Jump to content

Need help with an apparent infection.


Recommended Posts

Okay, Ill try this again:

I made a stupid mistake trying to play a browser game with my kids. Infected with internet security 2010.

When I try to run Malwarebytes I get "unable to execute file mbam.exe"

When I tried to use Rkill I get "logon.exe" box stating "another program is currently using this file"

Also attempting to start in safe mode puts me in a boot loop.

Here is my GMER log pasted directly in rather than attached:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2009-12-20 14:20:23

Windows 5.1.2600 Service Pack 2

Running: vl5vrrow.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\uwtyqfob.sys

---- Processes - GMER 1.0.15 ----

Library C:\WINDOWS\System32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [148] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\PSIService.exe [180] 0x006F0000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe [252] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [344] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [448] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [660] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [708] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [728] 0x10000000

Library C:\WINDOWS\system32\gabowuto.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [728] 0x00EA0000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [920] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [996] 0x10000000

Library C:\WINDOWS\System32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1144] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1180] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [1300] 0x00760000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1416] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1504] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [1628] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1712] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [1744] 0x00620000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [1768] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Bonjour\mDNSResponder.exe [1800] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Java\jre6\bin\jqs.exe [1972] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2020] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2904] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\VTTimer.exe [2960] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Java\jre6\bin\jusched.exe [2972] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe [2992] 0x00380000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\QuickTime\QTTask.exe [3040] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\iTunes\iTunesHelper.exe [3048] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\system32\ctfmon.exe [3080] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Microsoft ActiveSync\wcescomm.exe [3088] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Documents and Settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe [3096] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [3156] 0x00960000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe [3176] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\Ralink\Common\RaUI.exe [3192] 0x00380000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.exe [3684] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\PROGRA~1\MI3AA1~1\rapimgr.exe [3764] 0x10000000

Library C:\WINDOWS\system32\warosami.dll (*** hidden *** ) @ C:\Program Files\iPod\bin\iPodService.exe [3872] 0x10000000

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E ...

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0xAA 0x52 0xC6 0x00 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL

Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites

Hello Packman Jones

Welcome to Malwarebytes.

=====================

Please download DDS and save it to your desktop.

  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

Attach.txt.

================

Link to post
Share on other sites

Ok let's do the following:

First temporarily disable any antivirus program or any real time shields that are present:

If you do not know how then you can refer to this link:

http://www.bleepingcomputer.com/forums/topic114351.html

================

Then Download Combofix from any of the links below. You must rename it before saving it. Rename it to kahdah then save it to your desktop.

Link 1

Link 2

--------------------------------------------------------------------

Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK: (assuming ComboFix.exe is on the desktop as was instructed)

"%userprofile%\desktop\kahdah.exe" /killall

& follow the prompts.

  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt

Link to post
Share on other sites

Here it is:

ComboFix 09-12-21.08 - Owner 12/22/2009 20:33:52.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.218 [GMT -6:00]

