Unable to Get Rid of MS Juan

robinbirdie · March 7, 2009

Hi.

I've run MBAM and Avira Antivirus and MS Juan won't go away!

Here are my MBAM and HijackThis logs.

I would really appreciate some help!

Thanks,

Robin

MBAM

Malwarebytes' Anti-Malware 1.34

Database version: 1825

Windows 5.1.2600 Service Pack 3

3/6/2009 9:31:18 PM

mbam-log-2009-03-06 (21-31-18).txt

Scan type: Full Scan (C:\|)

Objects scanned: 154123

Time elapsed: 41 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

HijackThis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:34:01 PM, on 3/6/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\SYSTEM32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\SnapStream Media\Firefly\Firefly.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Panasonic\Device Monitor\dmwakeup.exe

C:\Program Files\Panasonic\MFStation\PCCMFSDM.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Documents and Settings\RBird\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\WinTV\TVServer\CaptureATSCStick.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\WINDOWS\DvzCommon\DvzMsgr.exe

C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe

C:\Program Files\Palm\HOTSYNC.EXE

C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\PROGRA~1\COMMON~1\SNAPST~1\Common\x10nets.exe

C:\Program Files\Trillian\trillian.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Pando Networks\Pando\pando.exe

C:\Program Files\WinTV\WinTV7\WinTV7.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll

O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [Firefly] C:\Program Files\SnapStream Media\Firefly\Firefly.exe

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Panasonic Device Monitor Wakeup] C:\Program Files\Panasonic\Device Monitor\dmwakeup.exe

O4 - HKLM\..\Run: [Panasonic Device Manager for Multi-Function Station software] C:\Program Files\Panasonic\MFStation\PCCMFSDM.exe

O4 - HKLM\..\Run: [Panasonic PCFAX for Multi-Function Station software] C:\Program Files\Panasonic\MFStation\KmPcFax.exe -1

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\RBird\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE

O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink\Toolbar\SearchUI.dll/search.html

O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

O9 - Extra button: SelectView - {16D60F96-2FF6-40b2-96D3-C32170E45A01} - C:\Program Files\SelectView\svie.dll

O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\dtv\EXPLBAR.DLL

O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1219922634162

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab

O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: , c:\windows\system32\pozimadu.dll, dptrzp.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (antivirscheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (antivirservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

O23 - Service: Panasonic Local Printer Service - Panasonic Communications Co., Ltd. - C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe

O23 - Service: Panasonic Trap Monitor Service - Panasonic - C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\SNAPST~1\Common\x10nets.exe

--

End of file - 11174 bytes

miekiemoes · March 7, 2009

Hi,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

robinbirdie · March 7, 2009

Thank you.

However, I'm having a problem.

When I start Combofix, it says:

ComboFix has detected the following real time scanner(s) to be active:

*Earthlink Antivirus

Antivirus and intrusion prevention programs are known to interfere with ComboFix's running. This may lead to unpredictable results or possible machine damage. Please disable these scanners before clicking 'OK'.

But I have no Earthlink Antivirus software on my computer.

miekiemoes · March 8, 2009

Hi,

If you don't have Earthlink present anymore, then just ignore the combofix message and proceed with the steps.

I assume you did disable your Avira?

robinbirdie · March 8, 2009

Yes, I did disable Avira. Here is the ComboFix log.

