\Gaijin Ent
2008-12-30 19:09 . 2008-12-30 19:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\GameHouse
2008-12-30 18:12 . 2008-12-30 18:12 <DIR> d-------- c:\documents and settings\Owner\Application Data\Gamehouse_Janes_Realty
2008-12-29 16:33 . 2009-01-16 09:54 <DIR> d-------- c:\documents and settings\Owner\Application Data\PlayFirst
2008-12-29 16:28 . 2008-12-29 16:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Fugazo
2008-12-28 21:49 . 2008-12-28 21:50 <DIR> d-------- c:\documents and settings\Owner\Application Data\PetShowCraze
2008-12-25 20:29 . 2008-12-25 20:29 <DIR> d-------- c:\documents and settings\Owner\Application Data\ViquaSoft
2008-12-25 18:01 . 2008-12-25 18:01 <DIR> d-------- c:\documents and settings\Owner\Application Data\Pogo Games
2008-12-24 21:38 . 2008-12-24 21:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\MythPeople
2008-12-22 21:13 . 2008-12-22 21:13 <DIR> d-------- c:\documents and settings\Everette\Application Data\RealArcade
2008-12-19 20:57 . 2008-12-19 20:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2008-12-18 19:41 . 2008-12-18 19:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2008-12-18 10:16 . 2008-12-18 10:21 <DIR> d-------- c:\documents and settings\Owner\Application Data\U3
2008-12-16 15:49 . 2008-12-16 15:49 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\My Games
2008-12-15 20:33 . 2008-12-15 20:33 <DIR> d-------- c:\documents and settings\Owner\Application Data\Eyeblaster
2008-12-15 19:44 . 2009-01-25 18:32 <DIR> d-------- c:\program files\GameHouse
2008-12-15 19:44 . 2009-01-23 18:43 <DIR> d-------- c:\documents and settings\Owner\Application Data\GameHouse
2008-12-15 19:11 . 2009-01-19 15:16 <DIR> d-------- c:\program files\RealArcade
2008-12-15 19:11 . 2009-01-19 15:17 <DIR> d-------- C:\GameHouse Games
2008-12-15 16:03 . 2008-12-15 16:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Gogii
2008-12-14 15:34 . 2008-12-14 15:34 <DIR> d-------- c:\documents and settings\Everette\Application Data\Talkback
2008-12-06 16:19 . 2009-01-01 16:40 <DIR> d-------- c:\documents and settings\Everette\Application Data\iWin
2008-12-05 15:14 . 2008-12-05 15:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\MumboJumbo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-29 07:19 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-29 04:05 133,255 --sha-w c:\windows\system32\pewekasi.dll
2009-01-28 23:40 125,440 ----a-w c:\windows\system32\userinit.exe
2009-01-26 20:51 --------- d-----w c:\program files\RecordNow!
2009-01-26 20:51 --------- d-----w c:\program files\CyberDefender
2009-01-26 20:51 --------- d-----w c:\program files\Compaq Instant Support
2009-01-26 17:17 --------- d-----w c:\program files\Microsoft Works
2009-01-26 17:15 --------- d-----w c:\documents and settings\Owner\Application Data\Skype
2009-01-26 17:15 --------- d-----w c:\documents and settings\Everette\Application Data\Skype
2009-01-24 19:00 --------- d-----w c:\documents and settings\Everette\Application Data\GameHouse
2009-01-24 18:02 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\GameHouse
2009-01-20 00:19 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-01-11 23:19 --------- d-----w c:\documents and settings\Owner\Application Data\Image Zone Express
2008-12-29 23:40 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-29 19:33 --------- d-----w c:\documents and settings\Owner\Application Data\skypePM
2008-12-24 04:58 --------- d-----w c:\documents and settings\Owner\Application Data\Stamps.com Internet Postage
2008-12-24 04:30 --------- d-----w c:\program files\Easy Internet signup
2008-12-17 22:54 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2008-12-14 17:01 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\HP
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-11-30 16:37 --------- d-----w c:\documents and settings\All Users\Application Data\Arcade Lab
2008-11-30 16:15 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\Image Zone Express
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-10-27 02:45 60,744 ----a-w c:\documents and settings\Owner\g2mdlhlpx.exe
2008-10-27 02:36 60,744 ----a-w c:\documents and settings\Everette\g2mdlhlpx.exe
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-01 00:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2004-07-11 21:19 84 ----a-w c:\documents and settings\Owner\Application Data\tvmcwrd.dll
2006-10-11 08:04 61,036 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 48,742 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 29,313 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 41,082 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 166,510 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

------- Sigcheck -------

2004-08-03 23:56 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-13 16:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe
2004-08-03 23:56 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\SoftwareDistribution\Download\6ca7b3a8efd5a9b6f87fff395a2eb989\userinit.exe
2009-01-28 15:40 125440 ffd1c035dcc3f5a9448f50d0b7be5a42 c:\windows\system32\userinit.exe
2009-01-28 15:40 125440 ffd1c035dcc3f5a9448f50d0b7be5a42 c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-22 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Spyware Cleaner Monitor"="c:\program files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" [2008-04-23 2192104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]
"Doctor Virus Cleaner Monitor"="c:\program files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" [2008-04-23 2060008]
"summitsoft Kids Control"="c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe" [2008-04-23 140008]
"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-10-11 151597]
"summitsoft Kids Control"="c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe" [2008-04-23 140008]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-15 282624]
"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-08-19 4841472]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]
"a8100fb5"="c:\windows\system32\pfdvqaxj.dll" [2009-01-30 86528]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"MSHNetSetup"="c:\windows\msbn\_setup.exe" [2003-02-19 131072]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 557056]

c:\documents and settings\Christi\Start Menu\Programs\Startup\
HotSync Manager.LNK - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2008-06-24 217088]
HOTSYNCSHORTCUTNAME.lnk - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Broadband Networking.lnk - c:\windows\Installer\{06B2B442-19FE-4398-BD4B-F5C00928DD8E}\_18be6784.exe [2004-05-02 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=G G

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\WINDOWS\\system32\\winlogon.exe"=
"c:\\WINDOWS\\explorer.exe"=
"c:\\WINDOWS\\system32\\logonui.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

S0 qragyjdm;qragyjdm;c:\windows\system32\drivers\gfyywwbb.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d77aade2-cd2f-11dd-b3d1-000ea666c68b}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-01-31 c:\windows\Tasks\ieqayshx.job
- c:\docume~1\PAIGE~1.NEW\LOCALS~1\Temp\efcBsRij.dll []

2009-01-31 c:\windows\Tasks\User_Feed_Synchronization-{CBE06E3D-72CE-491C-A757-EC0D8BDAE056}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]

2009-01-31 c:\windows\Tasks\wvakniyt.job
- c:\docume~1\Everette\LOCALS~1\Temp\opnonmjK.dll []
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - c:\program files\My.Freeze.com Toolbar\NetAssistant.dll
BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
BHO-{79D580BB-B973-485B-AA8A-3568F7529D2C} - c:\windows\system32\vtUlMfFX.dll
BHO-{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - c:\program files\My.Freeze.com Toolbar\NetAssistant.dll
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
Toolbar-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - c:\program files\My.Freeze.com Toolbar\freeze_us.dll
WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - c:\program files\My.Freeze.com Toolbar\freeze_us.dll
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
HKCU-Run-RecordNow! - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theanimalrescuesite.com/clickToGive/home.faces;jsessionid=A1E8B675914867DAE0611B889B5948D8.ctgProd04?siteId=4&link=ctg_trs_home_from_ars_home_sitenav
uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/
mSearch Bar = hxxp://srch-qus10.hpwis.com/
uInternet Connection Wizard,ShellNext = hxxp://qus10.hpwis.com/
uInternet Settings,ProxyOverride = localhost
IE: &Search - ?p=ZUman000
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
LSP: SpSubLSP.dll
Trusted Zone: salesnexus.com
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\xe0gw9ji.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-30 20:47:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\bgrbhr.dll
c:\windows\system32\cbpvyb.dll

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\bgrbhr.dll
c:\windows\system32\cbpvyb.dll
c:\windows\system32\vtUlMfFX.dll
c:\windows\system32\SpSubLSP.dll
.
Completion time: 2009-01-30 20:49:44
ComboFix-quarantined-files.txt 2009-01-31 04:49:41

Pre-Run: 125,550,166,016 bytes free
Post-Run: 128,200,523,776 bytes free

312 --- E O F --- 2009-01-22 06:23:39

Malwarebytes' Anti-Malware 1.33
Database version: 1711
Windows 5.1.2600 Service Pack 3

1/30/2009 8:33:57 PM
mbam-log-2009-01-30 (20-33-52).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 211417
Time elapsed: 1 hour(s), 19 minute(s), 12 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 10
Registry Keys Infected: 37
Registry Values Infected: 8
Registry Data Items Infected: 11
Folders Infected: 2
Files Infected: 51

Memory Processes Infected:
C:\WINDOWS\system32\ntdll64.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> No action taken.

Memory Modules Infected:
C:\WINDOWS\system32\ihglnvwy.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\torazovi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\tuhinibo.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\bobajitu.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\luzggk.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\jrjlnr.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\uywcluwb.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ixeakjlm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\Mpojoziyije.dll (Adware.BHO) -> No action taken.
C:\WINDOWS\system32\komjee.dll (Trojan.Vundo) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5bd74d3f-8f1b-496d-8014-8eff8a4fdcf2} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5bd74d3f-8f1b-496d-8014-8eff8a4fdcf2} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77ab5974-55a3-4737-9fd5-b93c64307f78} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{77ab5974-55a3-4737-9fd5-b93c64307f78} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5bd74d3f-8f1b-496d-8014-8eff8a4fdcf2} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2fa631cf-441a-4c4e-a138-a62434c56bb3} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2fa631cf-441a-4c4e-a138-a62434c56bb3} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2bf5b407-5678-4108-9615-457b7996667c} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2bf5b407-5678-4108-9615-457b7996667c} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{77ab5974-55a3-4737-9fd5-b93c64307f78} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b77ce989-c2a0-4786-aa23-8c1ddfb27e83} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a8100fb5 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmab233c29 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jahebikode (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vmafuqis (Adware.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mmevomebuf (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\bobajitu.dll -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\bobajitu.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\bobajitu.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\Program Files\Temporary (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Owner\Application Data\cogad (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\system32\ihglnvwy.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ywvnlghi.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\torazovi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\tuhinibo.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\uywcluwb.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\bobajitu.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\luzggk.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\jrjlnr.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ixeakjlm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\Mpojoziyije.dll (Adware.BHO) -> No action taken.
C:\WINDOWS\system32\komjee.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Christi\Local Settings\Temporary Internet Files\Content.IE5\9ZJXIBJ0\kb65666[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Everette\Local Settings\Temp\opnonmjK.dll (Adware.BHO) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\794CJNO3\156[1].net (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I5SU5F7U\index[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I5SU5F7U\upd105320[1] (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\Owner\My Documents\Christi\Local Settings\Temporary Internet Files\Content.IE5\9ZJXIBJ0\kb65666[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Paige.NEWPORT\Local Settings\Temp\efcBsRij.dll (Adware.BHO) -> No action taken.
C:\Documents and Settings\Paige.NEWPORT\Local Settings\Temporary Internet Files\Content.IE5\7U4LZ7U9\apstpldr.dll[1].htm (Adware.BHO) -> No action taken.
C:\Program Files\GameHouse\Ranch Rush\ijl15.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\Quarantine\39726.7461192477\MyWebSearch\bar\4.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\Quarantine\39726.7461192477\MyWebSearch\bar\4.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\Quarantine\39768.3820656019\A0022354.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP146\A0042776.dll (Adware.Shoper) -> No action taken.
C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> No action taken.
C:\WINDOWS\IA\asappsrv.dll (Adware.CommAd) -> No action taken.
C:\WINDOWS\IA\command.exe (Adware.CommAd) -> No action taken.
C:\WINDOWS\system32\chert5-998.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\efcArsss.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\nammfjpu.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ononjjqd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\opnmlJaW.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\senukare.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\tuvSIxXr.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqPIAQj.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wvUoMcbY.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\orulifetahefozuj.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\ntdll64.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BMab233c29.xml (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BMab233c29.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Administrator.NEWPORT\Local Settings\Temp\ntdll64.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Administrator.NEWPORT\Local Settings\Temp\mousehook.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Owner\Application Data\tvmknwrd.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\__11.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\ntdll64.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\mousehook.dll (Trojan.FakeAlert) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:10 PM, on 1/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theanimalrescuesite.com/...eId=4&link=ctg_trs_home_from_ars_home_sitenav
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {6A9DC3BC-0B3B-4F22-AC12-139A2B6A6408} - C:\WINDOWS\system32\vtUlMfFX.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [a8100fb5] rundll32.exe "C:\WINDOWS\system32\pfdvqaxj.dll",b
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" /start /minimize
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Doctor Virus Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" /start /minimize
O4 - HKCU\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKUS\S-1-5-19\..\Run: [jahebikode] Rundll32.exe "C:\WINDOWS\system32\torazovi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [jahebikode] Rundll32.exe "C:\WINDOWS\system32\torazovi.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'Default user')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZUman000
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.salesnexus.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218328767890
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218462079718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: G G
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 12919 bytes

Bio-Hazard · Jan 31, 2009

Hello!