Running from: c:\documents and settings\Owner\desktop\kahdah.exe

Command switches used :: /killall

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll

c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll.tmp

c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe

c:\program files\InternetSecurity2010

c:\program files\InternetSecurity2010\IS2010.exe

c:\windows\EventSystem.log

c:\windows\Fonts\acrsec.fon

c:\windows\system32\1042.exe

c:\windows\system32\11324.exe

c:\windows\system32\11573.exe

c:\windows\system32\1181.exe

c:\windows\system32\12487.exe

c:\windows\system32\12822.exe

c:\windows\system32\13429.exe

c:\windows\system32\13579.exe

c:\windows\system32\14478.exe

c:\windows\system32\15192.exe

c:\windows\system32\1522.exe

c:\windows\system32\16247.exe

c:\windows\system32\16781.exe

c:\windows\system32\1740.exe

c:\windows\system32\18110.exe

c:\windows\system32\18181.exe

c:\windows\system32\18467.exe

c:\windows\system32\18636.exe

c:\windows\system32\19440.exe

c:\windows\system32\20682.exe

c:\windows\system32\22285.exe

c:\windows\system32\2246.exe

c:\windows\system32\2354.exe

c:\windows\system32\2390.exe

c:\windows\system32\25042.exe

c:\windows\system32\25151.exe

c:\windows\system32\26500.exe

c:\windows\system32\27626.exe

c:\windows\system32\28311.exe

c:\windows\system32\297.exe

c:\windows\system32\30130.exe

c:\windows\system32\30419.exe

c:\windows\system32\30840.exe

c:\windows\system32\3565.exe

c:\windows\system32\41.exe

c:\windows\system32\4206.exe

c:\windows\system32\4658.exe

c:\windows\system32\469.exe

c:\windows\system32\4764.exe

c:\windows\system32\493.exe

c:\windows\system32\5118.exe

c:\windows\system32\6334.exe

c:\windows\system32\646.exe

c:\windows\system32\7886.exe

c:\windows\system32\8266.exe

c:\windows\system32\8346.exe

c:\windows\system32\8506.exe

c:\windows\system32\8938.exe

c:\windows\system32\bawayeka.dll

c:\windows\system32\bokenayo.dll

c:\windows\system32\BSTIeprintctl1.dll

c:\windows\system32\cache329

c:\windows\system32\cache329\B_329_0_1_503300.htm

c:\windows\system32\cache329\B_329_0_1_503300.swf

c:\windows\system32\cache329\B_329_0_1_504100.htm

c:\windows\system32\cache329\B_329_0_1_504100.swf

c:\windows\system32\cache329\B_329_0_1_506300.htm

c:\windows\system32\cache329\B_329_0_1_506300.swf

c:\windows\system32\cache329\B_329_0_1_513500.gif

c:\windows\system32\cache329\B_329_0_1_514400.htm

c:\windows\system32\cache329\B_329_0_1_514400.swf

c:\windows\system32\cache329\B_329_0_1_514900.htm

c:\windows\system32\cache329\B_329_0_1_514900.swf

c:\windows\system32\cache329\B_329_0_1_515000.htm

c:\windows\system32\cache329\B_329_0_1_515000.swf

c:\windows\system32\cache329\B_329_0_1_515400.htm

c:\windows\system32\cache329\B_329_0_1_515400.swf

c:\windows\system32\cache329\B_329_0_1_518300.htm

c:\windows\system32\cache329\B_329_0_1_518300.swf

c:\windows\system32\cache329\B_329_0_1_523000.htm

c:\windows\system32\cache329\B_329_0_1_523000.swf

c:\windows\system32\cache329\B_329_0_1_524000.htm

c:\windows\system32\cache329\B_329_0_1_524000.swf

c:\windows\system32\cache329\B_329_0_1_524400.htm

c:\windows\system32\cache329\B_329_0_1_524400.swf

c:\windows\system32\cache329\B_329_0_1_529900.htm

c:\windows\system32\cache329\B_329_0_1_529900.swf

c:\windows\system32\cache329\B_329_0_1_531300.htm

c:\windows\system32\cache329\B_329_0_1_531300.swf

c:\windows\system32\cache329\B_329_0_1_532400.htm

c:\windows\system32\cache329\B_329_0_1_532400.swf

c:\windows\system32\cache329\B_329_0_1_533600.htm

c:\windows\system32\cache329\B_329_0_1_533600.swf

c:\windows\system32\cache329\B_329_0_1_534300.htm

c:\windows\system32\cache329\B_329_0_1_534300.swf

c:\windows\system32\cache329\B_329_0_1_534500.htm

c:\windows\system32\cache329\B_329_0_1_534500.swf

c:\windows\system32\cache329\B_329_0_1_534700.htm

c:\windows\system32\cache329\B_329_0_1_534700.swf

c:\windows\system32\cache329\B_329_0_1_535000.htm

c:\windows\system32\cache329\B_329_0_1_535000.swf

c:\windows\system32\cache329\B_329_0_1_535300.htm

c:\windows\system32\cache329\B_329_0_1_535300.swf

c:\windows\system32\cache329\B_329_0_1_537300.htm

c:\windows\system32\cache329\B_329_0_1_537300.swf

c:\windows\system32\cache329\B_329_0_1_544900.gif

c:\windows\system32\cache329\B_329_0_1_545900.htm

c:\windows\system32\cache329\B_329_0_1_545900.swf

c:\windows\system32\cache329\B_329_0_1_549000.htm

c:\windows\system32\cache329\B_329_0_1_549000.swf

c:\windows\system32\cache329\B_329_0_1_549400.htm

c:\windows\system32\cache329\B_329_0_1_549400.swf

c:\windows\system32\cache329\B_329_0_1_554300.gif

c:\windows\system32\cache329\B_329_0_1_555100.gif

c:\windows\system32\cache329\B_329_0_1_555500.htm

c:\windows\system32\cache329\B_329_0_1_555500.swf

c:\windows\system32\cache329\B_329_0_1_558800.gif

c:\windows\system32\cache329\B_329_0_1_560400.htm

c:\windows\system32\cache329\B_329_0_1_560400.swf

c:\windows\system32\cache329\B_329_0_1_561000.htm

c:\windows\system32\cache329\B_329_0_1_561200.htm

c:\windows\system32\cache329\B_329_0_1_561200.swf

c:\windows\system32\cache329\B_329_0_1_562700.htm

c:\windows\system32\cache329\B_329_0_1_562700.swf

c:\windows\system32\cache329\B_329_0_1_563400.gif

c:\windows\system32\cache329\B_329_0_1_566800.htm

c:\windows\system32\cache329\B_329_0_1_566800.swf

c:\windows\system32\cache329\B_329_0_1_567900.htm

c:\windows\system32\cache329\B_329_0_1_567900.swf

c:\windows\system32\cache329\B_329_0_1_568300.htm

c:\windows\system32\cache329\B_329_0_1_568300.swf

c:\windows\system32\cache329\B_329_0_1_571500.htm

c:\windows\system32\cache329\B_329_0_1_571500.swf

c:\windows\system32\cache329\B_329_0_1_572600.htm