ComboFix 09-03-06.02 - RBird 2009-03-08 14:20:47.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1520 [GMT -4:00]

Running from: c:\documents and settings\RBird\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

AV: EarthLink Antivirus *On-access scanning enabled* (Updated)

FW: EarthLink Firewall *disabled*

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\RBird\Application Data\020000000f0737e7530C.manifest

c:\documents and settings\RBird\Application Data\020000000f0737e7530O.manifest

c:\documents and settings\RBird\Application Data\020000000f0737e7530P.manifest

c:\documents and settings\RBird\Application Data\020000000f0737e7530S.manifest

c:\documents and settings\RBird\Application Data\Adssite Advanced Toolbar

c:\documents and settings\RBird\Application Data\Adssite Advanced Toolbar\selected.xml

c:\temp\1cb

c:\temp\1cb\syscheck.log

c:\temp\tn3

c:\windows\GnuHashes.ini

c:\windows\system32\ayifebub.ini

c:\windows\system32\cdeeg.bak1

c:\windows\system32\cdeeg.ini

c:\windows\system32\dptrzp.dll

c:\windows\system32\drivers\npf.sys

c:\windows\system32\gesulodu.dll

c:\windows\system32\GroupPolicy000.dat

c:\windows\system32\h3

c:\windows\system32\init32.exe

c:\windows\system32\packet.dll

c:\windows\system32\tmp.reg

c:\windows\system32\uniq.tll

c:\windows\system32\win32hlp.cnf

c:\windows\system32\wpcap.dll

c:\windows\system32\xbadd.bak1

c:\windows\system32\xbadd.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_NPF

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-02-08 to 2009-03-08 )))))))))))))))))))))))))))))))

.

2009-03-07 15:26 . 2009-03-07 15:26 <DIR> d-------- c:\program files\Windows Installer Clean Up

2009-03-06 22:33 . 2009-03-06 22:33 <DIR> d-------- c:\program files\Trend Micro

2009-03-06 21:02 . 2009-03-06 21:02 <DIR> d-------- c:\program files\Avira

2009-03-06 21:02 . 2009-03-06 21:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-03-06 11:46 . 2009-03-06 11:46 <DIR> d-------- c:\program files\WinASO

2009-03-02 22:20 . 2009-03-02 22:20 147,456 --a------ c:\windows\system32\vbzip10.dll

2009-03-02 22:18 . 2009-03-08 14:25 105,198 --a------ c:\windows\system32\drivers\3360cbd7.sys

2009-03-02 22:12 . 2009-03-02 22:12 <DIR> d-------- c:\windows\system32\im5

2009-03-02 22:12 . 2009-03-02 22:59 <DIR> d-------- c:\windows\system32\ghu02

2009-03-02 22:12 . 2009-03-02 22:12 <DIR> d-------- c:\temp\itmp2

2009-03-02 22:12 . 2009-03-02 22:17 2 --a------ C:\1141469782

2009-02-25 15:07 . 2009-02-25 15:07 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-02-15 21:51 . 2009-02-15 21:52 <DIR> d-------- c:\program files\WinTV

2009-02-15 21:51 . 2009-02-15 21:51 <DIR> d-------- c:\program files\Common Files\IviSDK

2009-02-15 21:51 . 1998-09-25 14:16 270,848 --a------ c:\windows\UNWISE.EXE

2009-02-15 21:50 . 2008-12-24 02:43 303,160 --a------ c:\windows\system32\hcwpnp32.dll

2009-02-15 21:50 . 2008-09-26 13:18 106,552 --a------ c:\windows\system32\hcwi2c32.dll

2009-02-15 21:50 . 2004-06-08 07:03 36,921 --a------ c:\windows\system32\hcwutl32.dll

2009-02-15 21:50 . 2009-02-15 21:52 2,066 --a------ c:\windows\HCWPNP.INI

2009-02-15 21:46 . 2009-02-15 21:46 <DIR> d-------- C:\Hauppauge

2009-02-15 21:46 . 2008-12-01 12:06 96,256 --a------ c:\windows\system32\hcwCPem.ax

2009-02-15 21:46 . 2008-12-01 12:06 70,944 --a------ c:\windows\HCWemmon.exe

2009-02-15 21:46 . 2008-12-01 12:06 27,648 --a------ c:\windows\system32\drivers\emAudio.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-08 18:17 --------- d-----w c:\program files\Trillian

