Browser Problem(Hijack and Makware included)

Alex S · February 27, 2009

Couple days ago, my Trend Micro Security expired on all of my computers, but one of them is having problems with browsers. It takes couple minutes to load pages and often get a "[site] took too long to respond" error message. The internet is fine as other applications that require internet work as they did before. Any suggestions?

Malwarebyte log:

Malwarebytes' Anti-Malware 1.34

Database version: 1800

Windows 5.1.2600 Service Pack 2

2/26/2009 10:30:32 PM

mbam-log-2009-02-26 (22-30-32).txt

Scan type: Quick Scan

Objects scanned: 76337

Time elapsed: 4 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:10:25 PM, on 2/26/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\VMware\VMware Player\vmware-authd.exe

C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\system32\vmnat.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\eMule\emule.exe

C:\WINDOWS\system32\dwwin.exe

C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\system32\dwwin.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://*.trymedia.com (HKLM)

O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Monopoly Here and Now\Images\stg_drm.ocx

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Monopoly Here and Now\Images\armhelper.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{238D74CA-EEF5-4D41-917B-1FDC7E677240}: NameServer = 192.168.0.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{238D74CA-EEF5-4D41-917B-1FDC7E677240}: NameServer = 192.168.0.1

O17 - HKLM\System\CS3\Services\Tcpip\..\{238D74CA-EEF5-4D41-917B-1FDC7E677240}: NameServer = 192.168.0.1

O20 - AppInit_DLLs: cakfym.dll

O20 - Winlogon Notify: cbXQjhed - C:\WINDOWS\

O20 - Winlogon Notify: fcccDust - C:\WINDOWS\

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Intel

Edited February 27, 2009 by AdvancedSetup
Removed CODE Tags.

AdvancedSetup · February 27, 2009

STEP 01

With all other applications closed (Taskbar empty), open HijackThis again

and run Do a system scan only and place a check mark on the following items.

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\csrssc.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{238D74CA-EEF5-4D41-917B-1FDC7E677240}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{238D74CA-EEF5-4D41-917B-1FDC7E677240}: NameServer = 192.168.0.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{238D74CA-EEF5-4D41-917B-1FDC7E677240}: NameServer = 192.168.0.1
O20 - AppInit_DLLs: cakfym.dll
O20 - Winlogon Notify: cbXQjhed - C:\WINDOWS\
O20 - Winlogon Notify: fcccDust - C:\WINDOWS\
Then Quit All Browsers including the one you're reading this in now.
Then click on Fix checked and then quit HJT

STEP 02

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

STEP 03

Download

DDS

and save it to your desktop

http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click

dds.scr

to run the tool.

When done, the

DDS.txt

will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

DDS.txt
Attach.txt

Save both reports to your desktop
Please include the following logs in your next reply:
DDS.txt
and
Attach.txt

STEP 04

Please create a BOOTLOG

Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
Select "Enable Boot Logging" option and press enter.
Windows prompts you to select a Windows Installation (even if there is only one windows installation)
This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
If you're already running inside Windows you can enable it the following way.
Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
Click on OK and you will be prompted to RESTART Windows. Please do restart now.
After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.

Alex S · February 28, 2009

The problem got worse overnight before I did anything. Now no matter what site I open, I always get an error "Firefox can't access server at [site]"

I followed the instructions given above:

combofix log:

ComboFix 09-02-26.02 - HP_Administrator 2009-02-27 15:36:51.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.7.1033.18.2046.1569 [GMT -5:00]

Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

AV: Trend Micro Internet Security *On-access scanning enabled* (Outdated)

FW: Trend Micro Personal Firewall *enabled*

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

c:\windows\dat.txt

c:\windows\IE4 Error Log.txt

c:\windows\search_res.txt

c:\windows\system32\drivers\26293434.sys

c:\windows\system32\mdm.exe

c:\windows\system32\sbjgfvia.ini

c:\windows\wiaserviv.log

D:\Autorun.inf

L:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_26293434

((((((((((((((((((((((((( Files Created from 2009-01-27 to 2009-02-27 )))))))))))))))))))))))))))))))

.