c:\windows\system32\cache329\B_329_0_1_572600.swf

c:\windows\system32\cache329\B_329_0_1_577000.htm

c:\windows\system32\cache329\B_329_0_1_577000.swf

c:\windows\system32\cache329\B_329_0_1_578600.htm

c:\windows\system32\cache329\B_329_0_1_578600.swf

c:\windows\system32\cache329\B_329_0_1_579000.htm

c:\windows\system32\cache329\B_329_0_1_579000.swf

c:\windows\system32\cache329\B_329_0_1_579800.htm

c:\windows\system32\cache329\B_329_0_1_579800.swf

c:\windows\system32\cache329\B_329_0_1_581500.htm

c:\windows\system32\cache329\B_329_0_1_581500.swf

c:\windows\system32\cache329\B_329_0_1_581700.htm

c:\windows\system32\cache329\B_329_0_1_581700.swf

c:\windows\system32\cache329\B_329_0_1_587500.htm

c:\windows\system32\cache329\B_329_0_1_587500.swf

c:\windows\system32\cache329\B_329_0_1_587800.htm

c:\windows\system32\cache329\B_329_0_1_587800.swf

c:\windows\system32\cache329\B_329_0_1_588700.htm

c:\windows\system32\cache329\B_329_0_1_588700.swf

c:\windows\system32\cache329\B_329_0_1_590300.htm

c:\windows\system32\cache329\B_329_0_1_590300.swf

c:\windows\system32\cache329\B_329_0_1_591600.htm

c:\windows\system32\cache329\B_329_0_1_591600.swf

c:\windows\system32\cache329\B_329_0_1_593100.gif

c:\windows\system32\cache329\B_329_0_1_593800.htm

c:\windows\system32\cache329\B_329_0_1_593800.swf

c:\windows\system32\cache329\B_329_0_1_593900.htm

c:\windows\system32\cache329\B_329_0_1_593900.swf

c:\windows\system32\cache329\B_329_0_1_595700.gif

c:\windows\system32\cache329\B_329_0_1_598200.htm

c:\windows\system32\cache329\B_329_0_1_598200.swf

c:\windows\system32\cache329\B_329_0_1_598700.htm

c:\windows\system32\cache329\B_329_0_1_598700.swf

c:\windows\system32\cache329\B_329_0_1_598800.htm

c:\windows\system32\cache329\B_329_0_1_598800.swf

c:\windows\system32\cache329\B_329_0_1_599100.htm

c:\windows\system32\cache329\B_329_0_1_599100.swf

c:\windows\system32\cache329\B_329_0_1_599300.gif

c:\windows\system32\cache329\B_329_0_1_599600.htm

c:\windows\system32\cache329\B_329_0_1_599600.swf

c:\windows\system32\cache329\B_329_0_1_599800.gif

c:\windows\system32\cache329\B_329_0_1_600200.gif

c:\windows\system32\cache329\B_329_0_1_600800.htm

c:\windows\system32\cache329\B_329_0_1_600800.swf

c:\windows\system32\cache329\B_329_0_1_600900.htm

c:\windows\system32\cache329\B_329_0_1_600900.swf

c:\windows\system32\cache329\B_329_0_1_602100.htm

c:\windows\system32\cache329\B_329_0_1_602100.swf

c:\windows\system32\cache329\B_329_0_1_602700.htm

c:\windows\system32\cache329\B_329_0_1_602700.swf

c:\windows\system32\cache329\B_329_0_1_602900.htm

c:\windows\system32\cache329\B_329_0_1_602900.swf

c:\windows\system32\cache329\B_329_0_1_603100.htm

c:\windows\system32\cache329\B_329_0_1_603100.swf

c:\windows\system32\cache329\B_329_0_1_604800.htm

c:\windows\system32\cache329\B_329_0_1_604800.swf

c:\windows\system32\cache329\B_329_0_1_607600.htm

c:\windows\system32\cache329\B_329_0_1_607600.swf

c:\windows\system32\cache329\B_329_0_1_611400.htm

c:\windows\system32\cache329\B_329_0_1_611400.swf

c:\windows\system32\cache329\B_329_0_1_611600.htm

c:\windows\system32\cache329\B_329_0_1_611600.swf

c:\windows\system32\cache329\B_329_0_1_612700.htm

c:\windows\system32\cache329\B_329_0_1_612700.swf

c:\windows\system32\cache329\B_329_0_1_621600.htm

c:\windows\system32\cache329\B_329_0_1_621600.swf

c:\windows\system32\cache329\B_329_0_1_622100.gif

c:\windows\system32\cache329\B_329_0_1_623600.htm

c:\windows\system32\cache329\B_329_0_1_623600.swf

c:\windows\system32\cache329\B_329_0_1_627200.htm

c:\windows\system32\cache329\B_329_0_1_627200.swf

c:\windows\system32\cache329\B_329_0_1_629900.htm

c:\windows\system32\cache329\B_329_0_1_629900.swf

c:\windows\system32\cache329\B_329_0_1_630000.htm

c:\windows\system32\cache329\B_329_0_1_630000.swf

c:\windows\system32\cache329\B_329_0_1_630600.htm

c:\windows\system32\cache329\B_329_0_1_630600.swf

c:\windows\system32\cache329\B_329_0_1_631500.htm

c:\windows\system32\cache329\B_329_0_1_631500.swf

c:\windows\system32\cache329\B_329_0_1_632000.htm

c:\windows\system32\cache329\B_329_0_1_632000.swf

c:\windows\system32\cache329\B_329_0_1_632700.htm

c:\windows\system32\cache329\B_329_0_1_632700.swf

c:\windows\system32\cache329\B_329_0_1_636400.htm

c:\windows\system32\cache329\B_329_0_1_636400.swf

c:\windows\system32\cache329\B_329_0_1_650900.htm

c:\windows\system32\cache329\B_329_0_1_650900.swf

c:\windows\system32\cache329\B_329_0_1_652000.htm

c:\windows\system32\cache329\B_329_0_1_652000.swf

c:\windows\system32\cache329\B_329_0_1_653300.htm

c:\windows\system32\cache329\B_329_0_1_653300.swf

c:\windows\system32\cache329\B_329_0_1_654600.htm

c:\windows\system32\cache329\B_329_0_1_654600.swf

c:\windows\system32\cache329\B_329_0_1_655300.htm

c:\windows\system32\cache329\B_329_0_1_655300.swf

c:\windows\system32\cache329\B_329_0_1_655800.gif

c:\windows\system32\cache329\B_329_0_1_658500.gif

c:\windows\system32\cache329\B_329_0_1_659200.htm

c:\windows\system32\cache329\B_329_0_1_659200.swf

c:\windows\system32\cache329\B_329_0_1_659800.htm

c:\windows\system32\cache329\B_329_0_1_659800.swf

c:\windows\system32\cache329\B_329_0_1_660300.htm

c:\windows\system32\cache329\B_329_0_1_660300.swf

c:\windows\system32\cache329\B_329_0_1_660800.htm

c:\windows\system32\cache329\B_329_0_1_660800.swf

c:\windows\system32\cache329\B_329_0_1_661100.htm

c:\windows\system32\cache329\B_329_0_1_661100.swf

c:\windows\system32\cache329\B_329_0_1_670300.gif

c:\windows\system32\cache329\B_329_0_1_677800.gif

c:\windows\system32\cache329\B_329_0_1_683200.htm

c:\windows\system32\cache329\B_329_0_1_683200.swf

c:\windows\system32\cache329\B_329_0_1_686700.htm