I am going through your logs at the moment. I will post back soon as i can. On the Malwarebytes log it said No Action Taken, did fix all those entries? If you havent rerun Malwarebytes and fix all those entries.

Dante711 · Feb 1, 2009

rerun of Malewarebytes

I did have it fix the selected and am not sure why that wasn't shown on the log. Perhaps I posted the wrong one. To be on the safe side I reran Malewarebytes and here is the latest log from that. As the program was running an error occurred: Generic Host Process for Win32 Services Appname svchost.exe
I let maleware continue running and didn't pick send or don't send. When maleware was shuting down the computer to restart another window popped up: Error with DCOM server process launcher
and started a count down to restart the computer.

After restart things appeared normal. I'm sure it's not clean though.

Malwarebytes' Anti-Malware 1.33
Database version: 1711
Windows 5.1.2600 Service Pack 3

2/1/2009 12:32:00 PM
mbam-log-2009-02-01 (12-32-00).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 192915
Time elapsed: 1 hour(s), 7 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4cd82b64-f412-450a-9d5e-e8f5a5f01583} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4cd82b64-f412-450a-9d5e-e8f5a5f01583} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\vtUlMfFX.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vtUlMfFX.dllbox (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\c:\windows\system32\vtulmffx.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\XFfMlUtv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Bio-Hazard · Feb 2, 2009

I'd like you to check (a file/some files) for Viruses.

Go to VirusTotal or Jotti's

c:\windows\system32\userinit.exe

Click to expand...

Copy/Paste file into the white Upload a file box.
Click Send/Submit, and the file will upload to VirusTotal/Jotti, where it will be scanned by several anti-virus programmes.
After a while, a window will open, with details of what the scans found.
Copy and Paste results in your next reply.

Run CFScript

Close any open browsers.
Open Notepad by click start
Click Run
Type notepad into the box and click enter
Notepad will open
Copy and Paste everything from the Code box into Notepad:

Code:

Driver::
qragyjdm

File::
c:\windows\system32\bgrbhr.dll
c:\windows\system32\cbpvyb.dll
c:\windows\system32\vtUlMfFX.dll
c:\windows\system32\pfdvqaxj.dll
c:\windows\system32\jxaqvdfp.ini
c:\windows\system32\XFfMlUtv.ini2
c:\windows\system32\XFfMlUtv.ini
c:\windows\system32\ibitawum.ini
c:\windows\system32\bgrbhr.dll
c:\windows\ojegevus.dll
c:\windows\system32\unoeixqj.tmp
c:\windows\system32\lhcndy.dll
c:\windows\system32\cfxckdvg.dll
c:\windows\qragyjdm
c:\windows\system32\pewekasi.dll
c:\windows\system32\pfdvqaxj.dll
c:\windows\system32\drivers\gfyywwbb.sys
c:\windows\Tasks\ieqayshx.job
c:\docume~1\PAIGE~1.NEW\LOCALS~1\Temp\efcBsRij.dll
c:\windows\Tasks\wvakniyt.job
c:\docume~1\Everette\LOCALS~1\Temp\opnonmjK.dll
c:\documents and settings\Owner\Application Data\tvmcwrd.dll

Folder::
c:\program files\CyberDefender

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"a8100fb5"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\explorer.exe"=-

Save this as CFScript.txt, in the same location as ComboFix.exe (on your desktop)

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt

NOTE: Do not mouseclick combofix's window whilst it's running. That may cause it to stall it.

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
Virustotal results
New HijackThis log

Dante711 · Feb 3, 2009

Abridged logs

I apologize in advance if it was the incorrect action, but I let Combofix update when it asked me to.

Windows security reports that there aren't any antivirus programs running, but at start up 2 identical windows appear. One called Spyware Cleaner and one called Virus Cleaner. They look like typical Antivirus interfaces. I've been selecting 'disable monitoring' and closing each window.

ComboFix 09-02-02.04 - Owner 2009-02-02 22:17:50.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.335 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt

FILE ::
c:\docume~1\Everette\LOCALS~1\Temp\opnonmjK.dll
c:\docume~1\PAIGE~1.NEW\LOCALS~1\Temp\efcBsRij.dll
c:\documents and settings\Owner\Application Data\tvmcwrd.dll
c:\windows\ojegevus.dll
c:\windows\qragyjdm
c:\windows\system32\bgrbhr.dll
c:\windows\system32\cbpvyb.dll
c:\windows\system32\cfxckdvg.dll
c:\windows\system32\drivers\gfyywwbb.sys
c:\windows\system32\ibitawum.ini
c:\windows\system32\jxaqvdfp.ini
c:\windows\system32\lhcndy.dll
c:\windows\system32\pewekasi.dll
c:\windows\system32\pfdvqaxj.dll
c:\windows\system32\unoeixqj.tmp
c:\windows\system32\vtUlMfFX.dll
c:\windows\system32\XFfMlUtv.ini
c:\windows\system32\XFfMlUtv.ini2
c:\windows\Tasks\ieqayshx.job
c:\windows\Tasks\wvakniyt.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Mark\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Owner\Application Data\tvmcwrd.dll
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Paige\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\user\Local Settings\Temporary Internet Files\CPV.stt

"Dante here...I removed a large portion of this log to make it fit in this post. It was combofix's list of deleted files dealing with a program called CyberDefender. I left an example below, and will paste the rest of the list in subsequent posts..."

c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\UserGuide\stbarchk.ini
c:\program files\CyberDefender\UserGuide\CybDefISS.set
c:\program files\CyberDefender\UserGuide\CybDefISSchk.ini
c:\windows\ojegevus.dll
c:\windows\qragyjdm
c:\windows\system32\_006196_.tmp.dll
c:\windows\system32\bgrbhr.dll
c:\windows\system32\cbpvyb.dll
c:\windows\system32\cfxckdvg.dll
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekadmnkoexk.sys
c:\windows\system32\felazako.dll.tmp
c:\windows\system32\gitoribo.dll.tmp
c:\windows\system32\ibitawum.ini
c:\windows\system32\lhcndy.dll
c:\windows\system32\pewekasi.dll
c:\windows\system32\senekagetnjwsj.dat
c:\windows\system32\senekarhjfselb.dll
c:\windows\system32\senekatmsiufjs.dat
c:\windows\system32\senekatxurcaoj.dll
c:\windows\system32\unoeixqj.tmp
c:\windows\system32\win32hlp.cnf
c:\windows\system32\XFfMlUtv.ini2
c:\windows\Tasks\ieqayshx.job
c:\windows\Tasks\wvakniyt.job

----- BITS: Possible infected sites -----

hxxp://knowledgeadventure.cachefly.net
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\$NtServicePackUninstall$\userinit.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SENEKA
-------\Legacy_QRAGYJDM
-------\Service_qragyjdm

((((((((((((((((((((((((( Files Created from 2009-01-03 to 2009-02-03 )))))))))))))))))))))))))))))))
.