2009-02-24 20:31 . 2009-02-24 20:31 <DIR> d-------- c:\program files\Avira

2009-02-24 20:31 . 2009-02-24 20:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-24 20:24 . 2009-02-24 20:24 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-24 20:24 . 2009-02-24 20:24 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes

2009-02-24 20:24 . 2009-02-24 20:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-24 20:24 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-24 20:24 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-22 23:21 . 2009-02-23 16:07 <DIR> d--hs---- C:\found.006

2009-02-22 22:52 . 2009-02-23 16:07 <DIR> d--hs---- C:\found.005

2009-02-22 12:46 . 2009-02-22 12:46 6,682 --a------ c:\windows\system32\ymdvqxsa.dll

2009-02-22 12:43 . 2009-02-22 12:43 6,680 --a------ c:\windows\system32\lxvgrudc.dll

2009-02-22 00:46 . 2009-02-22 00:46 6,680 --a------ c:\windows\system32\sxnwqpbe.dll

2009-02-22 00:43 . 2009-02-22 00:43 6,682 --a------ c:\windows\system32\veciluev.dll

2009-02-21 12:48 . 2009-02-21 12:48 6,680 --a------ c:\windows\system32\qccsdeab.dll

2009-02-21 12:45 . 2009-02-21 12:45 6,682 --a------ c:\windows\system32\iwybliqt.dll

2009-02-21 00:48 . 2009-02-21 00:48 6,682 --a------ c:\windows\system32\gytyuvde.dll

2009-02-21 00:45 . 2009-02-21 00:45 6,680 --a------ c:\windows\system32\mslucypl.dll

2009-02-20 12:48 . 2009-02-20 12:48 6,682 --a------ c:\windows\system32\avsiclfg.dll

2009-02-20 12:45 . 2009-02-20 12:45 6,680 --a------ c:\windows\system32\kijhghsa.dll

2009-02-20 00:48 . 2009-02-20 00:48 6,680 --a------ c:\windows\system32\lysfxtud.dll

2009-02-20 00:45 . 2009-02-20 00:45 6,682 --a------ c:\windows\system32\mjelgcdi.dll

2009-02-19 12:48 . 2009-02-19 12:48 6,682 --a------ c:\windows\system32\aolxwbqm.dll

2009-02-19 12:45 . 2009-02-19 12:45 6,680 --a------ c:\windows\system32\kcvrfwek.dll

2009-02-19 00:48 . 2009-02-19 00:48 6,680 --a------ c:\windows\system32\pwuirakj.dll

2009-02-19 00:45 . 2009-02-19 00:45 6,682 --a------ c:\windows\system32\qewmudrs.dll

2009-02-18 12:48 . 2009-02-18 12:48 6,682 --a------ c:\windows\system32\rmrxmkqb.dll

2009-02-18 12:45 . 2009-02-18 12:45 6,680 --a------ c:\windows\system32\iehuhrff.dll

2009-02-18 00:45 . 2009-02-18 00:45 6,682 --a------ c:\windows\system32\xowtmgwx.dll

2009-02-18 00:42 . 2009-02-18 00:42 6,680 --a------ c:\windows\system32\ufyafhii.dll

2009-02-17 12:45 . 2009-02-17 12:45 6,682 --a------ c:\windows\system32\obsllppo.dll

2009-02-17 12:42 . 2009-02-17 12:42 6,680 --a------ c:\windows\system32\pvdcigjp.dll

2009-02-17 00:45 . 2009-02-17 00:45 6,682 --a------ c:\windows\system32\fejpdhrt.dll

2009-02-17 00:42 . 2009-02-17 00:42 6,680 --a------ c:\windows\system32\obrgjase.dll

2009-02-16 12:42 . 2009-02-16 12:42 6,682 --a------ c:\windows\system32\mcxnrlss.dll

2009-02-16 12:42 . 2009-02-16 12:42 6,680 --a------ c:\windows\system32\cdtewbtr.dll

2009-02-16 00:43 . 2009-02-16 00:43 6,682 --a------ c:\windows\system32\aflagumn.dll

2009-02-16 00:43 . 2009-02-16 00:43 6,680 --a------ c:\windows\system32\pqfcnxtq.dll

2009-02-15 12:44 . 2009-02-15 12:44 6,680 --a------ c:\windows\system32\qiyhllvu.dll

2009-02-15 12:41 . 2009-02-15 12:41 6,682 --a------ c:\windows\system32\kgomttwy.dll