c:\windows\system32\cache329\B_329_0_1_686700.swf

c:\windows\system32\cache329\B_329_0_1_687000.htm

c:\windows\system32\cache329\B_329_0_1_687000.swf

c:\windows\system32\cache329\B_329_0_1_688200.htm

c:\windows\system32\cache329\B_329_0_1_688200.swf

c:\windows\system32\cache329\B_329_0_2_536300.htm

c:\windows\system32\cache329\B_329_0_2_536300.swf

c:\windows\system32\cache329\B_329_0_2_577200.htm

c:\windows\system32\cache329\B_329_0_2_577200.swf

c:\windows\system32\cache329\B_329_0_2_578400.gif

c:\windows\system32\cache329\B_329_0_2_599100.htm

c:\windows\system32\cache329\B_329_0_2_599100.swf

c:\windows\system32\cache329\B_329_0_2_615000.htm

c:\windows\system32\cache329\B_329_0_2_615000.swf

c:\windows\system32\cache329\B_329_0_2_668500.htm

c:\windows\system32\cache329\B_329_0_2_668500.swf

c:\windows\system32\cache329\B_329_0_2_674300.htm

c:\windows\system32\cache329\B_329_0_2_674300.swf

c:\windows\system32\cache329\B_329_0_2_676300.htm

c:\windows\system32\cache329\B_329_0_2_676300.swf

c:\windows\system32\cache329\B_329_0_3_529100.htm

c:\windows\system32\cache329\B_329_0_3_529100.swf

c:\windows\system32\cache329\B_329_0_3_531800.htm

c:\windows\system32\cache329\B_329_0_3_531800.swf

c:\windows\system32\cache329\B_329_0_3_536200.htm

c:\windows\system32\cache329\B_329_0_3_536200.swf

c:\windows\system32\cache329\B_329_2_1_503300.htm

c:\windows\system32\cache329\B_329_2_1_503300.swf

c:\windows\system32\cache329\B_329_2_1_504100.htm

c:\windows\system32\cache329\B_329_2_1_504100.swf

c:\windows\system32\cache329\B_329_2_1_506300.htm

c:\windows\system32\cache329\B_329_2_1_506300.swf

c:\windows\system32\cache329\B_329_2_1_512000.htm

c:\windows\system32\cache329\B_329_2_1_512000.swf

c:\windows\system32\cache329\B_329_2_1_513500.gif

c:\windows\system32\cache329\B_329_2_1_513700.gif

c:\windows\system32\cache329\B_329_2_1_514400.htm

c:\windows\system32\cache329\B_329_2_1_514400.swf

c:\windows\system32\cache329\B_329_2_1_515400.htm

c:\windows\system32\cache329\B_329_2_1_515400.swf

c:\windows\system32\cache329\B_329_2_1_518100.htm

c:\windows\system32\cache329\B_329_2_1_518100.swf

c:\windows\system32\cache329\B_329_2_1_518300.htm

c:\windows\system32\cache329\B_329_2_1_518300.swf

c:\windows\system32\cache329\B_329_2_1_521100.htm

c:\windows\system32\cache329\B_329_2_1_521100.swf

c:\windows\system32\cache329\B_329_2_1_523000.htm

c:\windows\system32\cache329\B_329_2_1_523000.swf

c:\windows\system32\cache329\B_329_2_1_524400.htm

c:\windows\system32\cache329\B_329_2_1_524400.swf

c:\windows\system32\cache329\B_329_2_1_528400.htm

c:\windows\system32\cache329\B_329_2_1_528400.swf

c:\windows\system32\cache329\B_329_2_1_529900.htm

c:\windows\system32\cache329\B_329_2_1_529900.swf

c:\windows\system32\cache329\B_329_2_1_531300.htm

c:\windows\system32\cache329\B_329_2_1_531300.swf

c:\windows\system32\cache329\B_329_2_1_532400.htm

c:\windows\system32\cache329\B_329_2_1_532400.swf

c:\windows\system32\cache329\B_329_2_1_533600.htm

c:\windows\system32\cache329\B_329_2_1_533600.swf

c:\windows\system32\cache329\B_329_2_1_534300.htm

c:\windows\system32\cache329\B_329_2_1_534300.swf

c:\windows\system32\cache329\B_329_2_1_534500.htm

c:\windows\system32\cache329\B_329_2_1_534500.swf

c:\windows\system32\cache329\B_329_2_1_534700.htm

c:\windows\system32\cache329\B_329_2_1_534700.swf

c:\windows\system32\cache329\B_329_2_1_535000.htm

c:\windows\system32\cache329\B_329_2_1_535000.swf

c:\windows\system32\cache329\B_329_2_1_535300.htm

c:\windows\system32\cache329\B_329_2_1_535300.swf

c:\windows\system32\cache329\B_329_2_1_537300.htm

c:\windows\system32\cache329\B_329_2_1_537300.swf

c:\windows\system32\cache329\B_329_2_1_544900.gif

c:\windows\system32\cache329\B_329_2_1_544900.htm

c:\windows\system32\cache329\B_329_2_1_544900.swf

c:\windows\system32\cache329\B_329_2_1_545900.htm

c:\windows\system32\cache329\B_329_2_1_545900.swf

c:\windows\system32\cache329\B_329_2_1_547400.gif

c:\windows\system32\cache329\B_329_2_1_547900.htm

c:\windows\system32\cache329\B_329_2_1_547900.swf

c:\windows\system32\cache329\B_329_2_1_549000.htm

c:\windows\system32\cache329\B_329_2_1_549000.swf

c:\windows\system32\cache329\B_329_2_1_549400.htm

c:\windows\system32\cache329\B_329_2_1_549400.swf

c:\windows\system32\cache329\B_329_2_1_555100.gif

c:\windows\system32\cache329\B_329_2_1_555500.htm

c:\windows\system32\cache329\B_329_2_1_555500.swf

c:\windows\system32\cache329\B_329_2_1_560400.htm

c:\windows\system32\cache329\B_329_2_1_560400.swf

c:\windows\system32\cache329\B_329_2_1_562700.htm

c:\windows\system32\cache329\B_329_2_1_562700.swf

c:\windows\system32\cache329\B_329_2_1_563400.gif

c:\windows\system32\cache329\B_329_2_1_566800.htm

c:\windows\system32\cache329\B_329_2_1_566800.swf

c:\windows\system32\cache329\B_329_2_1_567900.htm

c:\windows\system32\cache329\B_329_2_1_567900.swf

c:\windows\system32\cache329\B_329_2_1_571500.htm

c:\windows\system32\cache329\B_329_2_1_571500.swf

c:\windows\system32\cache329\B_329_2_1_572600.htm

c:\windows\system32\cache329\B_329_2_1_572600.swf

c:\windows\system32\cache329\B_329_2_1_577000.htm

c:\windows\system32\cache329\B_329_2_1_577000.swf

c:\windows\system32\cache329\B_329_2_1_578600.htm

c:\windows\system32\cache329\B_329_2_1_578600.swf

c:\windows\system32\cache329\B_329_2_1_579000.htm

c:\windows\system32\cache329\B_329_2_1_579000.swf

c:\windows\system32\cache329\B_329_2_1_579800.htm

c:\windows\system32\cache329\B_329_2_1_579800.swf

c:\windows\system32\cache329\B_329_2_1_581700.htm

c:\windows\system32\cache329\B_329_2_1_581700.swf

c:\windows\system32\cache329\B_329_2_1_587500.htm