2009-01-30 18:41 . 2009-02-01 12:31 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-30 18:41 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-29 14:59 . 2009-01-29 14:59 <DIR> d-------- c:\program files\Trend Micro
2009-01-29 14:57 . 2009-01-29 14:58 <DIR> d-------- c:\program files\ERUNT
2009-01-28 19:22 . 2003-10-11 04:30 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\WINDOWS
2009-01-28 19:22 . 2008-09-14 17:52 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Yahoo!
2009-01-28 19:22 . 2003-10-14 05:31 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Symantec
2009-01-28 19:22 . 2003-10-11 04:06 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Sonic
2009-01-28 19:22 . 2003-10-11 05:03 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\SampleView
2009-01-28 19:22 . 2003-10-14 05:35 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\interMute
2009-01-28 19:22 . 2009-01-28 19:22 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT
2009-01-28 18:12 . 2009-01-28 20:13 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-28 18:12 . 2009-01-28 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a------ c:\windows\system32\hidserv.dll
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-01-26 13:09 . 2009-01-26 13:09 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-25 22:58 . 2009-01-25 22:58 <DIR> d-------- C:\temp
2009-01-25 22:57 . 2009-01-25 22:57 827,392 --a------ c:\windows\system32\FLASH.OCX
2009-01-25 12:59 . 2009-01-25 12:59 25,088 --a------ c:\windows\system32\drivers\gfyywwbb.sys
2009-01-24 16:02 . 2009-01-24 16:02 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Gamelab
2009-01-24 11:07 . 2009-01-24 11:08 <DIR> d-------- c:\documents and settings\Everette\Application Data\BeachPartyCraze
2009-01-21 22:23 . 2009-01-26 12:51 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-01-20 19:28 . 2009-01-20 19:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Winferno
2009-01-20 19:25 . 2009-01-20 19:25 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper
2009-01-20 19:23 . 2009-01-20 19:23 <DIR> d-------- c:\program files\Winferno
2009-01-19 15:22 . 2009-01-19 15:22 <DIR> d-------- c:\documents and settings\Owner\Application Data\iWin
2009-01-19 15:22 . 2009-01-19 15:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\iWin
2009-01-18 09:01 . 2009-01-18 09:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\NeptunesAdve
2009-01-16 17:16 . 2009-01-16 17:16 <DIR> d-------- c:\documents and settings\Owner\Application Data\Talkback
2009-01-16 17:02 . 2009-01-16 17:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\FreshGames
2009-01-16 15:45 . 2009-01-16 15:45 <DIR> d-------- c:\documents and settings\Owner\Application Data\Gamelab
2009-01-15 16:15 . 2009-01-15 16:15 <DIR> d-------- c:\documents and settings\Owner\Application Data\GameInvest
2009-01-11 14:18 . 2009-01-11 14:24 <DIR> d-------- c:\program files\Typing Test TQ
2009-01-10 20:00 . 2009-01-10 20:00 <DIR> d-------- c:\documents and settings\Owner\Application Data\My Games
2009-01-09 21:28 . 2009-01-09 21:28 <DIR> d-------- c:\documents and settings\Owner\Application Data\Amazon
2009-01-09 21:27 . 2009-01-09 21:27 <DIR> d-------- c:\program files\Amazon
2009-01-08 10:39 . 2009-01-08 10:39 <DIR> d-------- c:\documents and settings\Everette\Application Data\My Games
2009-01-07 13:44 . 2009-01-07 13:44 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\PlayFirst
2009-01-05 14:47 . 2009-01-05 14:47 <DIR> d-------- c:\program files\DivX
2009-01-03 15:03 . 2009-01-03 15:03 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Common Files
2009-01-03 14:58 . 2009-01-03 14:58 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Gaijin Ent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-29 07:19 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-26 20:51 --------- d-----w c:\program files\RecordNow!
2009-01-26 20:51 --------- d-----w c:\program files\Compaq Instant Support
2009-01-26 17:17 --------- d-----w c:\program files\Microsoft Works
2009-01-26 17:15 --------- d-----w c:\documents and settings\Owner\Application Data\Skype
2009-01-26 17:15 --------- d-----w c:\documents and settings\Everette\Application Data\Skype
2009-01-26 02:32 --------- d-----w c:\program files\GameHouse
2009-01-24 19:00 --------- d-----w c:\documents and settings\Everette\Application Data\GameHouse
2009-01-24 18:02 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\GameHouse
2009-01-24 02:43 --------- d-----w c:\documents and settings\Owner\Application Data\GameHouse
2009-01-20 00:19 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-01-19 23:16 --------- d-----w c:\program files\RealArcade
2009-01-16 17:54 --------- d-----w c:\documents and settings\Owner\Application Data\PlayFirst
2009-01-11 23:19 --------- d-----w c:\documents and settings\Owner\Application Data\Image Zone Express
2009-01-02 00:40 --------- d-----w c:\documents and settings\Everette\Application Data\iWin
2009-01-01 17:40 352,256 ----a-w c:\windows\eSellerateEngine.dll
2009-01-01 17:40 --------- d-----w c:\program files\Raptisoft
2009-01-01 17:30 --------- d-----w c:\documents and settings\Everette\Application Data\Gaijin Ent
2008-12-31 03:19 --------- d-----w c:\documents and settings\Owner\Application Data\Gaijin Ent
2008-12-31 03:09 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2008-12-31 02:12 --------- d-----w c:\documents and settings\Owner\Application Data\Gamehouse_Janes_Realty
2008-12-30 00:28 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2008-12-29 23:40 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-29 19:33 --------- d-----w c:\documents and settings\Owner\Application Data\skypePM
2008-12-29 05:50 --------- d-----w c:\documents and settings\Owner\Application Data\PetShowCraze
2008-12-26 04:29 --------- d-----w c:\documents and settings\Owner\Application Data\ViquaSoft
2008-12-26 02:01 --------- d-----w c:\documents and settings\Owner\Application Data\Pogo Games
2008-12-25 05:38 --------- d-----w c:\documents and settings\All Users\Application Data\MythPeople
2008-12-24 04:58 --------- d-----w c:\documents and settings\Owner\Application Data\Stamps.com Internet Postage
2008-12-24 04:30 --------- d-----w c:\program files\Easy Internet signup
2008-12-23 05:13 --------- d-----w c:\documents and settings\Everette\Application Data\RealArcade
2008-12-20 04:57 --------- d-----w c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2008-12-19 03:41 --------- d-----w c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2008-12-18 18:21 --------- d-----w c:\documents and settings\Owner\Application Data\U3
2008-12-17 22:54 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2008-12-16 23:49 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\My Games
2008-12-16 04:33 --------- d-----w c:\documents and settings\Owner\Application Data\Eyeblaster
2008-12-16 00:03 --------- d-----w c:\documents and settings\All Users\Application Data\Gogii
2008-12-14 23:34 --------- d-----w c:\documents and settings\Everette\Application Data\Talkback
2008-12-14 17:01 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\HP
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-05 23:14 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2008-10-27 02:45 60,744 ----a-w c:\documents and settings\Owner\g2mdlhlpx.exe
2008-10-27 02:36 60,744 ----a-w c:\documents and settings\Everette\g2mdlhlpx.exe
2006-10-11 08:04 61,036 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 48,742 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 29,313 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 41,082 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 166,510 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-30_20.48.22.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\ERDNT.EXE
+ 2009-02-01 17:46:44 7,413,760 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\Users\00000001\NTUSER.DAT
+ 2009-02-01 17:46:44 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\ERDNT.EXE
+ 2009-02-03 05:59:34 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\Users\00000001\NTUSER.DAT
+ 2009-02-03 05:59:38 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\ERDNT.EXE
+ 2009-02-03 06:25:46 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\Users\00000001\NTUSER.DAT
+ 2009-02-03 06:25:46 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\Users\00000002\UsrClass.dat
+ 2005-10-21 04:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-01-31 04:36:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-03 05:59:10 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-31 04:36:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-03 05:59:10 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-28 23:40:20 125,440 -c--a-w c:\windows\system32\dllcache\userinit.exe
+ 2004-08-04 07:56:57 24,576 -c--a-w c:\windows\system32\dllcache\userinit.exe
- 2009-01-28 23:40:20 125,440 ----a-w c:\windows\system32\userinit.exe
+ 2004-08-04 07:56:57 24,576 ----a-w c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-22 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Spyware Cleaner Monitor"="c:\program files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" [2008-04-23 2192104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]
"Doctor Virus Cleaner Monitor"="c:\program files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" [2008-04-23 2060008]
"summitsoft Kids Control"="c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe" [2008-04-23 140008]
"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-10-11 151597]
"summitsoft Kids Control"="c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe" [2008-04-23 140008]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-15 282624]
"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-08-19 4841472]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"MSHNetSetup"="c:\windows\msbn\_setup.exe" [2003-02-19 131072]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 557056]

c:\documents and settings\Christi\Start Menu\Programs\Startup\
HotSync Manager.LNK - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2008-06-24 217088]
HOTSYNCSHORTCUTNAME.lnk - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Broadband Networking.lnk - c:\windows\Installer\{06B2B442-19FE-4398-BD4B-F5C00928DD8E}\_18be6784.exe [2004-05-02 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d77aade2-cd2f-11dd-b3d1-000ea666c68b}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\User_Feed_Synchronization-{CBE06E3D-72CE-491C-A757-EC0D8BDAE056}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theanimalrescuesite.com/clickToGive/home.faces;jsessionid=A1E8B675914867DAE0611B889B5948D8.ctgProd04?siteId=4&link=ctg_trs_home_from_ars_home_sitenav
uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/
mSearch Bar = hxxp://srch-qus10.hpwis.com/
uInternet Connection Wizard,ShellNext = hxxp://qus10.hpwis.com/
uInternet Settings,ProxyOverride = localhost
IE: &Search - ?p=ZUman000
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
LSP: SpSubLSP.dll
Trusted Zone: salesnexus.com
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\xe0gw9ji.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-02 22:25:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(720)
c:\windows\system32\SpSubLSP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Yahoo!\browser\ycommon.exe
c:\windows\system32\rundll32.exe
c:\program files\SBC Self Support Tool\bin\mpbtn.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-02-02 22:30:42 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt 2009-02-03 06:30:39
ComboFix2.txt 2009-01-31 04:49:46

Pre-Run: 128,171,634,688 bytes free
Post-Run: 127,994,535,936 bytes free

1434 --- E O F --- 2009-01-22 06:23:39

Antivirus Version Last Update Result
a-squared 4.0.0.93 2009.01.29 -
AhnLab-V3 5.0.0.2 2009.01.29 Win-Trojan/Xema.variant
AntiVir 7.9.0.60 2009.01.29 -
Authentium 5.1.0.4 2009.01.29 -
Avast 4.8.1281.0 2009.01.28 Win32:FakeSys-P
AVG 8.0.0.229 2009.01.29 Downloader.Generic8.TLE
BitDefender 7.2 2009.01.29 -
CAT-QuickHeal 10.00 2009.01.29 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.01.29 -
Comodo 952 2009.01.29 -
DrWeb 4.44.0.09170 2009.01.29 -
eSafe 7.0.17.0 2009.01.29 Suspicious File
eTrust-Vet 31.6.6333 2009.01.29 -
F-Prot 4.4.4.56 2009.01.29 -
F-Secure 8.0.14470.0 2009.01.29 -
Fortinet 3.117.0.0 2009.01.29 -
GData 19 2009.01.29 Win32:FakeSys-P
Ikarus T3.1.1.45.0 2009.01.29 -
K7AntiVirus 7.10.609 2009.01.29 -
Kaspersky 7.0.0.125 2009.01.29 -
McAfee 5509 2009.01.28 Downloader-ASH.gen.b
McAfee+Artemis 5509 2009.01.28 Downloader-ASH.gen.b
Microsoft 1.4205 2009.01.29 -
NOD32 3811 2009.01.29 Win32/FakeInit
Norman 6.00.02 2009.01.29 -
nProtect 2009.1.8.0 2009.01.29 -
Panda 9.5.1.2 2009.01.29 -
PCTools 4.4.2.0 2009.01.29 -
Prevx1 V2 2009.01.29 -
Rising 21.13.42.00 2009.01.23 -
SecureWeb-Gateway 6.7.6 2009.01.29 Trojan.Crypt.LooksLike.XPACK
Sophos 4.38.0 2009.01.29 -
Sunbelt 3.2.1835.2 2009.01.16 -
Symantec 10 2009.01.29 -
TheHacker 6.3.1.5.232 2009.01.29 -
TrendMicro 8.700.0.1004 2009.01.29 -
VBA32 3.12.8.11 2009.01.29 -
ViRobot 2009.1.29.1580 2009.01.29 -
VirusBuster 4.5.11.0 2009.01.29 -
Additional information
File size: 125440 bytes
MD5...: ffd1c035dcc3f5a9448f50d0b7be5a42
SHA1..: dc5bac34c05604242388e0c8d74810edea85436e
SHA256: 6d21f297117089f403e38136390a7d2db2d903944e17b87743bad9b6c63271c7
SHA512: c36a9c8e832a48c0cd01f16c36b4125c54cbec9f14c3a33a3ca65581a2514006
7750931da66576d121de7fe6d4111a1e297bdea4f86947ce7245114ab79ea3c8
ssdeep: 3072:Cq3SnNLHF+xwtdue9lqRAz40a5uOqVKtp+:f3SNJ+xwtgeAAz4ltqM+
PEiD..: -
TrID..: File type identification
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2737
timedatestamp.....: 0x49805049 (Wed Jan 28 12:32:09 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2e56 0x2600 7.98 4b1435ab8f64e19e46ebe6a7561adbc0
.rdata 0x4000 0xf99 0x1000 7.96 b718367b0032947f38409619e75ccad0
.data 0x5000 0x1b000 0x1b000 7.99 f190880d15bb2dac7466db951924976d

( 0 imports )

( 0 exports )

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:42 PM, on 2/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theanimalrescuesite.com/...eId=4&link=ctg_trs_home_from_ars_home_sitenav
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" /start /minimize
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Doctor Virus Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" /start /minimize
O4 - HKCU\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'Default user')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZUman000
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.salesnexus.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218328767890
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218462079718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 12440 bytes