2009-02-15 00:44 . 2009-02-15 00:44 6,680 --a------ c:\windows\system32\esgyunhh.dll

2009-02-15 00:41 . 2009-02-15 00:41 6,682 --a------ c:\windows\system32\mdmepmlm.dll

2009-02-14 12:45 . 2009-02-14 12:45 6,682 --a------ c:\windows\system32\qtctukes.dll

2009-02-14 12:42 . 2009-02-14 12:42 6,680 --a------ c:\windows\system32\odbxirco.dll

2009-02-14 00:44 . 2009-02-14 00:44 6,682 --a------ c:\windows\system32\pvrvrwpr.dll

2009-02-14 00:41 . 2009-02-14 00:41 6,680 --a------ c:\windows\system32\keelsmbh.dll

2009-02-13 14:25 . 2009-02-13 14:25 6,680 --a------ c:\windows\system32\longtmhl.dll

2009-02-13 12:39 . 2009-02-13 12:39 6,682 --a------ c:\windows\system32\sagekmap.dll

2009-02-12 12:41 . 2009-02-12 12:41 6,680 --a------ c:\windows\system32\ftrdnnya.dll

2009-02-12 12:38 . 2009-02-12 12:38 6,682 --a------ c:\windows\system32\lfpuohqj.dll

2009-02-11 12:39 . 2009-02-11 12:39 6,682 --a------ c:\windows\system32\xexpofby.dll

2009-02-11 12:36 . 2009-02-11 12:36 6,680 --a------ c:\windows\system32\upldhtwh.dll

2009-02-10 12:36 . 2009-02-10 12:36 6,682 --a------ c:\windows\system32\jshyjwui.dll

2009-02-09 12:39 . 2009-02-09 12:39 6,682 --a------ c:\windows\system32\iqfchrgi.dll

2009-02-09 12:36 . 2009-02-09 12:36 6,680 --a------ c:\windows\system32\xrdehdng.dll

2009-02-08 12:39 . 2009-02-08 12:39 6,682 --a------ c:\windows\system32\qtwamipb.dll

2009-02-07 12:37 . 2009-02-07 12:37 6,682 --a------ c:\windows\system32\egruvrhr.dll

2009-02-07 12:34 . 2009-02-07 12:34 6,680 --a------ c:\windows\system32\wubdusca.dll

2009-02-06 12:37 . 2009-02-06 12:37 6,682 --a------ c:\windows\system32\cdsloncn.dll

2009-02-06 12:34 . 2009-02-06 12:34 6,680 --a------ c:\windows\system32\ihyxunwr.dll

2009-02-05 12:38 . 2009-02-05 12:38 6,680 --a------ c:\windows\system32\fbipesrb.dll

2009-02-05 12:35 . 2009-02-05 12:35 6,682 --a------ c:\windows\system32\spspseab.dll

2009-02-04 14:30 . 2009-02-04 14:30 <DIR> d-------- c:\program files\Zemote Receiver

2009-02-04 12:38 . 2009-02-04 12:38 6,680 --a------ c:\windows\system32\ncirjqbu.dll

2009-02-04 12:35 . 2009-02-04 12:35 6,682 --a------ c:\windows\system32\phgsunox.dll

2009-02-03 14:48 . 2009-02-03 16:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft

2009-02-03 12:35 . 2009-02-03 12:35 6,680 --a------ c:\windows\system32\yhbipngy.dll

2009-02-03 12:32 . 2009-02-03 12:32 6,682 --a------ c:\windows\system32\ajqilcyp.dll

2009-02-02 19:05 . 2009-02-02 19:05 6,682 --a------ c:\windows\system32\lsegmquh.dll

2009-02-02 18:38 . 2009-02-02 18:38 6,680 --a------ c:\windows\system32\yikmnqsn.dll

2009-01-31 17:15 . 2009-01-31 17:15 6,680 --a------ c:\windows\system32\dqfjckkn.dll

2009-01-31 17:12 . 2009-01-31 17:12 6,682 --a------ c:\windows\system32\vhkukjua.dll

2009-01-30 17:11 . 2009-01-30 17:11 6,682 --a------ c:\windows\system32\edqkmsly.dll

2009-01-30 17:11 . 2009-01-30 17:11 6,680 --a------ c:\windows\system32\xrxrlvsj.dll