c:\windows\system32\cache329\B_329_2_1_587500.swf

c:\windows\system32\cache329\B_329_2_1_587800.htm

c:\windows\system32\cache329\B_329_2_1_587800.swf

c:\windows\system32\cache329\B_329_2_1_588700.htm

c:\windows\system32\cache329\B_329_2_1_588700.swf

c:\windows\system32\cache329\B_329_2_1_588900.gif

c:\windows\system32\cache329\B_329_2_1_589700.gif

c:\windows\system32\cache329\B_329_2_1_590300.htm

c:\windows\system32\cache329\B_329_2_1_590300.swf

c:\windows\system32\cache329\B_329_2_1_591600.htm

c:\windows\system32\cache329\B_329_2_1_591600.swf

c:\windows\system32\cache329\B_329_2_1_592000.htm

c:\windows\system32\cache329\B_329_2_1_592000.swf

c:\windows\system32\cache329\B_329_2_1_593100.gif

c:\windows\system32\cache329\B_329_2_1_593900.htm

c:\windows\system32\cache329\B_329_2_1_593900.swf

c:\windows\system32\cache329\B_329_2_1_594400.htm

c:\windows\system32\cache329\B_329_2_1_594400.swf

c:\windows\system32\cache329\B_329_2_1_595700.gif

c:\windows\system32\cache329\B_329_2_1_598200.htm

c:\windows\system32\cache329\B_329_2_1_598200.swf

c:\windows\system32\cache329\B_329_2_1_598700.htm

c:\windows\system32\cache329\B_329_2_1_598700.swf

c:\windows\system32\cache329\B_329_2_1_598800.htm

c:\windows\system32\cache329\B_329_2_1_598800.swf

c:\windows\system32\cache329\B_329_2_1_599100.htm

c:\windows\system32\cache329\B_329_2_1_599100.swf

c:\windows\system32\cache329\B_329_2_1_599300.gif

c:\windows\system32\cache329\B_329_2_1_599600.htm

c:\windows\system32\cache329\B_329_2_1_599600.swf

c:\windows\system32\cache329\B_329_2_1_599800.gif

c:\windows\system32\cache329\B_329_2_1_600800.htm

c:\windows\system32\cache329\B_329_2_1_600800.swf

c:\windows\system32\cache329\B_329_2_1_600900.htm

c:\windows\system32\cache329\B_329_2_1_600900.swf

c:\windows\system32\cache329\B_329_2_1_602100.htm

c:\windows\system32\cache329\B_329_2_1_602100.swf

c:\windows\system32\cache329\B_329_2_1_602700.htm

c:\windows\system32\cache329\B_329_2_1_602700.swf

c:\windows\system32\cache329\B_329_2_1_602900.htm

c:\windows\system32\cache329\B_329_2_1_602900.swf

c:\windows\system32\cache329\B_329_2_1_603100.htm

c:\windows\system32\cache329\B_329_2_1_603100.swf

c:\windows\system32\cache329\B_329_2_1_604800.htm

c:\windows\system32\cache329\B_329_2_1_604800.swf

c:\windows\system32\cache329\B_329_2_1_607600.htm

c:\windows\system32\cache329\B_329_2_1_607600.swf

c:\windows\system32\cache329\B_329_2_1_611400.htm

c:\windows\system32\cache329\B_329_2_1_611400.swf

c:\windows\system32\cache329\B_329_2_1_611600.htm

c:\windows\system32\cache329\B_329_2_1_611600.swf

c:\windows\system32\cache329\B_329_2_1_621600.htm

c:\windows\system32\cache329\B_329_2_1_621600.swf

c:\windows\system32\cache329\B_329_2_1_622100.gif

c:\windows\system32\cache329\B_329_2_1_623600.htm

c:\windows\system32\cache329\B_329_2_1_623600.swf

c:\windows\system32\cache329\B_329_2_1_624900.htm

c:\windows\system32\cache329\B_329_2_1_624900.swf

c:\windows\system32\cache329\B_329_2_1_625100.htm

c:\windows\system32\cache329\B_329_2_1_625100.swf

c:\windows\system32\cache329\B_329_2_1_626000.htm

c:\windows\system32\cache329\B_329_2_1_626000.swf

c:\windows\system32\cache329\B_329_2_1_627200.htm

c:\windows\system32\cache329\B_329_2_1_627200.swf

c:\windows\system32\cache329\B_329_2_1_629900.htm

c:\windows\system32\cache329\B_329_2_1_629900.swf

c:\windows\system32\cache329\B_329_2_1_630000.htm

c:\windows\system32\cache329\B_329_2_1_630000.swf

c:\windows\system32\cache329\B_329_2_1_630600.htm

c:\windows\system32\cache329\B_329_2_1_630600.swf

c:\windows\system32\cache329\B_329_2_1_631500.htm

c:\windows\system32\cache329\B_329_2_1_631500.swf

c:\windows\system32\cache329\B_329_2_1_632000.htm

c:\windows\system32\cache329\B_329_2_1_632000.swf

c:\windows\system32\cache329\B_329_2_1_632700.htm

c:\windows\system32\cache329\B_329_2_1_632700.swf

c:\windows\system32\cache329\B_329_2_1_640300.htm

c:\windows\system32\cache329\B_329_2_1_640300.swf

c:\windows\system32\cache329\B_329_2_1_650900.htm

c:\windows\system32\cache329\B_329_2_1_650900.swf

c:\windows\system32\cache329\B_329_2_1_652000.htm

c:\windows\system32\cache329\B_329_2_1_652000.swf

c:\windows\system32\cache329\B_329_2_1_653300.htm

c:\windows\system32\cache329\B_329_2_1_653300.swf

c:\windows\system32\cache329\B_329_2_1_658500.gif

c:\windows\system32\cache329\B_329_2_1_659200.htm

c:\windows\system32\cache329\B_329_2_1_659200.swf

c:\windows\system32\cache329\B_329_2_1_659800.htm

c:\windows\system32\cache329\B_329_2_1_659800.swf

c:\windows\system32\cache329\B_329_2_1_660300.htm

c:\windows\system32\cache329\B_329_2_1_660300.swf

c:\windows\system32\cache329\B_329_2_1_660800.htm

c:\windows\system32\cache329\B_329_2_1_660800.swf

c:\windows\system32\cache329\B_329_2_1_667400.htm

c:\windows\system32\cache329\B_329_2_1_667400.swf

c:\windows\system32\cache329\B_329_2_1_669000.gif

c:\windows\system32\cache329\B_329_2_1_670300.gif

c:\windows\system32\cache329\B_329_2_1_683200.htm

c:\windows\system32\cache329\B_329_2_1_683200.swf

c:\windows\system32\cache329\B_329_2_1_688200.htm

c:\windows\system32\cache329\B_329_2_1_688200.swf

c:\windows\system32\cache329\B_329_2_2_536300.htm

c:\windows\system32\cache329\B_329_2_2_536300.swf

c:\windows\system32\cache329\B_329_2_2_538600.htm

c:\windows\system32\cache329\B_329_2_2_538600.swf

c:\windows\system32\cache329\B_329_2_2_547900.htm

c:\windows\system32\cache329\B_329_2_2_547900.swf

c:\windows\system32\cache329\B_329_2_2_550800.htm

c:\windows\system32\cache329\B_329_2_2_550800.swf

c:\windows\system32\cache329\B_329_2_2_551000.htm

c:\windows\system32\cache329\B_329_2_2_551000.swf

c:\windows\system32\cache329\B_329_2_2_567100.htm