Dante711 · Feb 3, 2009

Part of what was cut from the combofix log

c:\program files\CyberDefender
c:\program files\CyberDefender\AntiSpyware\AWSDLL.dll
c:\program files\CyberDefender\AntiSpyware\cdas28.exe
c:\program files\CyberDefender\AntiSpyware\CDAScfg.ini
c:\program files\CyberDefender\AntiSpyware\cdaspat.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat1.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat11.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat12.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat13.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat14.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat2.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat3.dat.03
c:\program files\CyberDefender\AntiSpyware\cdaspat4.dat.03
c:\program files\CyberDefender\AntiSpyware\CDASSettings.ini
c:\program files\CyberDefender\AntiSpyware\CDAVFS.dll
c:\program files\CyberDefender\AntiSpyware\cdspnsrv.dll
c:\program files\CyberDefender\AntiSpyware\config.ini
c:\program files\CyberDefender\AntiSpyware\ConsolidatedResources.dll
c:\program files\CyberDefender\AntiSpyware\CybDefSB.dll
c:\program files\CyberDefender\AntiSpyware\CybDefSBUI.dll
c:\program files\CyberDefender\AntiSpyware\CybDefSysUI.dll
c:\program files\CyberDefender\AntiSpyware\CyberDefenderEDC.exe
c:\program files\CyberDefender\AntiSpyware\EDCConfig.exe
c:\program files\CyberDefender\AntiSpyware\Includes\Alert.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Adware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Alert Internet Explorer.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Alert Startup Program.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Browser Changer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Browser Plugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\BrowserChanger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\BrowserPlugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Bundler.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\categories.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Commercial Key Logger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\CommercialKeyLogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Cookie.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Data Miner.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\DataMiner.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Key Logger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\KeyLogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Low Risk Adware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\LowRiskAdware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Malware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\P2P.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\RAT.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Report Tracking Cookie.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Restore tracking cookie.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Search Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\SearchHijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Spyware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Stealth.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Trojan Downloader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\TrojanDownloader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Category\Worm.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\007 Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\007 Spy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\123mania.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\180ad Solution.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\180search Assistant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\180SearchAssistant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\180Solutions.com SurfAssistant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\2020Search.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\2020Search.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\2nd-thought.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\2nd thought.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\404search.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\7AdPower.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\7FaSSt.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\7search-BrowserAccelerator.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\911-search.info.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ABC Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ABetterInternet.Aurora.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ABetterInternet.Ceres.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ABetterInternet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\About Blank.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Abox.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Absolute Key Logger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\abxtoolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ace Club Casino.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AceNotes Free.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aconti-Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aconti.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ActiveSearch (411 Ferret).txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ActiveSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ActMon Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Acx Install.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ad-Flow.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ad-Popper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdBars.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdBreak.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdBureau.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdDestroyer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adintelligence.AproposToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adlogix Browser Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adlogix.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Admanager Controller.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Admess.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Admilli Service.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdPlus-SurferBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdRoar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adrotator.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdShooter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adtomi.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adultlinks Quickbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adultlinks.Quickbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adultlinks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Advanced Searchbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Advertbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Advertising.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adviva.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AdvSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Advware.BetterInternet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ADWARE.BINET.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adware.FOne.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Adware.HotSearchBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AFA Internet Enhancement.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ahead Nero Burning Rom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Alexa Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Alexa.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\All-In-One Telcom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AllCyberSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Altnet Software.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Altnet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AltnetBDE.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AlwaysUpdatedNews.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Alyon.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Andlotsmore.com dialler.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AntiLamer Light.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AntivirusGold.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aornum.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Apropos.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ares.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AsianRaw Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Atwola Cookie.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aureate-Radiate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aureate Group Mail.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aureate or Radiate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Aureate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AutoSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\AutoUpdate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Avenue Media.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Azesearch Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BackDoor-BDI.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Agent.EN.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Delf.is.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Hackdoor.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Jeem.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Prorat.16.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Rbot.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.Thunk.E.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Backdoor.win32.bifrose.d.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BackWeb Lite.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BackWeb.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BargainBuddy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BDE Projector.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BDHelper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BDPlugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BDSearch Plugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BearShare.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Begin2search.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Belcaro GoldenRetriever.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Berbew Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BFast.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BHO_DealHelper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bho_SEP.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bho_SideFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BigTrafficNetwork.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bikinidesk.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BingoFun Games.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BlazeFind.Bridge.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BlazeFind.Browserhelper2.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BlazeFind.SearchEnhancer.ISTbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BlazeFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BlazingTools Perfect Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Blondes.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bluemountain.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bokja NetInfo.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BonziBuddy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BookedSpace.Remanent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BookedSpace.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BPS Spyware Remover.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bridge.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Brilliant Digital.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BroadCastPC.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserAid.Featured-Results.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserAid.INetP.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserAid.RunDLL16.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserAid.SearchandClick.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserAid.Startium.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserAid.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserPal.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BrowserToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BuddyLinks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BuddyMediaBHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bulla.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Bullguard Popup Ad.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BullsEye Network.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BullsEye.CashBack.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BullsEye.eXact Advertising.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BullsEye.eXact.ISEXEng.Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\BullsEye.NaviSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\C-Dilla.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\C2.lop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CallingHome.biz.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Carpe Diem.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Carpediem.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CAS.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Cashback.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CasinoClient.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CasinoOnNet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CasinoPalazzo.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Central-24 Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CES webmail.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Claria.Dashbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Claria.Precision Time.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Claria.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Claria.Weatherscope.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClearSearch.Net.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CleverIEHooker.Jeired.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClickAgents.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClickAlchemy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClickSpring.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClickSpring_MediaTickets.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClickSpring_PurityScan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Clickyes2enter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClimaxBucks.InternetOptimizer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ClipGenie.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Clkoptimizer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Clocksync.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Comedy-Planet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Comet Cursor.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Comet Systems.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Comload.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Commander Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for About Blank.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for BC Computing spy software.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for IGetNet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for Keyloggers.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for MBP dialers.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for SBSoft.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components For Spectorsoft.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Common Components for Transponders.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CommonName.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Comsoft.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Conducent FlexPak.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Conducent TimeSink.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ConfuSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Connector Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CoolSavings.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CoolWebSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CoreMetrics.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Coulomb Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Coulomb Ltd.Content Access Plugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CouponAge.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CouponsAndOffers.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CrackSpider.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CrazyWinnings.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Crush.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\CustomToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Cydoor.TOPicks.a.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Cydoor.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Daily Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DailyWinner.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DailyWinnerBHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Daosearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DAP.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dapsol Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dapsol.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DashBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Date Regon.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DateMaker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DCON.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DealHelper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DelfinProject.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Derbiz.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Desktop Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialer.Axload.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialer.IEDisco.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialer.Scom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialer.UDconnect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialer2004.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DialerData Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DialerMaker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DialerOffline.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dialerplatform.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DialXS.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Diamond Deal Casino.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Divago.Surfairy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DivX Pro 5.1.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Dluca-M.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Domain Sponsor Cookie.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DoubleClick.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Download Accelerator Plus ads.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Download Accelerator.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Downloader.Lunii.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DownloadPlus.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DownloadReceiver.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DownloadWare.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DSO Exploit.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DSSAgent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DyFuCA.InternetOptimizer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\DyFuCA.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\E2G.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\E2Give.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EasyBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EasySearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EasyWebSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eBates MoneyMaker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eBates.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eBayToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eBlaster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eGroup.InstantAccess.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eGroupDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Elite toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EliteBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Elitum.EliteBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Emesx.dll.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\emusic.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EnConfidence.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ePlugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ErrorGuard.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ESP Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eSyndicate BHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eUniverse.IncrediFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eUniverse.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eUniverse.UpdMgr.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EverAd.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eXact Advertising.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eXact ISEXEng.Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ExactSearchBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Excite.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ExDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ezCyberSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EzSearchbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\eZula HotText.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\EzuLa.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\F__kSite.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FactoryNetwork Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Fairtale Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Farmmext.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Farsighter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Fast Video Player Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FastClick.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Fastfind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FastSeeker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Fastvideoplayer dialler.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FastVideoPlayer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FavoriteMan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FCI.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FileFreedom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FindSpy.A.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FindWhateverNow.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FizzleWizzle Search Bar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FlashEnhancer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FlashenhancerBHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FlashGet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FlashTrack.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Flingstone Infamous Downloader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Flyswat.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Forbes.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Free Scratch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FreeConnectLtd.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FreeScratchAndWin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FreeScratchCards.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Fresh Bar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Funny Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FunWeb.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\FunWebProducts.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN-eWallet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN-Supported Software.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN.DashBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN.Date Manager.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN.Precision Time.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN.Screen Scenes.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GAIN.Weatherscope.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GameSpy Arcade.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Gator.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GetMirar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GigaTech SuperBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GigexAgent-SpeedDelivery.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Global Netcom Inc.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GlobalCS Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GlobalDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GloboSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Gloggle.Shing.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Gloogle Downloader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GMSoft Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GogoTools.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GoHip.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GoIndirect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Golden Eye.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Golden Palace Casino.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GoZilla.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Grip Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Grokster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\GSIM.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\H@tKeysH@@k.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hacker.ag.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Haczyk.Ulubione.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HalfLemon.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HangUpTeam.TechnicRat.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Haxdoor-H.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hellz Little Spy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hi-Wire.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hijacker.IEHost.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HitBox.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HitHopper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HitsLink.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Holystic-Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Holystic.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HomepageProtector.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hot_Pleasure.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hotsearchbar Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HotSearchBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hungry Hands porn hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HungryHands BHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HuntBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\HuntToolBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Huysuzseks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Hyperlinker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ibero Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IberoDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IBIS Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\icannnews.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ICOO Loader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IE Access.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IE Driver.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IE Plugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ie2bar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEAccess.IEDial.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEFeats.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEHijacker.Find4u.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEHijacker.HereToFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEHijacker.Hotoffers.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEHijacker.richfind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEHIjacker.SearchExe.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEHijacker.ZestyFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IELoader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEMenuExtension Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEPageHelper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IEPlugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IESearchToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\iGetNet.Natural Language Navigation.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IGetNet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ILookup.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ILookup.Vroomsearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ImIServer IEPlugin.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IncrediFindBHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\InetSpeak.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Instafinder.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Instant Access.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IntermixMedia.KeenValue.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Internet Washer Pro.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\InternetDelivery.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\InternetOptimizer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\InternetWasher.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IntexusDial.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IPinsight.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\iSearch desktop search.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\iSearch Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\iSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.ISTactiveX.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.ISTbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.ISTsvc.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.ISTsvc_Updater.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.PowerScan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.SideFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.Slotch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISearchTech.YSB.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\istbar.dotcomToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISTbar.Slotch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\istbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ISTbar.XXXToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\IwantSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\iWon.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Jeem.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Jeired.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Jraun.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\KazaaLite.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Kazoom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\KeenValue PerfectNav.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\KeenValue.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\KEXplorer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\KeyCaptor.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Keyhost Hijacker - JRaun.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Klez.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LimeShop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Limewire.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LinkGrabber 99.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LinkMaker Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LinkMaker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LinkSynergy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Locators.com Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Look2Me.Topconverting.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Look2Me.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Lop.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Lop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LoudMarketing.WinFavorites.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Lovefreegames Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Lycos Sidesearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Lycos.SideSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\LZIO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MagicControl.Agent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MagicControl.Av.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MagicControl.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MagicControl.WinMgts.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MainPean Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Mainpean Stardialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MainPean.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MakeThemCry.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Malware.Psguard.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Malware.TopAntiSpyware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MarketDart.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Marketscore Internet Accelerator.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Marketscore Netsetter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Marketscore(Netsetter).txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Masta Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Mastacash.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MatrixDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Maxifiles.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Media Pass.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Media Tickets.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaBuddy (FileFreedom).txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaCharger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaGateway.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaLoads Enhanced.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaMotor.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaPass.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaPlex.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaTicket.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaTickets.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MediaUpdate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MegaSearch Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Megasearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Memory Watcher.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MemoryMeter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MemoryWatcher.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Metadirect hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Metadirect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\metareward.com Cookie.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MicroGaming.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\midADdle.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Mindset Interactive - Favoriteman.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MiniBug.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Mirar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MoeMoney.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MOM.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MoneyTree.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Morpheus.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MPGCom Toolbar.txt

to be continued...