2009-01-29 17:09 . 2009-01-29 17:09 6,682 --a------ c:\windows\system32\kvkyxtgc.dll

2009-01-29 17:09 . 2009-01-29 17:09 6,680 --a------ c:\windows\system32\jhuscymu.dll

2009-01-28 17:10 . 2009-01-28 17:10 6,682 --a------ c:\windows\system32\humsmick.dll

2009-01-28 17:07 . 2009-01-28 17:07 6,680 --a------ c:\windows\system32\wukkqplv.dll

2009-01-28 16:54 . 2009-01-28 16:54 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\MSNInstaller

2009-01-28 08:08 . 2009-01-28 08:27 <DIR> d-------- c:\windows\_ISTMP1.DIR

2009-01-28 08:08 . 2009-01-28 08:28 504 --a------ c:\windows\_delis32.ini

2009-01-27 17:11 . 2009-01-27 17:11 6,680 --a------ c:\windows\system32\ebgknqrj.dll

2009-01-27 17:08 . 2009-01-27 17:08 6,682 --a------ c:\windows\system32\qctkqtay.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-27 20:43 --------- d-----w c:\documents and settings\LocalService\Application Data\VMware

2009-02-27 20:43 --------- d-----w c:\documents and settings\All Users\Application Data\VMware

2009-02-27 20:30 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\MegauploadToolbar

2009-02-27 19:29 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\DNA

2009-02-27 15:40 --------- d-----w c:\program files\eMule

2009-02-27 04:05 --------- d-----w c:\program files\glider

2009-02-25 11:23 --------- d-----w c:\program files\DNA

2009-02-25 05:49 --------- d-----w c:\program files\HTV

2009-02-25 00:55 --------- d-----w c:\program files\Trend Micro

2009-02-24 05:10 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\EmailNotifier

2009-02-23 21:07 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\BitTorrent

2009-02-12 02:31 --------- d-----w c:\program files\World of Warcraft

2009-02-10 17:01 16,384 ----a-w c:\windows\DCEBoot.exe

2009-02-03 21:29 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-02-03 20:46 --------- d-----w c:\program files\Lavasoft

2009-02-03 20:46 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\Lavasoft

2009-01-27 19:23 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-01-02 23:35 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\DivX

2009-01-02 05:36 --------- d-----w c:\program files\DivX

2008-10-30 22:45 30 ----a-w c:\documents and settings\HP_Administrator\jagex_runescape_preferences.dat

2008-09-25 18:59 3,766,158 ----a-w c:\program files\World of Warcraft.zip

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "c:\progra~1\MEGAUP~2\MEGAUP~1.DLL" [2008-08-04 1947080]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]

[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}"= "c:\progra~1\MEGAUP~2\MEGAUP~1.DLL" [2008-08-04 1947080]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-c39e-35f1d2a32ec8}]

[HKEY_CLASSES_ROOT\megauploadtoolbar.MEGAUPLOADTOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-09 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-14 7323648]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-07 180269]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

c:\documents and settings\Default User\Start Menu\Programs\Startup\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-03-07 27136]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\program files\iolo\System Mechanic 6"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk

backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk

backup=c:\windows\pss\Updates From HP.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]

path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk

backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

--a------ 2007-12-22 02:20 222080 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2004-08-09 23:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]

--a------ 2005-11-01 12:01 90112 c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]

--a------ 2005-08-05 23:56 64512 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]

--a------ 2005-11-09 19:29 249856 c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]

--a------ 2005-06-02 01:35 49152 c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

--a------ 2005-10-12 22:30 139264 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

--a------ 2007-09-26 14:42 267064 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

--a------ 2006-04-13 11:09 49152 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

--a------ 2005-12-14 16:51 7323648 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2007-06-29 06:24 286720 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]

--a------ 2005-07-23 01:14 237568 c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer]

--a------ 2006-12-20 11:38 557056 c:\program files\iolo\System Mechanic 6\SMSystemAnalyzer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

--a------ 2006-01-06 11:46 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

--a------ 2006-03-07 16:28 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UfSeAgnt.exe]

--a------ 2008-07-29 13:24 1398024 c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

--a------ 2005-12-14 16:51 1519616 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

--a------ 2006-01-11 19:23 15961088 c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\BitTorrent_DNA\\dna.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\DISC\\DISCover.exe"=