c:\windows\system32\cache329\B_329_2_2_567100.swf

c:\windows\system32\cache329\B_329_2_2_567700.htm

c:\windows\system32\cache329\B_329_2_2_567700.swf

c:\windows\system32\cache329\B_329_2_2_569300.gif

c:\windows\system32\cache329\B_329_2_2_577200.htm

c:\windows\system32\cache329\B_329_2_2_577200.swf

c:\windows\system32\cache329\B_329_2_2_578400.gif

c:\windows\system32\cache329\B_329_2_2_586300.htm

c:\windows\system32\cache329\B_329_2_2_586300.swf

c:\windows\system32\cache329\B_329_2_2_588700.htm

c:\windows\system32\cache329\B_329_2_2_588700.swf

c:\windows\system32\cache329\B_329_2_2_589300.htm

c:\windows\system32\cache329\B_329_2_2_589300.swf

c:\windows\system32\cache329\B_329_2_2_599100.htm

c:\windows\system32\cache329\B_329_2_2_599100.swf

c:\windows\system32\cache329\B_329_2_2_615000.htm

c:\windows\system32\cache329\B_329_2_2_615000.swf

c:\windows\system32\cache329\B_329_2_2_622300.gif

c:\windows\system32\cache329\B_329_2_2_622900.gif

c:\windows\system32\cache329\B_329_2_2_627500.htm

c:\windows\system32\cache329\B_329_2_2_627500.swf

c:\windows\system32\cache329\B_329_2_2_627900.htm

c:\windows\system32\cache329\B_329_2_2_627900.swf

c:\windows\system32\cache329\B_329_2_2_628000.gif

c:\windows\system32\cache329\B_329_2_2_628500.htm

c:\windows\system32\cache329\B_329_2_2_628500.swf

c:\windows\system32\cache329\B_329_2_2_628700.htm

c:\windows\system32\cache329\B_329_2_2_628700.swf

c:\windows\system32\cache329\B_329_2_2_639300.gif

c:\windows\system32\cache329\B_329_2_2_649800.gif

c:\windows\system32\cache329\B_329_2_2_651400.gif

c:\windows\system32\cache329\B_329_2_2_664300.htm

c:\windows\system32\cache329\B_329_2_2_664300.swf

c:\windows\system32\cache329\B_329_2_2_666400.htm

c:\windows\system32\cache329\B_329_2_2_666400.swf

c:\windows\system32\cache329\B_329_2_2_668000.htm

c:\windows\system32\cache329\B_329_2_2_668000.swf

c:\windows\system32\cache329\B_329_2_2_668400.htm

c:\windows\system32\cache329\B_329_2_2_668400.swf

c:\windows\system32\cache329\B_329_2_2_668500.htm

c:\windows\system32\cache329\B_329_2_2_668500.swf

c:\windows\system32\cache329\B_329_2_2_668900.htm

c:\windows\system32\cache329\B_329_2_2_668900.swf

c:\windows\system32\cache329\B_329_2_2_669600.htm

c:\windows\system32\cache329\B_329_2_2_669600.swf

c:\windows\system32\cache329\B_329_2_2_672400.htm

c:\windows\system32\cache329\B_329_2_2_672400.swf

c:\windows\system32\cache329\B_329_2_2_673400.gif

c:\windows\system32\cache329\B_329_2_2_674300.htm

c:\windows\system32\cache329\B_329_2_2_674300.swf

c:\windows\system32\cache329\B_329_2_2_676300.htm

c:\windows\system32\cache329\B_329_2_2_676300.swf

c:\windows\system32\cache329\B_329_2_2_737100.htm

c:\windows\system32\cache329\B_329_2_2_737100.swf

c:\windows\system32\cache329\B_329_2_2_737700.gif

c:\windows\system32\cache329\B_329_2_2_737800.gif

c:\windows\system32\cache329\B_329_2_2_737900.gif

c:\windows\system32\cache329\B_329_2_2_738000.gif

c:\windows\system32\cache329\B_329_2_2_738300.gif

c:\windows\system32\cache329\B_329_2_2_775900.htm

c:\windows\system32\cache329\B_329_2_2_775900.swf

c:\windows\system32\cache329\B_329_2_3_529100.htm

c:\windows\system32\cache329\B_329_2_3_529100.swf

c:\windows\system32\cache329\B_329_2_3_531800.htm

c:\windows\system32\cache329\B_329_2_3_531800.swf

c:\windows\system32\cache329\B_329_2_3_531900.gif

c:\windows\system32\cache329\B_329_2_3_536200.htm

c:\windows\system32\cache329\B_329_2_3_536200.swf

c:\windows\system32\cache329\B_329_2_3_546200.gif

c:\windows\system32\cache329\B_329_2_3_557400.htm

c:\windows\system32\cache329\B_329_2_3_557400.swf

c:\windows\system32\cache329\B_329_2_3_557700.htm

c:\windows\system32\cache329\B_329_2_3_557700.swf

c:\windows\system32\cache329\B_329_2_3_559300.htm

c:\windows\system32\cache329\B_329_2_3_559300.swf

c:\windows\system32\cache329\B_329_2_3_578700.gif

c:\windows\system32\cache329\B_329_2_3_580800.gif

c:\windows\system32\cache329\B_329_2_3_582000.gif

c:\windows\system32\cache329\B_329_2_3_582600.gif

c:\windows\system32\cache329\B_329_2_3_582800.gif

c:\windows\system32\cache329\B_329_2_3_583100.gif

c:\windows\system32\cache329\B_329_2_3_589500.htm

c:\windows\system32\cache329\B_329_2_3_589500.swf

c:\windows\system32\cache329\B_329_2_3_592700.gif

c:\windows\system32\cache329\B_329_2_3_610600.gif

c:\windows\system32\cache329\B_329_2_3_610900.htm

c:\windows\system32\cache329\B_329_2_3_610900.jpg

c:\windows\system32\cache329\B_329_2_3_613100.htm

c:\windows\system32\cache329\B_329_2_3_613100.jpg

c:\windows\system32\cache329\B_329_2_3_620000.htm

c:\windows\system32\cache329\B_329_2_3_620000.swf

c:\windows\system32\cache329\B_329_2_3_624900.htm

c:\windows\system32\cache329\B_329_2_3_624900.swf

c:\windows\system32\cache329\B_329_2_3_626000.htm

c:\windows\system32\cache329\B_329_2_3_626000.swf

c:\windows\system32\cache329\B_329_2_3_632100.htm

c:\windows\system32\cache329\B_329_2_3_632100.swf

c:\windows\system32\cache329\B_329_2_3_649000.gif

c:\windows\system32\cache329\B_329_2_3_665900.gif

c:\windows\system32\cache329\B_329_2_3_668500.htm

c:\windows\system32\cache329\B_329_2_3_668500.swf

c:\windows\system32\cache329\B_329_2_3_671300.gif

c:\windows\system32\cache329\B_329_2_3_671400.gif

c:\windows\system32\cache329\B_329_2_3_671700.gif

c:\windows\system32\cache329\B_329_2_3_672100.gif

c:\windows\system32\cache329\B_329_2_3_731700.gif

c:\windows\system32\cache329\B_329_2_3_737100.htm

c:\windows\system32\cache329\B_329_2_3_737100.swf

c:\windows\system32\cache329\B_329_2_3_737700.gif

c:\windows\system32\cache329\B_329_2_3_737800.gif

c:\windows\system32\cache329\B_329_2_3_737900.gif

c:\windows\system32\cache329\B_329_2_3_738000.gif