2009-03-08 06:13 --------- d-----w c:\program files\LogMeIn

2009-03-07 20:35 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater

2009-03-07 19:25 --------- d-----w c:\program files\MSECache

2009-03-07 02:13 --------- d-----w c:\documents and settings\All Users\Application Data\ATI MMC

2009-03-06 21:15 --------- d-----w c:\documents and settings\RBird\Application Data\uTorrent

2009-03-05 18:25 --------- d-----w c:\documents and settings\RBird\Application Data\dvdcss

2009-03-03 03:05 --------- d-----w c:\documents and settings\RBird\Application Data\FrostWire

2009-03-03 02:24 --------- d-----w c:\documents and settings\RBird\Application Data\LimeWire

2009-03-02 20:16 --------- d-----w c:\program files\SelectView

2009-03-02 17:06 --------- d-----w c:\program files\SnapStream Media

2009-03-02 17:06 --------- d-----w c:\documents and settings\All Users\Application Data\SnapStream

2009-02-27 04:06 --------- d-----w c:\program files\Microsoft Silverlight

2009-02-18 23:18 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-16 01:51 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-09 01:18 --------- d-----w c:\documents and settings\RBird\Application Data\Move Networks

2009-02-07 20:59 --------- d-----w c:\program files\Bonjour

2009-02-01 19:06 --------- d-----w c:\documents and settings\RBird\Application Data\Panasonic

2009-02-01 19:06 --------- d-----w c:\documents and settings\All Users\Application Data\Panasonic

2009-02-01 19:02 --------- d-----w c:\program files\Panasonic

2009-01-23 23:15 --------- d-----w c:\documents and settings\RBird\Application Data\Skype

2009-01-16 23:39 --------- d-----w c:\program files\Room Arranger

2009-01-16 23:31 --------- d-----w c:\program files\Common Files\ParallelGraphics

2009-01-16 23:26 --------- d-----w c:\program files\Color Style Studio

2009-01-13 03:05 --------- d-----w c:\program files\Google

2007-03-05 01:57 774,144 ------w c:\program files\RngInterstitial.dll

2007-05-22 23:14 8,784 ------w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll

2007-05-22 23:17 245,408 ------w c:\program files\mozilla firefox\plugins\unicows.dll

2008-08-30 16:26 122,880 ------w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2008-08-28 11:51 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082820080829\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-05 68856]

"Google Update"="c:\documents and settings\RBird\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-09 133104]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-17 63048]

"Firefly"="c:\program files\SnapStream Media\Firefly\Firefly.exe" [2006-06-05 180224]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-30 29744]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"Panasonic Device Monitor Wakeup"="c:\program files\Panasonic\Device Monitor\dmwakeup.exe" [2006-11-02 303104]

"Panasonic Device Manager for Multi-Function Station software"="c:\program files\Panasonic\MFStation\PCCMFSDM.exe" [2007-05-21 126976]

"Panasonic PCFAX for Multi-Function Station software"="c:\program files\Panasonic\MFStation\KmPcFax.exe" [2007-05-29 757760]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-25 148888]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

c:\documents and settings\RBird\Start Menu\Programs\Startup\

HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2004-04-13 299008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Dataviz Messenger.lnk - c:\windows\DvzCommon\DvzMsgr.exe [2003-07-01 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2008-10-17 12:51 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=dptrzp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New Application

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmctxth

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--------- 2008-10-15 02:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]

--------- 2007-01-01 17:22 3739648 c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

--------- 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--------- 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

--------- 2008-01-21 12:17 61440 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\emMON]

--a------ 2008-12-01 12:06 70944 c:\windows\HCWemmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Symantec RemoteAssist"=3 (0x3)

"RegManServ"=2 (0x2)

"OpenCASE Media Agent"=2 (0x2)

"nmservice"=2 (0x2)

"nmraapache"=3 (0x3)

"LiveUpdate Notice Service"=2 (0x2)