Dante711 · Feb 3, 2009

The rest of what was cut from the combofix log

c:\program files\CyberDefender\AntiSpyware\Includes\Description\MSConnect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MSView.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MX-Targeting.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\My Daily Horoscope.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\My Search.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\My Way.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\myDoom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MyNetProtector.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MyPointsPointAlert.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\MySearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\n-CASE.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NaughtyPops.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NavExcel.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NavHelper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NaviSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Navpmc.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\nCASE.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NeededWare.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Neo Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netpal.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NetRatings Premeter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NetRatings.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netservices BV.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netsonic.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netster Searchbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netvenda.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netvision Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Netword Agent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network Essentials.Hopper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network Essentials.ScBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network Essentials.Search-Exe.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network Essentials.SmartpopOops.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network Essentials.SmartPops.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network Essentials.WindowEnhancer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Network1.Popups.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NetworkEssentials.SCBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NetworkEssentials.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\New.net.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NewDotNet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NewsUpdate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NJStar Asian Explorer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NN_Bar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NoCreditCard Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NowBox.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NV-Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\NVDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Oemji Bar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Oemji Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OfferAgent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OffshoreClicks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\One2one Viewer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OnFlow.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OnlDial.MaConnect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OnlDial.Ole.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OnWebMedia.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Oodlz.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OpenSite.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OpinionBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OrbitExplorer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OutLaster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Overpro.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\OverPro.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\P2P Networking.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ParisVoyeur Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PeopleOnPage.Apropos.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PeopleOnPage.AproposMedia.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PeopleOnPage.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PeoplePC Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Peper Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Peper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Perfect Keylogger Lite.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Perfect Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Phony search redirector.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Piratos.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PKings-IEHelper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Pops-Stop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Pops Stop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PopUpDefence.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Popuper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Popuppers Advertising.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Porn Dialer 5-2-46-112.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Porn Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\pornbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PowerReg Scheduler.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PowerSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Powerstrip.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PrecisionPop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PrecisionTime.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Preview AdService.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ProDyne Webinstall.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PromulGate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Prutect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PSGuard Desktop Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PSGuard.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Puper.UpdateSearches.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\PurityScan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\QaBar-Adult Links Toolband.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\QaBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Qcbar.AdultLinks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\QHosts.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Qidion Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Quicknavigate Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\QuickPage.SwitchDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\QuickSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Radlight 3 PRO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Radlight Divx Player.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RadLight Media Player.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Radlight.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RapidBlaster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RasDial.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RCPrograms.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Redhotnetworks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RedV.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Regsync.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RelatedLinks BHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RelatedLinks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Remote Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ReplaceSearch.BHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Rex Services.Adtrojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RichFind.Q.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RightFinder.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RiverSoftware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Roings.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Rsync.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Ruboskizo.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RVP.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\RXToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Rydial.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Safecast.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Safeguard Protect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SafeSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SafeSurfing.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SahAgent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SandBoxer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SaveNow - WhenUSave.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SaveNow.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Scam.Trackzapper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SCBAR.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SDBot.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Search-Pounder.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Search Assistant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Search Miracle.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Search Relevancy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Search Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Searchalot.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchAndClick.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchbarCash.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchCentrix.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchEnhancement hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchEnhancement.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchExe.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchFast.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchForIt Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Searchforit.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchForIt.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Searchit.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchMaid.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchMiracle.EliteBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Searchmiracle.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchPounders Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchRelevancy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchSquire.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchV.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\searchwww.hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SearchWWW.IEToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SecondThought.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Secret-Crush.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SecretCrush.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Security iGuard.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\seekseek hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Seeq Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Sesso.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SexCounter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Sexfiles Dialers.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SexFiles.nu.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SexList.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SexTracker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShareDocs.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShopAtHome.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShopAtHomeSelect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShopForGood.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShopNav Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShopNav.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShopNavSearch.Srng.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ShowBehind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\sICRO Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SideFind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SideSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SinSource.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Slagent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SlimFTP.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SlotchBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SmartBrowser.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SmartPops - Network Essentials.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SmitFraud.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Softomate Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Specific911 Hijack.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Spector Pro Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpediaBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Speedblaster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpeedDelivery.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Spy Recon Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyArsenal HomeKeylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyBlast.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyBuddy Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyDeleter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyKeylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyKiller 2005.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpyPC Keylogger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpySheriff.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Spyware.Perezzz.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpywareNo.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SpywareNuker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SquireSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Srng.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\StarInstall(MainPean).txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Startnow.Hyperbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Startpage.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Starware Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Starware.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Statblaster.MemoryWatcher.b.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Statblaster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\StoolBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\StopPop.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Strip Player.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SubSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SunInfoConnect.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SupaSeek.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Super-gals.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Super-spider Hijacker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SuperBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Superlogy.com.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Supersmileys.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SupremeSpy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SureBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Surf Accuracy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Surfairy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SurfAssistant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Surfbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SurfSideKick.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SwimSuitNetwork.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SwitchDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SyncroAd.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SySsfitb.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\System Soap Pro.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\System Soap.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\System Spy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\System1060.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SysWeb-Telecom Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SysWebTelecom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\SyvumClickTM.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TafBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Target Saver.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TargetNet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Targetsaver.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Targetsoft.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TeenXXX (TinyBar).txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Teknum Updater.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TestTimer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TheSearchMall.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TIB Browser.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TIBS Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TIBS dialers.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TIBS Premium Rate Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TIBS Premium Rate Dialler.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TightVNC.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Timbuktu Pro.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Timesink.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TinTel dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TinTel.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TinyBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Tinyo.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ToolbarCC.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TopConverting Crazywinnings.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TopConverting Downloader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Topconverting.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TOPicks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TopMoxie.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TopPicks.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TopRebates.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TopSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TrafficHog.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Ahexe.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Alchemy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.BI.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Bolger.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Ceres.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.LocalNRD.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Multimpp.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.MXTarget.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Pynix.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Speer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.Twain-tech.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Transponder.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Troj.Dloader.FQ.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan-Downloader-Hidden.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan-Downloader-Stubby.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan-Fake Warning.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan Common Components.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan Downloader Apher.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan drsnsrch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Banker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.CallingHome.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Delf.IT.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Dialer.FU.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.DNS Changer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.BHOmod.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.CT.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.Domcom.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.FH.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.FQ.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.Pacimedia.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Downloader.Small.BDZ.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Dropper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Drsnsrch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Dumaru.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.FakeAlert.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.FakeSpy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.FavAdd.ae.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Favadd.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Hacktool.Rootkit.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Pakes.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Popuper.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Proxy.BK.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Proxy.Webber.O.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Sheldor.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Spywad.A.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.StartPage.BN.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.startpage.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Stubby.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Win32.Revop.c.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Win32.Sdbot-QG.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Trojan.Wuviewer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TSCash.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Tubby Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TubbyBHO.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TurboDownload.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TV Media Display.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TvMedia.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Twain-tech.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TwainTech.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Twister.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\TX4.BrowserAd.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\UCmore.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\UKVideo2 Dialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Unknown Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ValueAd.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VBouncer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Virtual Bouncer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VirtualBouncer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Virtumonde.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VLoading.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\vx2 (Transponder).txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2 Transponder variant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2.aBetterInternet.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2.BTGrab.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2.DealsOnline.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2.Host.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2.LocalNRD.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\VX2.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\W32.Bagle.I.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\W32.HLLW.Xolox.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WareOut.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Web3000.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebDialer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebHancer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebInstall.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebRebates.TopRebates.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebRebates.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebSearch Toolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WebTrends live.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.ClockSync.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.Control.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.DesktopToolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.SaveNow.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.Search.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenU.WeatherCast.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenUSave.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WhenUSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WildMedia.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WildTangent.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win-Spy.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.Backdoor.Jeem.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\win32.blaster.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.Downloader.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.LolaWeb.Trojan.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\win32.mydoom.p@mm.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.Netsky.B.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.Perfiler.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.Sasser.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.Welchia.B.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Win32.winshow.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WinAD.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WindowEnhancer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Windows AdControl.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WindUpdate.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WindUpdates.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WinFavorites.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Wink.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Winpage Blocker.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Winpup.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Winpup32.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WinTools.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Wishbone.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Wowvirgins.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\WurldMedia.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Xrenoder.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Xupiter.OrbitExplorer.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Xupiter.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\XXXDIAL.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\XXXtoolbar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\YourSiteBar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ZANGO Search Assistant.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Zango.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Zestyfind.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ZipClix.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\Zoombar.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Description\ZSearch.txt
c:\program files\CyberDefender\AntiSpyware\Includes\Loading Index.htm
c:\program files\CyberDefender\AntiSpyware\Includes\NoItems Index.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Notify.wav
c:\program files\CyberDefender\AntiSpyware\Includes\Report Spyware.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Report.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Restore Spyware.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Restore.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Settings Browser Helper Objects.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Settings Internet Explorer.htm
c:\program files\CyberDefender\AntiSpyware\Includes\Settings Startup Program.htm
c:\program files\CyberDefender\AntiSpyware\InstallResource.dll
c:\program files\CyberDefender\AntiSpyware\iss_sm.ico
c:\program files\CyberDefender\AntiSpyware\ISSIntro.exe
c:\program files\CyberDefender\AntiSpyware\sum.htm
c:\program files\CyberDefender\AntiSpyware\support.ico
c:\program files\CyberDefender\AntiSpyware\support_sm.ico
c:\program files\CyberDefender\AntiSpyware\UserGuide\cdaschk.ini
c:\program files\CyberDefender\AntiSpyware\UserGuide\cybdefantispy.set
c:\program files\CyberDefender\AntiSpyware\wslvucfg.ini
c:\program files\CyberDefender\AntiVirus\CapiCom.Dll
c:\program files\CyberDefender\AntiVirus\cdav2a.exe
c:\program files\CyberDefender\AntiVirus\CDAVcfg.ini
c:\program files\CyberDefender\AntiVirus\CDAVFS.dll
c:\program files\CyberDefender\AntiVirus\CDAVFS.inf
c:\program files\CyberDefender\AntiVirus\CDAVFS.sys
c:\program files\CyberDefender\AntiVirus\cdavpat.dat.03
c:\program files\CyberDefender\AntiVirus\cdavpat.dat.04
c:\program files\CyberDefender\AntiVirus\cdavpat.dat.05
c:\program files\CyberDefender\AntiVirus\CDAVSettings.ini
c:\program files\CyberDefender\AntiVirus\cdspnsrv.dll
c:\program files\CyberDefender\AntiVirus\CybDefAV.dll
c:\program files\CyberDefender\AntiVirus\CybDefAVUI.dll
c:\program files\CyberDefender\AntiVirus\CybDefCom.dll
c:\program files\CyberDefender\AntiVirus\CybDefExt.dll
c:\program files\CyberDefender\AntiVirus\CyberDefenderEDC.exe
c:\program files\CyberDefender\AntiVirus\DisableWindowsFirewall.exe
c:\program files\CyberDefender\AntiVirus\EnableWindowsFirewall.exe
c:\program files\CyberDefender\AntiVirus\Html\History eMail.htm
c:\program files\CyberDefender\AntiVirus\Html\History File.htm
c:\program files\CyberDefender\AntiVirus\Html\Loading Index.htm
c:\program files\CyberDefender\AntiVirus\Html\NoItems Index.htm
c:\program files\CyberDefender\AntiVirus\Html\Notify.wav
c:\program files\CyberDefender\AntiVirus\UserGuide\CybDefAV.set
c:\program files\CyberDefender\AntiVirus\UserGuide\CybDefAVchk.ini
c:\program files\CyberDefender\AntiVirus\uwcdsoe.dl_
c:\program files\CyberDefender\AntiVirus\uwcdsoe.dll
c:\program files\CyberDefender\AntiVirus\uwcdsolk.dl_
c:\program files\CyberDefender\AntiVirus\uwcdsolk.dll
c:\program files\CyberDefender\AntiVirus\uwhook32.dl_
c:\program files\CyberDefender\AntiVirus\uwhook32.dll
c:\program files\CyberDefender\AntiVirus\wslvucfg.ini
c:\program files\CyberDefender\cdinstx.exe
c:\program files\CyberDefender\earlySpam\cdaspm.dll
c:\program files\CyberDefender\earlySpam\images\block_normal.bmp
c:\program files\CyberDefender\earlySpam\images\block_over.bmp
c:\program files\CyberDefender\earlySpam\images\earlySPAMBtn.bmp
c:\program files\CyberDefender\earlySpam\images\grant_normal.bmp
c:\program files\CyberDefender\earlySpam\images\grant_over.bmp
c:\program files\CyberDefender\earlySpam\images\options_normal.bmp
c:\program files\CyberDefender\earlySpam\images\options_over.bmp
c:\program files\CyberDefender\earlySpam\images\spy_normal.bmp
c:\program files\CyberDefender\earlySpam\images\spy_over.bmp
c:\program files\CyberDefender\earlySpam\oeapiinitcom.dll
c:\program files\CyberDefender\earlySpam\oecom.dll
c:\program files\CyberDefender\earlySpam\oestore.dll
c:\program files\CyberDefender\earlySpam\uwmyjunk.ini
c:\program files\CyberDefender\eula.rtf
c:\program files\CyberDefender\HomePage\CDWebVw.dll
c:\program files\CyberDefender\InstallModule\AdPresenter\CSIDL_PROGRAM_FILES\AdPresenter\cdNetAd.dll
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\cdaspm.dll
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\block_normal.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\block_over.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\earlySPAMBtn.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\grant_normal.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\grant_over.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\options_normal.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\options_over.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\spy_normal.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\images\spy_over.bmp
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\oeapiinitcom.dll
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\oecom.dll
c:\program files\CyberDefender\InstallModule\AntiSpam\CSIDL_PROGRAM_FILES\earlySpam\oestore.dll
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\cdinstx.exe
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\cdmyidd.dll
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\database.db
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Includes\Loading.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Includes\NoItems Index.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Includes\Password Cookie.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Includes\Passwords Index.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Includes\Privacy Index.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\charset.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\cookie.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\defaultCharset.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\form.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\frame.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\gray.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\green.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\host.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bg.jpg
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bg_button.jpg
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bg_top.jpg
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_go.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_go_down.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_go_over.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_grey.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_red - Copy.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_red.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_red_down.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\bt_red_over.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\caution.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\frame.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\logo.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\logo.jpg
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\logo_orange.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\topbar.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\topbar_orange.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\images\warning.gif
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\popup.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\port.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\protocol.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\red.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\referrer.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\scamalert.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\scamalert.htm1
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\scamalert.htm1.mine
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\scamalert.htm1.r2829
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\scamalert.htm1.r2835
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\script.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\security.html
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\style.css
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\Scam Alert\yellow.htm
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\st.ico
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\stbarpat.dat.03
c:\program files\CyberDefender\InstallModule\SecurityToolbar\CSIDL_LOCAL_APPDATA\CyberDefender\UserGuide\cybdefstbar.set

Bio-Hazard · Feb 3, 2009

Hello!