"c:\\Program Files\\DISC\\DiscStreamHub.exe"=

"c:\\Program Files\\eMule\\emule.exe"=

"c:\\Program Files\\Sierra Entertainment\\World in Conflict - DEMO\\wic.exe"=

"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\Softnyx\\WolfTeam\\Wolfteam.bin"=

"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Documents and Settings\\HP_Administrator\\Desktop\\Random\\Stronghold Legends\\StrongholdLegends.exe"=

"c:\\ijji\\ENGLISH\\u_skid.exe"=

"c:\\Program Files\\DriftCity\\DriftCity.exe"=

"c:\\Program Files\\Trillian\\trillian.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\Ares\\Ares.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"25356:TCP"= 25356:TCP:BitComet 25356 TCP

"25356:UDP"= 25356:UDP:BitComet 25356 UDP

"37442:TCP"= 37442:TCP:bittorent

"37442:UDP"= 37442:UDP:bittorrent

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2008-02-21 52240]

R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2007-12-16 36368]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-06-29 24652]

R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2007-12-16 333328]

S3 krpoaglm;krpoaglm;\??\c:\documents and settings\HP_Administrator\Desktop\Glider\krpoaglm.sys --> c:\documents and settings\HP_Administrator\Desktop\Glider\krpoaglm.sys [?]

S3 rowhuftys;rowhuftys;\??\c:\documents and settings\HP_Administrator\Desktop\New Folder\rowhuftys.sys --> c:\documents and settings\HP_Administrator\Desktop\New Folder\rowhuftys.sys [?]

S3 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2008-02-21 488768]

S3 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2008-02-21 648456]

S3 uxlpxh;uxlpxh;\??\c:\documents and settings\HP_Administrator\Desktop\Alex's Glider\uxlpxh.sys --> c:\documents and settings\HP_Administrator\Desktop\Alex's Glider\uxlpxh.sys [?]

S3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [2006-03-07 468768]

S3 XDva042;XDva042;\??\c:\windows\system32\XDva042.sys --> c:\windows\system32\XDva042.sys [?]

S3 XDva074;XDva074;\??\c:\windows\system32\XDva074.sys --> c:\windows\system32\XDva074.sys [?]

S3 XDva081;XDva081;\??\c:\windows\system32\XDva081.sys --> c:\windows\system32\XDva081.sys [?]

S3 XDva093;XDva093;\??\c:\windows\system32\XDva093.sys --> c:\windows\system32\XDva093.sys [?]

S3 XDva104;XDva104;\??\c:\windows\system32\XDva104.sys --> c:\windows\system32\XDva104.sys [?]

.

Contents of the 'Scheduled Tasks' folder

2009-02-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []

.

- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)

URLSearchHooks-Rank - (no file)

.

------- Supplementary Scan -------

.

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uInternet Connection Wizard,ShellNext = hxxp://links.hppcdl.com/default.asp?rowid=7218&url=http%3A%2F%2Fwww%2Eshopping%2Ehp%2Ecom%2Fwebapp%2Fshopping%2Faccessories%5Flanding%2Edo%3Flanding%3Ddesktop%26aoid%3D29627

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

Trusted Zone: trymedia.com

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\l1pbmd2r.default\

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPJava11.dll

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPJava12.dll

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPJava13.dll

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPJava14.dll

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPJava32.dll

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPJPI150_05.dll

FF - plugin: c:\program files\Java\jre1.5.0_05\bin\NPOJI610.dll

FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

VBEFile=NOTEPAD.EXE %1

VBSFile=NOTEPAD.EXE %1

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://*.trymedia.com (HKLM)

O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Monopoly Here and Now\Images\stg_drm.ocx

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Monopoly Here and Now\Images\armhelper.ocx

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Intel

Edited February 28, 2009 by AdvancedSetup
Removed CODE Tags

AdvancedSetup · February 28, 2009

Download but do not yet run ComboFix

If you have a previous version of Combofix.exe, delete it and download a fresh copy.