"LiveUpdate Notice Ex"=2 (0x2)

"LiveUpdate"=3 (0x3)

"ELNKUpdateService"=2 (0x2)

"EarthLinkSafeConnectAgent"=3 (0x3)

"dvpapi"=2 (0x2)

"CLTNetCnService"=2 (0x2)

"Automatic LiveUpdate Scheduler"=2 (0x2)

"AuthFw"=3 (0x3)

"ATI Smart"=2 (0x2)

"Ati HotKey Poller"=2 (0x2)

"ADSService"=3 (0x3)

"aawservice"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"winvnc"=2 (0x2)

"ProtectionService"=2 (0x2)

"ose"=3 (0x3)

"NetSvc"=3 (0x3)

"iPod Service"=3 (0x3)

"idsvc"=3 (0x3)

"IDriverT"=3 (0x3)

"GoogleDesktopManager"=3 (0x3)

"Apple Mobile Device"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Palm\\HOTSYNC.EXE"=

"c:\\Program Files\\NetMeeting\\conf.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Trillian\\trillian.exe"=

"c:\\Program Files\\LogMeIn\\x86\\LogMeIn.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

"c:\\WINDOWS\\system32\\msiexec.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Pando Networks\\Pando\\pando.exe"=

"c:\\Documents and Settings\\RBird\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=

"c:\\Documents and Settings\\RBird\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Documents and Settings\\RBird\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Panasonic\\TrapMonitor\\Trapmnnt.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5800:TCP"= 5800:TCP:TightVNC

"5900:TCP"= 5900:TCP:TightVNC

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"67:UDP"= 67:UDP:DHCP Discovery Service

"58150:TCP"= 58150:TCP:Pando P2P TCP Listening Port

"58150:UDP"= 58150:UDP:Pando P2P UDP Listening Port

R0 GRFILTER;CS NDIS Driver;c:\windows\system32\drivers\GRFilter.sys [2007-04-11 22528]

R2 GRTdiMon;GR TDI Mon;c:\windows\system32\drivers\GRTdiMon.sys [2007-04-11 42496]

R2 HauppaugeTVServer;HauppaugeTVServer;c:\program files\WinTV\TVServer\HauppaugeTVServer.exe [2009-02-15 434176]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [2007-05-31 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2007-05-31 47640]

R2 Panasonic Local Printer Service;Panasonic Local Printer Service;c:\progra~1\PANASO~1\LocalCom\lmsrvnt.exe [2009-02-01 36864]

S2 CWMonitor;Symantec Crimeware Protection Driver;\??\c:\program files\Common Files\Symantec Shared\coShared\CW\1.0\Monitor.sys --> c:\program files\Common Files\Symantec Shared\coShared\CW\1.0\Monitor.sys [?]

S3 ADSFilter;ADSFilter - (EarthLink Filter Driver);c:\windows\system32\drivers\ADSFilter.sys [2007-08-03 57456]

S3 ADSMonitor;ADSMonitor - (EarthLink Monitor Driver);c:\windows\system32\drivers\ADSMonitor.sys [2007-08-03 38384]

S3 EarthLinkSafeConnectDriver;EarthLinkSafeConnectDriver;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys [?]

S3 EarthLinkSafeConnectFilter;EarthLinkSafeConnectFilter;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys [?]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-14 29744]

S3 maa950c;maa950c;c:\windows\system32\drivers\maa950c.sys [2008-03-01 24784]

S3 maa950m;maa950m;c:\windows\system32\drivers\maa950m.sys [2008-03-01 25044]

S3 maa950u;maa950u;c:\windows\system32\drivers\maa950u.sys [2008-03-01 49237]

S3 pnetmdm;PdaNet Modem;c:\windows\system32\drivers\pnetmdm.sys [2007-07-25 8576]

S4 AuthFw;AuthFw; [x]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

Contents of the 'Scheduled Tasks' folder

2009-03-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-03-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1715567821-839522115-1004.job