You did ver well. Combofix has update feature so i did the right thing by updating it.

Do you still have these popups?

Run CFScript

Close any open browsers.
Open Notepad by click start
Click Run
Type notepad into the box and click enter
Notepad will open
Copy and Paste everything from the Code box into Notepad:

Code:

File::
c:\windows\system32\drivers\gfyywwbb.sys
Folder::
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper
c:\documents and settings\Owner\Application Data\iWin
c:\documents and settings\All Users\Application Data\iWin
c:\documents and settings\Everette\Application Data\iWin
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\spoolsv.exe"=-

Save this as CFScript.txt, in the same location as ComboFix.exe (on your desktop)

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt

NOTE: Do not mouseclick combofix's window whilst it's running. That may cause it to stall it.

ATF-Cleaner

Please download ATF Cleaner by Atribune.

Save it to your desktop
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords please click No at the prompt.
Click Exit on the Main menu to close the program.

Kaspersky Online Scan

Please go to Kaspersky website and perform an online antivirus scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
Kaspersky Log
New HijackThis log

Dante711 · Feb 4, 2009

A little closer

Yes the two windows still appear at start up. I searched them and found them to be part of the owner's installed antivirus program: Summitsoft Systemtech Antispyware with AntiVirus. For now I'm disabling them and closing them. After this is over I'll uninstall and replace with something (hopefully) better.

ComboFix 09-02-02.04 - Owner 2009-02-03 16:31:31.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.218 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt
* Created a new restore point

FILE ::
c:\windows\system32\drivers\gfyywwbb.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\iWin
c:\documents and settings\Everette\Application Data\iWin
c:\documents and settings\Owner\Application Data\iWin
c:\documents and settings\Owner\Application Data\iWin\PageantPrincess\hiscore.dat
c:\documents and settings\Owner\Application Data\iWin\PageantPrincess\logfile.txt
c:\documents and settings\Owner\Application Data\iWin\PageantPrincess\prefs.dat
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\Config.xml
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\db\Aliases.dbs
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\db\Sites.dbs
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\dwld\Phishinglist.xip
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\dwld\WhiteList.xip
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\report\aggr_storage.xml
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\report\send_storage.xml
c:\documents and settings\Paige.NEWPORT\Application Data\Smart-Shopper\cs\res1\WhiteList.dbs
c:\windows\system32\drivers\gfyywwbb.sys

.
((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-01-30 18:41 . 2009-02-01 12:31 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-30 18:41 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-29 14:59 . 2009-01-29 14:59 <DIR> d-------- c:\program files\Trend Micro
2009-01-29 14:57 . 2009-01-29 14:58 <DIR> d-------- c:\program files\ERUNT
2009-01-28 19:22 . 2003-10-11 04:30 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\WINDOWS
2009-01-28 19:22 . 2008-09-14 17:52 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Yahoo!
2009-01-28 19:22 . 2003-10-14 05:31 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Symantec
2009-01-28 19:22 . 2003-10-11 04:06 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Sonic
2009-01-28 19:22 . 2003-10-11 05:03 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\SampleView
2009-01-28 19:22 . 2003-10-14 05:35 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\interMute
2009-01-28 19:22 . 2009-01-28 19:22 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT
2009-01-28 18:12 . 2009-01-28 20:13 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-28 18:12 . 2009-01-28 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a------ c:\windows\system32\hidserv.dll
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-01-26 13:09 . 2009-01-26 13:09 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-25 22:58 . 2009-01-25 22:58 <DIR> d-------- C:\temp
2009-01-25 22:57 . 2009-01-25 22:57 827,392 --a------ c:\windows\system32\FLASH.OCX
2009-01-24 16:02 . 2009-01-24 16:02 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Gamelab
2009-01-24 11:07 . 2009-01-24 11:08 <DIR> d-------- c:\documents and settings\Everette\Application Data\BeachPartyCraze
2009-01-21 22:23 . 2009-01-26 12:51 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-01-20 19:28 . 2009-01-20 19:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Winferno
2009-01-20 19:23 . 2009-01-20 19:23 <DIR> d-------- c:\program files\Winferno
2009-01-18 09:01 . 2009-01-18 09:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\NeptunesAdve
2009-01-16 17:16 . 2009-01-16 17:16 <DIR> d-------- c:\documents and settings\Owner\Application Data\Talkback
2009-01-16 17:02 . 2009-01-16 17:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\FreshGames
2009-01-16 15:45 . 2009-01-16 15:45 <DIR> d-------- c:\documents and settings\Owner\Application Data\Gamelab
2009-01-15 16:15 . 2009-01-15 16:15 <DIR> d-------- c:\documents and settings\Owner\Application Data\GameInvest
2009-01-11 14:18 . 2009-01-11 14:24 <DIR> d-------- c:\program files\Typing Test TQ
2009-01-10 20:00 . 2009-01-10 20:00 <DIR> d-------- c:\documents and settings\Owner\Application Data\My Games
2009-01-09 21:28 . 2009-01-09 21:28 <DIR> d-------- c:\documents and settings\Owner\Application Data\Amazon
2009-01-09 21:27 . 2009-01-09 21:27 <DIR> d-------- c:\program files\Amazon
2009-01-08 10:39 . 2009-01-08 10:39 <DIR> d-------- c:\documents and settings\Everette\Application Data\My Games
2009-01-07 13:44 . 2009-01-07 13:44 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\PlayFirst
2009-01-05 14:47 . 2009-01-05 14:47 <DIR> d-------- c:\program files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-29 07:19 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-26 20:51 --------- d-----w c:\program files\RecordNow!
2009-01-26 20:51 --------- d-----w c:\program files\Compaq Instant Support
2009-01-26 17:17 --------- d-----w c:\program files\Microsoft Works
2009-01-26 17:15 --------- d-----w c:\documents and settings\Owner\Application Data\Skype
2009-01-26 17:15 --------- d-----w c:\documents and settings\Everette\Application Data\Skype
2009-01-26 02:32 --------- d-----w c:\program files\GameHouse
2009-01-24 19:00 --------- d-----w c:\documents and settings\Everette\Application Data\GameHouse
2009-01-24 18:02 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\GameHouse
2009-01-24 02:43 --------- d-----w c:\documents and settings\Owner\Application Data\GameHouse
2009-01-20 00:19 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-01-19 23:16 --------- d-----w c:\program files\RealArcade
2009-01-16 17:54 --------- d-----w c:\documents and settings\Owner\Application Data\PlayFirst
2009-01-11 23:19 --------- d-----w c:\documents and settings\Owner\Application Data\Image Zone Express
2009-01-03 23:03 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\Common Files
2009-01-03 22:58 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\Gaijin Ent
2009-01-01 17:40 352,256 ----a-w c:\windows\eSellerateEngine.dll
2009-01-01 17:40 --------- d-----w c:\program files\Raptisoft
2009-01-01 17:30 --------- d-----w c:\documents and settings\Everette\Application Data\Gaijin Ent
2008-12-31 03:19 --------- d-----w c:\documents and settings\Owner\Application Data\Gaijin Ent
2008-12-31 03:09 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2008-12-31 02:12 --------- d-----w c:\documents and settings\Owner\Application Data\Gamehouse_Janes_Realty
2008-12-30 00:28 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2008-12-29 23:40 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-29 19:33 --------- d-----w c:\documents and settings\Owner\Application Data\skypePM
2008-12-29 05:50 --------- d-----w c:\documents and settings\Owner\Application Data\PetShowCraze
2008-12-26 04:29 --------- d-----w c:\documents and settings\Owner\Application Data\ViquaSoft
2008-12-26 02:01 --------- d-----w c:\documents and settings\Owner\Application Data\Pogo Games
2008-12-25 05:38 --------- d-----w c:\documents and settings\All Users\Application Data\MythPeople
2008-12-24 04:58 --------- d-----w c:\documents and settings\Owner\Application Data\Stamps.com Internet Postage
2008-12-24 04:30 --------- d-----w c:\program files\Easy Internet signup
2008-12-23 05:13 --------- d-----w c:\documents and settings\Everette\Application Data\RealArcade
2008-12-20 04:57 --------- d-----w c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2008-12-19 03:41 --------- d-----w c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2008-12-18 18:21 --------- d-----w c:\documents and settings\Owner\Application Data\U3
2008-12-17 22:54 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2008-12-16 23:49 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\My Games
2008-12-16 04:33 --------- d-----w c:\documents and settings\Owner\Application Data\Eyeblaster
2008-12-16 00:03 --------- d-----w c:\documents and settings\All Users\Application Data\Gogii
2008-12-14 23:34 --------- d-----w c:\documents and settings\Everette\Application Data\Talkback
2008-12-14 17:01 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\HP
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-05 23:14 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-10-27 02:45 60,744 ----a-w c:\documents and settings\Owner\g2mdlhlpx.exe
2008-10-27 02:36 60,744 ----a-w c:\documents and settings\Everette\g2mdlhlpx.exe
2006-10-11 08:04 61,036 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 48,742 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 29,313 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 41,082 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 166,510 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-30_20.48.22.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\ERDNT.EXE
+ 2009-02-01 17:46:44 7,413,760 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\Users\00000001\NTUSER.DAT
+ 2009-02-01 17:46:44 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\ERDNT.EXE
+ 2009-02-03 05:59:34 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\Users\00000001\NTUSER.DAT
+ 2009-02-03 05:59:38 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-3-2009\ERDNT.EXE
+ 2009-02-04 00:25:06 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2-3-2009\Users\00000001\NTUSER.DAT
+ 2009-02-04 00:25:06 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-3-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\ERDNT.EXE
+ 2009-02-03 06:25:46 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\Users\00000001\NTUSER.DAT
+ 2009-02-03 06:25:46 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\Users\00000002\UsrClass.dat
+ 2005-10-21 04:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-01-31 04:36:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-03 05:59:10 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-31 04:36:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-03 05:59:10 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-28 23:40:20 125,440 -c--a-w c:\windows\system32\dllcache\userinit.exe
+ 2004-08-04 07:56:57 24,576 -c--a-w c:\windows\system32\dllcache\userinit.exe
- 2009-01-28 23:40:20 125,440 ----a-w c:\windows\system32\userinit.exe
+ 2004-08-04 07:56:57 24,576 ----a-w c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-22 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Spyware Cleaner Monitor"="c:\program files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" [2008-04-23 2192104]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]
"Doctor Virus Cleaner Monitor"="c:\program files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" [2008-04-23 2060008]
"summitsoft Kids Control"="c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe" [2008-04-23 140008]
"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-10-11 151597]
"summitsoft Kids Control"="c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe" [2008-04-23 140008]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-15 282624]
"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-08-19 4841472]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"MSHNetSetup"="c:\windows\msbn\_setup.exe" [2003-02-19 131072]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 557056]

c:\documents and settings\Christi\Start Menu\Programs\Startup\
HotSync Manager.LNK - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2008-06-24 217088]
HOTSYNCSHORTCUTNAME.lnk - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Broadband Networking.lnk - c:\windows\Installer\{06B2B442-19FE-4398-BD4B-F5C00928DD8E}\_18be6784.exe [2004-05-02 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d77aade2-cd2f-11dd-b3d1-000ea666c68b}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\User_Feed_Synchronization-{CBE06E3D-72CE-491C-A757-EC0D8BDAE056}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theanimalrescuesite.com/clickToGive/home.faces;jsessionid=A1E8B675914867DAE0611B889B5948D8.ctgProd04?siteId=4&link=ctg_trs_home_from_ars_home_sitenav
uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/
mSearch Bar = hxxp://srch-qus10.hpwis.com/
uInternet Connection Wizard,ShellNext = hxxp://qus10.hpwis.com/
uInternet Settings,ProxyOverride = localhost
IE: &Search - ?p=ZUman000
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
LSP: SpSubLSP.dll
Trusted Zone: salesnexus.com
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\xe0gw9ji.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 16:34:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\SpSubLSP.dll
.
Completion time: 2009-02-03 16:36:53
ComboFix-quarantined-files.txt 2009-02-04 00:36:40
ComboFix2.txt 2009-02-03 06:30:43
ComboFix3.txt 2009-01-31 04:49:46