Download it to your DESKTOP - it MUST run from the Desktop

download.bleepingcomputer.com/sUBs/ComboFix.exe

subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

Driver::
krpoaglm
rowhuftys
uxlpxh
XDva042
XDva074
XDva081
XDva093
XDva104

DirLook::
C:\found.006
C:\found.005

Folder::
c:\windows\_ISTMP1.DIR

File::
c:\windows\system32\XDva042.sys
c:\windows\system32\XDva074.sys
c:\windows\system32\XDva081.sys
c:\windows\system32\XDva093.sys
c:\windows\system32\XDva104.sys
c:\documents and settings\HP_Administrator\Desktop\Alex's Glider\uxlpxh.sys
c:\documents and settings\HP_Administrator\Desktop\New Folder\rowhuftys.sys
c:\documents and settings\HP_Administrator\Desktop\Glider\krpoaglm.sys
c:\windows\system32\ymdvqxsa.dll
c:\windows\system32\lxvgrudc.dll
c:\windows\system32\sxnwqpbe.dll
c:\windows\system32\veciluev.dll
c:\windows\system32\qccsdeab.dll
c:\windows\system32\iwybliqt.dll
c:\windows\system32\gytyuvde.dll
c:\windows\system32\mslucypl.dll
c:\windows\system32\avsiclfg.dll
c:\windows\system32\kijhghsa.dll
c:\windows\system32\lysfxtud.dll
c:\windows\system32\mjelgcdi.dll
c:\windows\system32\aolxwbqm.dll
c:\windows\system32\kcvrfwek.dll
c:\windows\system32\pwuirakj.dll
c:\windows\system32\qewmudrs.dll
c:\windows\system32\rmrxmkqb.dll
c:\windows\system32\iehuhrff.dll
c:\windows\system32\xowtmgwx.dll
c:\windows\system32\ufyafhii.dll
c:\windows\system32\obsllppo.dll
c:\windows\system32\pvdcigjp.dll
c:\windows\system32\fejpdhrt.dll
c:\windows\system32\obrgjase.dll
c:\windows\system32\mcxnrlss.dll
c:\windows\system32\cdtewbtr.dll
c:\windows\system32\aflagumn.dll
c:\windows\system32\pqfcnxtq.dll
c:\windows\system32\qiyhllvu.dll
c:\windows\system32\kgomttwy.dll
c:\windows\system32\esgyunhh.dll
c:\windows\system32\mdmepmlm.dll
c:\windows\system32\qtctukes.dll
c:\windows\system32\odbxirco.dll
c:\windows\system32\pvrvrwpr.dll
c:\windows\system32\keelsmbh.dll
c:\windows\system32\longtmhl.dll
c:\windows\system32\sagekmap.dll
c:\windows\system32\ftrdnnya.dll
c:\windows\system32\lfpuohqj.dll
c:\windows\system32\xexpofby.dll
c:\windows\system32\upldhtwh.dll
c:\windows\system32\jshyjwui.dll
c:\windows\system32\iqfchrgi.dll
c:\windows\system32\xrdehdng.dll
c:\windows\system32\qtwamipb.dll
c:\windows\system32\egruvrhr.dll
c:\windows\system32\wubdusca.dll
c:\windows\system32\cdsloncn.dll
c:\windows\system32\ihyxunwr.dll
c:\windows\system32\fbipesrb.dll
c:\windows\system32\spspseab.dll
c:\windows\system32\ncirjqbu.dll
c:\windows\system32\phgsunox.dll
c:\windows\system32\yhbipngy.dll
c:\windows\system32\ajqilcyp.dll
c:\windows\system32\lsegmquh.dll
c:\windows\system32\yikmnqsn.dll
c:\windows\system32\dqfjckkn.dll
c:\windows\system32\vhkukjua.dll
c:\windows\system32\edqkmsly.dll
c:\windows\system32\xrxrlvsj.dll
c:\windows\system32\kvkyxtgc.dll
c:\windows\system32\jhuscymu.dll
c:\windows\system32\humsmick.dll
c:\windows\system32\wukkqplv.dll
c:\windows\_delis32.ini
c:\windows\system32\ebgknqrj.dll
c:\windows\system32\qctkqtay.dll
c:\windows\DCEBoot.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"=-

RegLock::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Nls\CodePage\EUDCCodeRange]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Hardware Profiles\[u]0[/u]001\Software\Microsoft]

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
Disconnect from the Internet.
Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

Alex S · February 28, 2009

Here is the log of the combofix with the script:

ComboFix 09-02-26.02 - HP_Administrator 2009-02-28 10:26:03.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1251.7.1033.18.2046.1561 [GMT -5:00]

Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

AV: Trend Micro Internet Security *On-access scanning enabled* (Outdated)

FW: Trend Micro Personal Firewall *enabled*

* Created a new restore point

FILE ::

c:\documents and settings\HP_Administrator\Desktop\Alex's Glider\uxlpxh.sys

c:\documents and settings\HP_Administrator\Desktop\Glider\krpoaglm.sys

c:\documents and settings\HP_Administrator\Desktop\New Folder\rowhuftys.sys

c:\windows\_delis32.ini

c:\windows\DCEBoot.exe

c:\windows\system32\aflagumn.dll

c:\windows\system32\ajqilcyp.dll

c:\windows\system32\aolxwbqm.dll

c:\windows\system32\avsiclfg.dll

c:\windows\system32\cdsloncn.dll

c:\windows\system32\cdtewbtr.dll

c:\windows\system32\dqfjckkn.dll

c:\windows\system32\ebgknqrj.dll

c:\windows\system32\edqkmsly.dll

c:\windows\system32\egruvrhr.dll

c:\windows\system32\esgyunhh.dll

c:\windows\system32\fbipesrb.dll

c:\windows\system32\fejpdhrt.dll

c:\windows\system32\ftrdnnya.dll

c:\windows\system32\gytyuvde.dll

c:\windows\system32\humsmick.dll

c:\windows\system32\iehuhrff.dll

c:\windows\system32\ihyxunwr.dll

c:\windows\system32\iqfchrgi.dll

c:\windows\system32\iwybliqt.dll

c:\windows\system32\jhuscymu.dll

c:\windows\system32\jshyjwui.dll

c:\windows\system32\kcvrfwek.dll

c:\windows\system32\keelsmbh.dll

c:\windows\system32\kgomttwy.dll

c:\windows\system32\kijhghsa.dll

c:\windows\system32\kvkyxtgc.dll

c:\windows\system32\lfpuohqj.dll

c:\windows\system32\longtmhl.dll

c:\windows\system32\lsegmquh.dll

c:\windows\system32\lxvgrudc.dll

c:\windows\system32\lysfxtud.dll

c:\windows\system32\mcxnrlss.dll

c:\windows\system32\mdmepmlm.dll

c:\windows\system32\mjelgcdi.dll

c:\windows\system32\mslucypl.dll

c:\windows\system32\ncirjqbu.dll

c:\windows\system32\obrgjase.dll

c:\windows\system32\obsllppo.dll

c:\windows\system32\odbxirco.dll

c:\windows\system32\phgsunox.dll

c:\windows\system32\pqfcnxtq.dll

c:\windows\system32\pvdcigjp.dll

c:\windows\system32\pvrvrwpr.dll

c:\windows\system32\pwuirakj.dll

c:\windows\system32\qccsdeab.dll

c:\windows\system32\qctkqtay.dll

c:\windows\system32\qewmudrs.dll

c:\windows\system32\qiyhllvu.dll

c:\windows\system32\qtctukes.dll

c:\windows\system32\qtwamipb.dll

c:\windows\system32\rmrxmkqb.dll

c:\windows\system32\sagekmap.dll

c:\windows\system32\spspseab.dll

c:\windows\system32\sxnwqpbe.dll

c:\windows\system32\ufyafhii.dll

c:\windows\system32\upldhtwh.dll

c:\windows\system32\veciluev.dll

c:\windows\system32\vhkukjua.dll

c:\windows\system32\wubdusca.dll

c:\windows\system32\wukkqplv.dll

c:\windows\system32\XDva042.sys

c:\windows\system32\XDva074.sys

c:\windows\system32\XDva081.sys

c:\windows\system32\XDva093.sys

c:\windows\system32\XDva104.sys

c:\windows\system32\xexpofby.dll

c:\windows\system32\xowtmgwx.dll

c:\windows\system32\xrdehdng.dll

c:\windows\system32\xrxrlvsj.dll

c:\windows\system32\yhbipngy.dll

c:\windows\system32\yikmnqsn.dll

c:\windows\system32\ymdvqxsa.dll

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\_delis32.ini

c:\windows\_ISTMP1.DIR

c:\windows\_ISTMP1.DIR\_ISTMP0.DIR\_isres.dll