c:\windows\system32\cache329\B_329_2_3_738300.gif

c:\windows\system32\cache329\B_329_2_3_775800.htm

c:\windows\system32\cache329\B_329_2_3_775800.swf

c:\windows\system32\cache329\B_329_2_4_567800.gif

c:\windows\system32\cache329\B_329_2_4_570400.gif

c:\windows\system32\cache329\B_329_2_4_571300.gif

c:\windows\system32\cache329\B_329_2_4_571600.gif

c:\windows\system32\cache329\B_329_2_4_573600.gif

c:\windows\system32\cache329\B_329_3_1_503300.htm

c:\windows\system32\cache329\B_329_3_1_503300.swf

c:\windows\system32\cache329\B_329_3_1_504100.htm

c:\windows\system32\cache329\B_329_3_1_504100.swf

c:\windows\system32\cache329\B_329_3_1_506300.htm

c:\windows\system32\cache329\B_329_3_1_506300.swf

c:\windows\system32\cache329\B_329_3_1_513500.gif

c:\windows\system32\cache329\B_329_3_1_513700.gif

c:\windows\system32\cache329\B_329_3_1_514400.htm

c:\windows\system32\cache329\B_329_3_1_514400.swf

c:\windows\system32\cache329\B_329_3_1_514900.htm

c:\windows\system32\cache329\B_329_3_1_514900.swf

c:\windows\system32\cache329\B_329_3_1_515000.htm

c:\windows\system32\cache329\B_329_3_1_515000.swf

c:\windows\system32\cache329\B_329_3_1_515400.htm

c:\windows\system32\cache329\B_329_3_1_515400.swf

c:\windows\system32\cache329\B_329_3_1_518100.htm

c:\windows\system32\cache329\B_329_3_1_518100.swf

c:\windows\system32\cache329\B_329_3_1_518300.htm

c:\windows\system32\cache329\B_329_3_1_518300.swf

c:\windows\system32\cache329\B_329_3_1_521100.htm

c:\windows\system32\cache329\B_329_3_1_521100.swf

c:\windows\system32\cache329\B_329_3_1_523000.htm

c:\windows\system32\cache329\B_329_3_1_523000.swf

c:\windows\system32\cache329\B_329_3_1_524400.htm

c:\windows\system32\cache329\B_329_3_1_524400.swf

c:\windows\system32\cache329\B_329_3_1_529900.htm

c:\windows\system32\cache329\B_329_3_1_529900.swf

c:\windows\system32\cache329\B_329_3_1_531300.htm

c:\windows\system32\cache329\B_329_3_1_531300.swf

c:\windows\system32\cache329\B_329_3_1_532400.htm

c:\windows\system32\cache329\B_329_3_1_532400.swf

c:\windows\system32\cache329\B_329_3_1_533600.htm

c:\windows\system32\cache329\B_329_3_1_533600.swf

c:\windows\system32\cache329\B_329_3_1_534300.htm

c:\windows\system32\cache329\B_329_3_1_534300.swf

c:\windows\system32\cache329\B_329_3_1_534500.htm

c:\windows\system32\cache329\B_329_3_1_534500.swf

c:\windows\system32\cache329\B_329_3_1_534700.htm

c:\windows\system32\cache329\B_329_3_1_534700.swf

c:\windows\system32\cache329\B_329_3_1_535000.htm

c:\windows\system32\cache329\B_329_3_1_535000.swf

c:\windows\system32\cache329\B_329_3_1_535300.htm

c:\windows\system32\cache329\B_329_3_1_535300.swf

c:\windows\system32\cache329\B_329_3_1_537300.htm

c:\windows\system32\cache329\B_329_3_1_537300.swf

c:\windows\system32\cache329\B_329_3_1_544900.gif

c:\windows\system32\cache329\B_329_3_1_544900.htm

c:\windows\system32\cache329\B_329_3_1_544900.swf

c:\windows\system32\cache329\B_329_3_1_545900.htm

c:\windows\system32\cache329\B_329_3_1_545900.swf

c:\windows\system32\cache329\B_329_3_1_547900.htm

c:\windows\system32\cache329\B_329_3_1_547900.swf

c:\windows\system32\cache329\B_329_3_1_549000.htm

c:\windows\system32\cache329\B_329_3_1_549000.swf

c:\windows\system32\cache329\B_329_3_1_549400.htm

c:\windows\system32\cache329\B_329_3_1_549400.swf

c:\windows\system32\cache329\B_329_3_1_555500.htm

c:\windows\system32\cache329\B_329_3_1_555500.swf

c:\windows\system32\cache329\B_329_3_1_560400.htm

c:\windows\system32\cache329\B_329_3_1_560400.swf

c:\windows\system32\cache329\B_329_3_1_562700.htm

c:\windows\system32\cache329\B_329_3_1_562700.swf

c:\windows\system32\cache329\B_329_3_1_566800.htm

c:\windows\system32\cache329\B_329_3_1_566800.swf

c:\windows\system32\cache329\B_329_3_1_567900.htm

c:\windows\system32\cache329\B_329_3_1_567900.swf

c:\windows\system32\cache329\B_329_3_1_572600.htm

c:\windows\system32\cache329\B_329_3_1_572600.swf

c:\windows\system32\cache329\B_329_3_1_577000.htm

c:\windows\system32\cache329\B_329_3_1_577000.swf

c:\windows\system32\cache329\B_329_3_1_579000.htm

c:\windows\system32\cache329\B_329_3_1_579000.swf

c:\windows\system32\cache329\B_329_3_1_579800.htm

c:\windows\system32\cache329\B_329_3_1_579800.swf

c:\windows\system32\cache329\B_329_3_1_581700.htm

c:\windows\system32\cache329\B_329_3_1_581700.swf

c:\windows\system32\cache329\B_329_3_1_587800.htm

c:\windows\system32\cache329\B_329_3_1_587800.swf

c:\windows\system32\cache329\B_329_3_1_588700.htm

c:\windows\system32\cache329\B_329_3_1_588700.swf

c:\windows\system32\cache329\B_329_3_1_590300.htm

c:\windows\system32\cache329\B_329_3_1_590300.swf

c:\windows\system32\cache329\B_329_3_1_593100.gif

c:\windows\system32\cache329\B_329_3_1_593900.htm

c:\windows\system32\cache329\B_329_3_1_593900.swf

c:\windows\system32\cache329\B_329_3_1_598200.htm

c:\windows\system32\cache329\B_329_3_1_598200.swf

c:\windows\system32\cache329\B_329_3_1_598700.htm

c:\windows\system32\cache329\B_329_3_1_598700.swf

c:\windows\system32\cache329\B_329_3_1_598800.htm

c:\windows\system32\cache329\B_329_3_1_598800.swf

c:\windows\system32\cache329\B_329_3_1_599100.htm

c:\windows\system32\cache329\B_329_3_1_599100.swf

c:\windows\system32\cache329\B_329_3_1_599600.htm

c:\windows\system32\cache329\B_329_3_1_599600.swf

c:\windows\system32\cache329\B_329_3_1_599800.gif

c:\windows\system32\cache329\B_329_3_1_600800.htm

c:\windows\system32\cache329\B_329_3_1_600800.swf

c:\windows\system32\cache329\B_329_3_1_600900.htm

c:\windows\system32\cache329\B_329_3_1_600900.swf

c:\windows\system32\cache329\B_329_3_1_602100.htm

c:\windows\system32\cache329\B_329_3_1_602100.swf