Pre-Run: 127,910,617,088 bytes free
Post-Run: 127,892,135,936 bytes free

267 --- E O F --- 2009-01-22 06:23:39

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, February 3, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, February 04, 2009 00:27:02
Records in database: 1741832
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 115709
Threat name: 10
Infected objects: 12
Suspicious objects: 0
Duration of the scan: 01:59:35

File name / Threat name / Threats count
C:\Documents and Settings\Owner\Application Data\SummitSoft\AntiSpyware\JunkFile\Data\26 Jan 09-11.14.ZIP Infected: Trojan.Win32.Midgare.ssj 1
C:\Documents and Settings\Owner\Application Data\SummitSoft\AntiSpyware\JunkFile\Data\26 Jan 09-11.14.ZIP Infected: Trojan-Downloader.JS.Psyme.amg 1
C:\Documents and Settings\Owner\Application Data\SummitSoft\AntiSpyware\JunkFile\Data\26 Jan 09-11.14.ZIP Infected: Trojan.Win32.Agent.bknt 1
C:\Documents and Settings\Owner\Application Data\SummitSoft\AntiSpyware\JunkFile\Data\26 Jan 09-11.14.ZIP Infected: not-a-virus:FraudTool.Win32.VirusRemover.bd 1
C:\Documents and Settings\Owner\My Documents\Christi\Local Settings\Temporary Internet Files\Content.IE5\6S609WLD\freescan[1].htm Infected: not-a-virus:FraudTool.Win32.Antivirus2009.g 1
C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\Quarantine\39726.7461192477\MyWebSearch\bar\4.bin\MWSBAR.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ea 1
C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\Quarantine\39726.7461192477\MyWebSearch\SrchAstt\4.bin\MWSSRCAS.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ca 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\seneka.sys.vir Infected: Rootkit.Win32.Pakes.it 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\senekadmnkoexk.sys.vir Infected: Rootkit.Win32.Pakes.it 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\senekarhjfselb.dll.vir Infected: Backdoor.Win32.Bifrose.fnj 1
C:\WINDOWS\curgsi.exe Infected: not-a-virus:AdWare.Win32.HelpExpress 2

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:18:31 PM, on 2/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theanimalrescuesite.com/...eId=4&link=ctg_trs_home_from_ars_home_sitenav
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\My.Freeze.com Toolbar\freeze_us.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\SpywareCleaner\RealTimeMonitorSC.exe" /start /minimize
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Doctor Virus Cleaner Monitor] "C:\Program Files\Summitsoft\SystemTech AntiSpyware\VirusCleaner\RealTimeMonitorVC.exe" /start /minimize
O4 - HKCU\..\Run: [summitsoft Kids Control] C:\Program Files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'Default user')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZUman000
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.salesnexus.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218328767890
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218462079718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 13046 bytes

Dante711 · Feb 4, 2009

Java

Before I forget a change I made was to download and install the latest version of java (6.11) in order to run Kaspersky. I got it directly Sun Microsystems.

Bio-Hazard · Feb 4, 2009

Hello!

We are making good process.

Yes the two windows still appear at start up. I searched them and found them to be part of the owner's installed antivirus program: Summitsoft Systemtech Antispyware with AntiVirus. For now I'm disabling them and closing them. After this is over I'll uninstall and replace with something (hopefully) better.

Good research. As long as user is happy to get rid of it. We can change it now. Also once we are done i will also give few links to other programs. Malwarebytes Antimalware is a good program to have. We already used that, so i would keep that.

Remove programs

Click Start
Go to Control Panel
Go to Add/Remove Programs
Find and click Remove for the following (if present):

Summitsoft SystemTech AntiSpyware

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

Run CFScript

Close any open browsers.
Open Notepad by click start
Click Run
Type notepad into the box and click enter
Notepad will open
Copy and Paste everything from the Code box into Notepad:

Code:

File::
C:\WINDOWS\curgsi.exe 
Folder::
C:\Program Files\My.Freeze.com Toolbar
c:\program files\Summitsoft
C:\Documents and Settings\Owner\Application Data\SummitSoft
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Doctor Virus Cleaner Monitor"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spyware Cleaner Monitor"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
[-HKEY_CLASSES_ROOT\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]

Save this as CFScript.txt, in the same location as ComboFix.exe (on your desktop)

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt

NOTE: Do not mouseclick combofix's window whilst it's running. That may cause it to stall it.

Antivirus

Anti-virus software are programs that detect cleans and erase harmful virus files on a computer
Web server or network. Unchecked virus files can unintentionally be forwarded to others including trading partners and thereby spreading infection. Because new viruses regularly emerge anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present and will clean delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

Avira AntiVir Personal - Free anti-virus software for Windows. Detects and removes more than 50000 viruses. Free support.
avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer then only one of them should be active in memory at a time.

Firewall

Looking over your log it seems you don't have any evidence of a third party FIREWALL. As the term conveys a firewall is an extra layer of security installed onto computers which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders.

If you are using the built-in Windows XP firewall it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to phone home for more instructions. Simply put Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

I would recommend to install install a free firewall for personal use from one of these excellent vendors. Choice is yours:

Online-Armor Free
Agnitum
Sunbelt/Kerio (Free version after 30 days)
Comodo (Uncheck during installation Install Comodo SafeSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!)

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
New HijackThis log
A description of how your computer is behaving

Dante711 · Feb 5, 2009

Reporting

The computer seems to be behaving normally. None of the original symptoms are there anymore. Summitsoft didn't have an uninstall file so I deleted anything with the company name. Installed AVG and Comodo and Spybot S&D is still there. I will instruct the user on updating and regular scanning. Do you have a suggestion for good internet/virus/malware safety instructional sites? I think they could use more information.

ComboFix 09-02-04.01 - Owner 2009-02-04 23:56:47.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.219 [GMT -8:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt
* Created a new restore point