c:\windows\_ISTMP1.DIR\_ISTMP0.DIR\_isres.opt

c:\windows\_ISTMP1.DIR\_ISTMP0.DIR\Copy of _isres.dll

c:\windows\_ISTMP1.DIR\_ISTMP0.DIR\Corecomp.ini

c:\windows\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll

c:\windows\_ISTMP1.DIR\_ISTMP0.DIR\ISUninst.exe

c:\windows\DCEBoot.exe

c:\windows\system32\aflagumn.dll

c:\windows\system32\ajqilcyp.dll

c:\windows\system32\aolxwbqm.dll

c:\windows\system32\avsiclfg.dll

c:\windows\system32\cdsloncn.dll

c:\windows\system32\cdtewbtr.dll

c:\windows\system32\dqfjckkn.dll

c:\windows\system32\ebgknqrj.dll

c:\windows\system32\edqkmsly.dll

c:\windows\system32\egruvrhr.dll

c:\windows\system32\esgyunhh.dll

c:\windows\system32\fbipesrb.dll

c:\windows\system32\fejpdhrt.dll

c:\windows\system32\ftrdnnya.dll

c:\windows\system32\gytyuvde.dll

c:\windows\system32\humsmick.dll

c:\windows\system32\iehuhrff.dll

c:\windows\system32\ihyxunwr.dll

c:\windows\system32\iqfchrgi.dll

c:\windows\system32\iwybliqt.dll

c:\windows\system32\jhuscymu.dll

c:\windows\system32\jshyjwui.dll

c:\windows\system32\kcvrfwek.dll

c:\windows\system32\keelsmbh.dll

c:\windows\system32\kgomttwy.dll

c:\windows\system32\kijhghsa.dll

c:\windows\system32\kvkyxtgc.dll

c:\windows\system32\lfpuohqj.dll

c:\windows\system32\longtmhl.dll

c:\windows\system32\lsegmquh.dll

c:\windows\system32\lxvgrudc.dll

c:\windows\system32\lysfxtud.dll

c:\windows\system32\mcxnrlss.dll

c:\windows\system32\mdmepmlm.dll

c:\windows\system32\mjelgcdi.dll

c:\windows\system32\mslucypl.dll

c:\windows\system32\ncirjqbu.dll

c:\windows\system32\obrgjase.dll

c:\windows\system32\obsllppo.dll

c:\windows\system32\odbxirco.dll

c:\windows\system32\phgsunox.dll

c:\windows\system32\pqfcnxtq.dll

c:\windows\system32\pvdcigjp.dll

c:\windows\system32\pvrvrwpr.dll

c:\windows\system32\pwuirakj.dll

c:\windows\system32\qccsdeab.dll

c:\windows\system32\qctkqtay.dll

c:\windows\system32\qewmudrs.dll

c:\windows\system32\qiyhllvu.dll

c:\windows\system32\qtctukes.dll

c:\windows\system32\qtwamipb.dll

c:\windows\system32\rmrxmkqb.dll

c:\windows\system32\sagekmap.dll

c:\windows\system32\spspseab.dll

c:\windows\system32\sxnwqpbe.dll

c:\windows\system32\ufyafhii.dll

c:\windows\system32\upldhtwh.dll

c:\windows\system32\veciluev.dll

c:\windows\system32\vhkukjua.dll

c:\windows\system32\wubdusca.dll

c:\windows\system32\wukkqplv.dll

c:\windows\system32\xexpofby.dll

c:\windows\system32\xowtmgwx.dll

c:\windows\system32\xrdehdng.dll

c:\windows\system32\xrxrlvsj.dll

c:\windows\system32\yhbipngy.dll

c:\windows\system32\yikmnqsn.dll

c:\windows\system32\ymdvqxsa.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_KRPOAGLM

-------\Legacy_ROWHUFTYS

-------\Legacy_UXLPXH

-------\Legacy_XDVA042

-------\Legacy_XDVA074

-------\Legacy_XDVA081

-------\Legacy_XDVA093

-------\Legacy_XDVA104

-------\Service_krpoaglm

-------\Service_rowhuftys

-------\Service_uxlpxh

-------\Service_XDva042

-------\Service_XDva074

-------\Service_XDva081

-------\Service_XDva093

-------\Service_XDva104

((((((((((((((((((((((((( Files Created from 2009-01-28 to 2009-02-28 )))))))))))))))))))))))))))))))