- c:\documents and settings\RBird\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-09 04:26]

2007-03-04 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job

- c:\program files\Microsoft IntelliType Pro\itype.exe [2006-11-21 18:08]

2009-03-01 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job

- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

2008-06-04 c:\windows\Tasks\Uniblue SpeedUpMyPC.job

- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html

IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE: {{16D60F96-2FF6-40b2-96D3-C32170E45A01} - {DA45FFEB-CD7D-4220-9B9B-F71967DE2B60} - c:\program files\SelectView\svie.dll

FF - ProfilePath - c:\documents and settings\RBird\Application Data\Mozilla\Firefox\Profiles\ayuzmg27.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=58819&ei=utf-8&yahoo_domain=search.yahoo.com&p=

FF - component: c:\documents and settings\RBird\Application Data\Mozilla\Firefox\Profiles\ayuzmg27.default\extensions\{916ab64c-bc3e-471b-8e60-29551922a7ba}\components\Engine.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\RBird\Application Data\Mozilla\Firefox\Profiles\ayuzmg27.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll

FF - plugin: c:\documents and settings\RBird\Application Data\Mozilla\Firefox\Profiles\ayuzmg27.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\RBird\Application Data\Mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\RBird\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\program files\Common Files\ParallelGraphics\Cortona\npCortona.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCortona.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npgcplug.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-08 14:24:34

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\3360cbd7]

"ImagePath"="\SystemRoot\System32\drivers\3360cbd7.sys"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(804)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\LMIinit.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe

c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\LogMeIn\x86\ramaint.exe

c:\program files\WinTV\TVServer\CaptureATSCStick.exe

c:\program files\LogMeIn\x86\LogMeIn.exe

c:\program files\LogMeIn\x86\LMIGuardian.exe

c:\progra~1\PANASO~1\TRAPMO~1\Trapmnnt.exe

c:\program files\LogMeIn\x86\LMIGuardian.exe

c:\program files\iPod\bin\iPodService.exe

c:\progra~1\COMMON~1\SNAPST~1\Common\X10nets.exe

.

**************************************************************************

.

Completion time: 2009-03-08 14:27:29 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-08 18:27:25

Pre-Run: 255,427,223,552 bytes free

Post-Run: 255,886,118,912 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4

350 --- E O F --- 2009-02-27 01:38:41

miekiemoes · March 8, 2009

Hi,

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

File::
c:\windows\system32\drivers\3360cbd7.sys
C:\1141469782
Folder::
c:\windows\system32\im5
c:\windows\system32\ghu02
c:\temp\itmp2
Driver::
3360cbd7
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New Application]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmctxth]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again.

After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

robinbirdie · March 8, 2009

Actually, after my last post, I ran MBAM and MS Juan is gone!

Thank you so much for your help!!

miekiemoes · March 8, 2009

Hi,

It would be a great idea to perform the other steps as well, because there's still malware present. The latest steps should remove it

robinbirdie · March 9, 2009

Oh. Okay, I'll do that now.

robinbirdie · March 9, 2009

Here is the ComboFix log:

ComboFix 09-03-06.02 - RBird 2009-03-08 23:37:11.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1377 [GMT -4:00]

Running from: c:\documents and settings\RBird\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\RBird\Desktop\cfscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

AV: EarthLink Antivirus *On-access scanning enabled* (Updated)

FW: EarthLink Firewall *disabled*

* Created a new restore point

FILE ::

C:\1141469782

c:\windows\system32\drivers\3360cbd7.sys

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\1141469782

c:\temp\itmp2

c:\temp\itmp2\mTS.log

c:\windows\system32\drivers\3360cbd7.sys

c:\windows\system32\ghu02

c:\windows\system32\im5

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_3360cbd7

((((((((((((((((((((((((( Files Created from 2009-02-09 to 2009-03-09 )))))))))))))))))))))))))))))))