FILE ::
c:\windows\curgsi.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\SummitSoft
c:\documents and settings\Owner\Application Data\SummitSoft\AntiSpyware\DesktopStyler\Empty.ico
c:\documents and settings\Owner\Application Data\SummitSoft\AntiSpyware\DFF\Types.ini
c:\documents and settings\Owner\Application Data\SummitSoft\AntiSpyware\JunkFile\Data\26 Jan 09-11.14.ZIP
c:\documents and settings\Owner\Application Data\SummitSoft\AntiSpyware\JunkFile\JunkData.txt
c:\documents and settings\Owner\Application Data\SummitSoft\AntiSpyware\Privacy\PrivacyDetail.txt
c:\documents and settings\Owner\Application Data\SummitSoft\AntiSpyware\RegistryCleaner\RegBackup\Monday-January-26-2009_09.12.reg
c:\windows\curgsi.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-03 16:48 . 2009-02-03 16:48 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 16:48 . 2009-02-03 16:48 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-30 18:41 . 2009-02-01 12:31 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-30 18:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-30 18:41 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-30 18:41 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-29 14:59 . 2009-01-29 14:59 <DIR> d-------- c:\program files\Trend Micro
2009-01-29 14:57 . 2009-01-29 14:58 <DIR> d-------- c:\program files\ERUNT
2009-01-28 19:22 . 2003-10-11 04:30 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\WINDOWS
2009-01-28 19:22 . 2008-09-14 17:52 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Yahoo!
2009-01-28 19:22 . 2003-10-14 05:31 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Symantec
2009-01-28 19:22 . 2003-10-11 04:06 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\Sonic
2009-01-28 19:22 . 2003-10-11 05:03 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\SampleView
2009-01-28 19:22 . 2003-10-14 05:35 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT\Application Data\interMute
2009-01-28 19:22 . 2009-01-28 19:22 <DIR> d-------- c:\documents and settings\Administrator.NEWPORT
2009-01-28 18:12 . 2009-01-28 20:13 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-28 18:12 . 2009-01-28 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a------ c:\windows\system32\hidserv.dll
2009-01-28 18:01 . 2008-04-13 17:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys
2009-01-28 18:00 . 2008-04-13 11:39 14,592 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2009-01-26 13:09 . 2009-01-26 13:09 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-25 22:58 . 2009-01-25 22:58 <DIR> d-------- C:\temp
2009-01-25 22:57 . 2009-01-25 22:57 827,392 --a------ c:\windows\system32\FLASH.OCX
2009-01-24 16:02 . 2009-01-24 16:02 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\Gamelab
2009-01-24 11:07 . 2009-01-24 11:08 <DIR> d-------- c:\documents and settings\Everette\Application Data\BeachPartyCraze
2009-01-21 22:23 . 2009-01-26 12:51 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-01-20 19:28 . 2009-01-20 19:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Winferno
2009-01-18 09:01 . 2009-01-18 09:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\NeptunesAdve
2009-01-16 17:16 . 2009-01-16 17:16 <DIR> d-------- c:\documents and settings\Owner\Application Data\Talkback
2009-01-16 17:02 . 2009-01-16 17:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\FreshGames
2009-01-16 15:45 . 2009-01-16 15:45 <DIR> d-------- c:\documents and settings\Owner\Application Data\Gamelab
2009-01-15 16:15 . 2009-01-15 16:15 <DIR> d-------- c:\documents and settings\Owner\Application Data\GameInvest
2009-01-11 14:18 . 2009-01-11 14:24 <DIR> d-------- c:\program files\Typing Test TQ
2009-01-10 20:00 . 2009-01-10 20:00 <DIR> d-------- c:\documents and settings\Owner\Application Data\My Games
2009-01-09 21:28 . 2009-01-09 21:28 <DIR> d-------- c:\documents and settings\Owner\Application Data\Amazon
2009-01-09 21:27 . 2009-01-09 21:27 <DIR> d-------- c:\program files\Amazon
2009-01-08 10:39 . 2009-01-08 10:39 <DIR> d-------- c:\documents and settings\Everette\Application Data\My Games
2009-01-07 13:44 . 2009-01-07 13:44 <DIR> d-------- c:\documents and settings\Paige.NEWPORT\Application Data\PlayFirst
2009-01-05 14:47 . 2009-01-05 14:47 <DIR> d-------- c:\program files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-04 00:48 --------- d-----w c:\program files\Java
2009-01-29 07:19 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-26 20:51 --------- d-----w c:\program files\RecordNow!
2009-01-26 20:51 --------- d-----w c:\program files\Compaq Instant Support
2009-01-26 17:17 --------- d-----w c:\program files\Microsoft Works
2009-01-26 17:15 --------- d-----w c:\documents and settings\Owner\Application Data\Skype
2009-01-26 17:15 --------- d-----w c:\documents and settings\Everette\Application Data\Skype
2009-01-26 02:32 --------- d-----w c:\program files\GameHouse
2009-01-24 19:00 --------- d-----w c:\documents and settings\Everette\Application Data\GameHouse
2009-01-24 18:02 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\GameHouse
2009-01-24 02:43 --------- d-----w c:\documents and settings\Owner\Application Data\GameHouse
2009-01-20 00:19 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-01-19 23:16 --------- d-----w c:\program files\RealArcade
2009-01-16 17:54 --------- d-----w c:\documents and settings\Owner\Application Data\PlayFirst
2009-01-11 23:19 --------- d-----w c:\documents and settings\Owner\Application Data\Image Zone Express
2009-01-03 23:03 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\Common Files
2009-01-03 22:58 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\Gaijin Ent
2009-01-01 17:40 352,256 ----a-w c:\windows\eSellerateEngine.dll
2009-01-01 17:40 --------- d-----w c:\program files\Raptisoft
2009-01-01 17:30 --------- d-----w c:\documents and settings\Everette\Application Data\Gaijin Ent
2008-12-31 03:19 --------- d-----w c:\documents and settings\Owner\Application Data\Gaijin Ent
2008-12-31 03:09 --------- d-----w c:\documents and settings\All Users\Application Data\GameHouse
2008-12-31 02:12 --------- d-----w c:\documents and settings\Owner\Application Data\Gamehouse_Janes_Realty
2008-12-30 00:28 --------- d-----w c:\documents and settings\All Users\Application Data\Fugazo
2008-12-29 23:40 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-12-29 19:33 --------- d-----w c:\documents and settings\Owner\Application Data\skypePM
2008-12-29 05:50 --------- d-----w c:\documents and settings\Owner\Application Data\PetShowCraze
2008-12-26 04:29 --------- d-----w c:\documents and settings\Owner\Application Data\ViquaSoft
2008-12-26 02:01 --------- d-----w c:\documents and settings\Owner\Application Data\Pogo Games
2008-12-25 05:38 --------- d-----w c:\documents and settings\All Users\Application Data\MythPeople
2008-12-24 04:58 --------- d-----w c:\documents and settings\Owner\Application Data\Stamps.com Internet Postage
2008-12-24 04:30 --------- d-----w c:\program files\Easy Internet signup
2008-12-23 05:13 --------- d-----w c:\documents and settings\Everette\Application Data\RealArcade
2008-12-20 04:57 --------- d-----w c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2008-12-19 03:41 --------- d-----w c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2008-12-18 18:21 --------- d-----w c:\documents and settings\Owner\Application Data\U3
2008-12-17 22:54 --------- d-----w c:\documents and settings\All Users\Application Data\Sandlot Games
2008-12-16 23:49 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\My Games
2008-12-16 04:33 --------- d-----w c:\documents and settings\Owner\Application Data\Eyeblaster
2008-12-16 00:03 --------- d-----w c:\documents and settings\All Users\Application Data\Gogii
2008-12-14 23:34 --------- d-----w c:\documents and settings\Everette\Application Data\Talkback
2008-12-14 17:01 --------- d-----w c:\documents and settings\Paige.NEWPORT\Application Data\HP
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-05 23:14 --------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-10-27 02:45 60,744 ----a-w c:\documents and settings\Owner\g2mdlhlpx.exe
2008-10-27 02:36 60,744 ----a-w c:\documents and settings\Everette\g2mdlhlpx.exe
2009-02-05 07:40 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-02-05 07:40 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-02-05 07:40 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-02-05 07:40 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-02-05 07:40 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-30_20.48.22.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\ERDNT.EXE
+ 2009-02-01 17:46:44 7,413,760 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\Users\00000001\NTUSER.DAT
+ 2009-02-01 17:46:44 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-1-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\ERDNT.EXE
+ 2009-02-03 05:59:34 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\Users\00000001\NTUSER.DAT
+ 2009-02-03 05:59:38 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-2-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-3-2009\ERDNT.EXE
+ 2009-02-04 00:25:06 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2-3-2009\Users\00000001\NTUSER.DAT
+ 2009-02-04 00:25:06 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2-3-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2-4-2009\ERDNT.EXE
+ 2009-02-05 07:37:01 7,430,144 ----a-w c:\windows\ERDNT\AutoBackup\2-4-2009\Users\00000001\NTUSER.DAT
+ 2009-02-05 07:37:02 503,808 ----a-w c:\windows\ERDNT\AutoBackup\2-4-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 20:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\ERDNT.EXE
+ 2009-02-03 06:25:46 7,421,952 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\Users\00000001\NTUSER.DAT
+ 2009-02-03 06:25:46 368,640 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-02\Users\00000002\UsrClass.dat
+ 2005-10-21 04:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-01-31 04:36:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-03 05:59:10 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-31 04:36:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-03 05:59:10 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-28 23:40:20 125,440 -c--a-w c:\windows\system32\dllcache\userinit.exe
+ 2004-08-04 07:56:57 24,576 -c--a-w c:\windows\system32\dllcache\userinit.exe
+ 2009-02-04 00:48:05 144,792 ----a-w c:\windows\system32\java.exe
+ 2009-02-04 00:48:05 144,792 ----a-w c:\windows\system32\javaw.exe
+ 2009-02-04 00:48:05 148,888 ----a-w c:\windows\system32\javaws.exe
- 2009-01-28 23:40:20 125,440 ----a-w c:\windows\system32\userinit.exe
+ 2004-08-04 07:56:57 24,576 ----a-w c:\windows\system32\userinit.exe
+ 2009-02-05 07:35:20 16,384 ----atw c:\windows\temp\Perflib_Perfdata_644.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-22 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]
"NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-10-11 151597]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-15 282624]
"PS2"="c:\windows\system32\ps2.exe" [2002-07-31 81920]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-08-19 4841472]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-09-03 160592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"MSHNetSetup"="c:\windows\msbn\_setup.exe" [2003-02-19 131072]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 557056]

c:\documents and settings\Christi\Start Menu\Programs\Startup\
HotSync Manager.LNK - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2008-06-24 217088]
HOTSYNCSHORTCUTNAME.lnk - c:\program files\Palm\Hotsync.exe [2004-06-09 471040]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
Microsoft Broadband Networking.lnk - c:\windows\Installer\{06B2B442-19FE-4398-BD4B-F5C00928DD8E}\_18be6784.exe [2004-05-02 25214]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d77aade2-cd2f-11dd-b3d1-000ea666c68b}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-02-05 c:\windows\Tasks\User_Feed_Synchronization-{CBE06E3D-72CE-491C-A757-EC0D8BDAE056}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:36]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-summitsoft Kids Control - c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe
HKLM-Run-summitsoft Kids Control - c:\program files\Summitsoft\SystemTech AntiSpyware\KidsCtrl\BackProcessAPC.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theanimalrescuesite.com/clickToGive/home.faces;jsessionid=A1E8B675914867DAE0611B889B5948D8.ctgProd04?siteId=4&link=ctg_trs_home_from_ars_home_sitenav
uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/
mSearch Bar = hxxp://srch-qus10.hpwis.com/
uInternet Connection Wizard,ShellNext = hxxp://qus10.hpwis.com/
uInternet Settings,ProxyOverride = localhost
IE: &Search - ?p=ZUman000
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
LSP: SpSubLSP.dll
Trusted Zone: salesnexus.com
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\xe0gw9ji.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-04 23:59:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\SpSubLSP.dll
.
Completion time: 2009-02-05 0:01:58
ComboFix-quarantined-files.txt 2009-02-05 08:01:44
ComboFix2.txt 2009-02-04 00:36:54
ComboFix3.txt 2009-02-03 06:30:43
ComboFix4.txt 2009-01-31 04:49:46

Pre-Run: 127,602,655,232 bytes free
Post-Run: 127,641,792,512 bytes free

269 --- E O F --- 2009-01-22 06:23:39

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:41:44 AM, on 2/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theanimalrescuesite.com/...eId=4&link=ctg_trs_home_from_ars_home_sitenav
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [MSHNetSetup] C:\WINDOWS\msbn\_setup.exe STATE_COPY_FILES (User 'Default user')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZUman000
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.salesnexus.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1218328767890
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218462079718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 13508 bytes

Bio-Hazard · Feb 5, 2009

Update Adobe Reader

Please uninstall older version of Adobe Reader before installing the latest version

Click Start
Control Panel
Double clicking on Add/Remove Programs
Locate older version of Adobe Reader and click on Change/Remove to uninstall it
Click HERE to download the latest version of Adobe Acrobat Reader.
Select your Windows version and click on Download. If you are using Internet Explorer, you will receive prompts. Allow the installation to be ran and it will be installed automatically for you. If you are using other browsers, it will prompt you to save a file. Save this file to your desktop and run it to install the latest version of Adobe Reader.
Close your Internet browser and open it again.

Your log now appears to be clean. Congratulations!

You can get rid of the tools we used:

ATF Cleaner(You can just delete the exe file from your desktop)
ERUNT(You can uninstall it from Add/Remove Programs)

Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints Malware Complaints. You need to be registered to post as, unfortunately, we were hit with too many spam posts to allow guest posting to continue. Just find your country room and register your complaint.

Delete ComboFix and Clean Up
Click Start > Run > type combofix /u > OK (Note the space between combofix and /u)

Please advise if this step is missed for any reason as it performs some important actions.

General Security and Computer Health
Below are some steps to follow in order to dramatically lower the chances of reinfection. You may have already implemented some of the steps below, however you should follow any steps that you have not already implemented.

Make sure that you keep your antivirus updated
New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
NOTE: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.
NOTE: The update process uses ActiveX, so you will need to use internet explorer for it and allow the ActiveX control to install.
Update Non-Microsoft Programs
Microsoft isn't the only company whose products can contain security vulnerabilities. To check whether other programs running on your PC are in need of an update, you can use the Secunia Software Inspector or F-secure Health Check. I suggest that you run one of them at least once a month.
Make Internet Explorer More Secure
You are using Internet Explorer v. 7. Therefore please read and follow the recommendations at this SITE

Recommended Programs

I would recommend the download and installation of some or all of the following programs (if not already present), and the updating of them on a regular basis.

WinPatrol
As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge. For more information, please visit HERE.
SpywareBlaster
SpywareBlaster sets killbits in the registry to prevent known malicious ActiveX controls from installing on your computer. If you don't know what ActiveX controls are, see HERE. You can download SpywareBlaster from HERE.
Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware is an anti-malware application that can thoroughly remove even the most advanced malware. It includes a number of features, including a built in protection monitor that blocks malicious processes before they even start.You can download Malwarebytes' Anti-Malware from HERE. Here are two tutorials: Malwarebytes' Anti-Malware Setup Guide and Malwarebytes' Anti-Malware Scanning Guide.
Hosts File
For added protection you may also like to add a host file. A simple explanation of what a Hosts file does is HERE and for more information regarding host files read HERE.
Use an alternative Internet Browser
Many of the exploits are directed to users of Internet Explorer. Try using a different browser instead: Firefox or Opera

Here is a great article by miekiemoes How to prevent Malware.

Finally I am trying to make one point very clear. It is ABSOLUTELY ESSENTIAL to keep all of your security programs up to date.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Happy surfing and stay clean!

Bio-Hazard

Dante711 · Feb 6, 2009

Final Words

The last actions were completed and everything went fine. I made sure AVG and Comodo and windows are set to autoupdate. I turned firefox into the default browser. When they come to get the PC I'll show them how the new protections work as well as the book marked articles on safer browsing. Just two quick questions:

What was the removal university like?
Could any of these malware programs jump to a memory stick?

Thank you very much for your time and help. It is very much appreciated.

Bio-Hazard · Feb 6, 2009

Dante711 said:
What was the removal university like?

Well it was fun but it is also hard. I love what i am doing but it is not for everyone. If you are interested then you have to first register with the site, you can do that HERE and after that you can read little about it HERE

Dante711 said:
Could any of these malware programs jump to a memory stick?

I havent seen any signs of flash drive infection. if you want to clean your memory sticks you can use this tool to do it.

Flash Disinfector

Please download Flash_Disinfector and save it to your desktop.
Double click to run it.
You will be prompted to plug in your flash drive. Plug it in.
Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime.
When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager.
Click on File > New Task (Run...). Type in explorer.exe and press Enter. Your desktop should now appear.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Dante711 · Feb 7, 2009

All done

Thanks again and continued success as you help us poor infected users!

Virtumonde.prx

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Bio-Hazard

Emeritus- Malware Team

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Dante711

New member

Dante711

New member

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Dante711

New member

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Dante711

New member

Bio-Hazard

Emeritus- Malware Team

Dante711

New member