c:\windows\system32\cache329\B_329_3_1_602900.htm

c:\windows\system32\cache329\B_329_3_1_602900.swf

c:\windows\system32\cache329\B_329_3_1_603100.htm

c:\windows\system32\cache329\B_329_3_1_603100.swf

c:\windows\system32\cache329\B_329_3_1_607600.htm

c:\windows\system32\cache329\B_329_3_1_607600.swf

c:\windows\system32\cache329\B_329_3_1_611400.htm

c:\windows\system32\cache329\B_329_3_1_611400.swf

c:\windows\system32\cache329\B_329_3_1_611600.htm

c:\windows\system32\cache329\B_329_3_1_611600.swf

c:\windows\system32\cache329\B_329_3_1_621600.htm

c:\windows\system32\cache329\B_329_3_1_621600.swf

c:\windows\system32\cache329\B_329_3_1_622100.gif

c:\windows\system32\cache329\B_329_3_1_623600.htm

c:\windows\system32\cache329\B_329_3_1_623600.swf

c:\windows\system32\cache329\B_329_3_1_626000.htm

c:\windows\system32\cache329\B_329_3_1_626000.swf

c:\windows\system32\cache329\B_329_3_1_627200.htm

c:\windows\system32\cache329\B_329_3_1_627200.swf

c:\windows\system32\cache329\B_329_3_1_629900.htm

c:\windows\system32\cache329\B_329_3_1_629900.swf

c:\windows\system32\cache329\B_329_3_1_630000.htm

c:\windows\system32\cache329\B_329_3_1_630000.swf

c:\windows\system32\cache329\B_329_3_1_630600.htm

c:\windows\system32\cache329\B_329_3_1_630600.swf

c:\windows\system32\cache329\B_329_3_1_631500.htm

c:\windows\system32\cache329\B_329_3_1_631500.swf

c:\windows\system32\cache329\B_329_3_1_632000.htm

c:\windows\system32\cache329\B_329_3_1_632000.swf

c:\windows\system32\cache329\B_329_3_1_632700.htm

c:\windows\system32\cache329\B_329_3_1_632700.swf

c:\windows\system32\cache329\B_329_3_1_650900.htm

c:\windows\system32\cache329\B_329_3_1_650900.swf

c:\windows\system32\cache329\B_329_3_1_652000.htm

c:\windows\system32\cache329\B_329_3_1_652000.swf

c:\windows\system32\cache329\B_329_3_1_658500.gif

c:\windows\system32\cache329\B_329_3_1_659200.htm

c:\windows\system32\cache329\B_329_3_1_659200.swf

c:\windows\system32\cache329\B_329_3_1_659800.htm

c:\windows\system32\cache329\B_329_3_1_659800.swf

c:\windows\system32\cache329\B_329_3_1_660300.htm

c:\windows\system32\cache329\B_329_3_1_660300.swf

c:\windows\system32\cache329\B_329_3_1_660800.htm

c:\windows\system32\cache329\B_329_3_1_660800.swf

c:\windows\system32\cache329\B_329_3_1_670300.gif

c:\windows\system32\cache329\B_329_3_1_683200.htm

c:\windows\system32\cache329\B_329_3_1_683200.swf

c:\windows\system32\cache329\B_329_3_1_688200.htm

c:\windows\system32\cache329\B_329_3_1_688200.swf

c:\windows\system32\cache329\B_329_3_2_536300.htm

c:\windows\system32\cache329\B_329_3_2_536300.swf

c:\windows\system32\cache329\B_329_3_2_538600.htm

c:\windows\system32\cache329\B_329_3_2_538600.swf

c:\windows\system32\cache329\B_329_3_2_547900.htm

c:\windows\system32\cache329\B_329_3_2_547900.swf

c:\windows\system32\cache329\B_329_3_2_550800.htm

c:\windows\system32\cache329\B_329_3_2_550800.swf

c:\windows\system32\cache329\B_329_3_2_567100.htm

c:\windows\system32\cache329\B_329_3_2_567100.swf

c:\windows\system32\cache329\B_329_3_2_567700.htm

c:\windows\system32\cache329\B_329_3_2_567700.swf

c:\windows\system32\cache329\B_329_3_2_577200.htm

c:\windows\system32\cache329\B_329_3_2_577200.swf

c:\windows\system32\cache329\B_329_3_2_578400.gif

c:\windows\system32\cache329\B_329_3_2_586300.htm

c:\windows\system32\cache329\B_329_3_2_586300.swf

c:\windows\system32\cache329\B_329_3_2_588700.htm

c:\windows\system32\cache329\B_329_3_2_588700.swf

c:\windows\system32\cache329\B_329_3_2_589300.htm

c:\windows\system32\cache329\B_329_3_2_589300.swf

c:\windows\system32\cache329\B_329_3_2_599100.htm

c:\windows\system32\cache329\B_329_3_2_599100.swf

c:\windows\system32\cache329\B_329_3_2_615000.htm

c:\windows\system32\cache329\B_329_3_2_615000.swf

c:\windows\system32\cache329\B_329_3_2_627500.htm

c:\windows\system32\cache329\B_329_3_2_627500.swf

c:\windows\system32\cache329\B_329_3_2_627900.htm

c:\windows\system32\cache329\B_329_3_2_627900.swf

c:\windows\system32\cache329\B_329_3_2_628000.gif

c:\windows\system32\cache329\B_329_3_2_628500.htm

c:\windows\system32\cache329\B_329_3_2_628500.swf

c:\windows\system32\cache329\B_329_3_2_628700.htm

c:\windows\system32\cache329\B_329_3_2_628700.swf

c:\windows\system32\cache329\B_329_3_2_629900.htm

c:\windows\system32\cache329\B_329_3_2_629900.swf

c:\windows\system32\cache329\B_329_3_2_649800.gif

c:\windows\system32\cache329\B_329_3_2_664300.htm

c:\windows\system32\cache329\B_329_3_2_664300.swf

c:\windows\system32\cache329\B_329_3_2_666400.htm

c:\windows\system32\cache329\B_329_3_2_666400.swf

c:\windows\system32\cache329\B_329_3_2_668000.htm

c:\windows\system32\cache329\B_329_3_2_668000.swf

c:\windows\system32\cache329\B_329_3_2_668400.htm

c:\windows\system32\cache329\B_329_3_2_668400.swf

c:\windows\system32\cache329\B_329_3_2_668500.htm

c:\windows\system32\cache329\B_329_3_2_668500.swf

c:\windows\system32\cache329\B_329_3_2_668900.htm

c:\windows\system32\cache329\B_329_3_2_668900.swf

c:\windows\system32\cache329\B_329_3_2_672400.htm

c:\windows\system32\cache329\B_329_3_2_672400.swf

c:\windows\system32\cache329\B_329_3_2_674300.htm

c:\windows\system32\cache329\B_329_3_2_674300.swf

c:\windows\system32\cache329\B_329_3_2_676300.htm

c:\windows\system32\cache329\B_329_3_2_676300.swf

c:\windows\system32\cache329\B_329_3_2_737700.gif

c:\windows\system32\cache329\B_329_3_2_737800.gif

c:\windows\system32\cache329\B_329_3_2_737900.gif

c:\windows\system32\cache329\B_329_3_2_738000.gif

c:\windows\system32\cache329\B_329_3_2_738300.gif

c:\windows\system32\cache329\B_329_3_2_775900.htm

c:\windows\system32\cache329\B_329_3_2_775900.swf

c:\windows\system32\cache329\B_329_3_3_529100.htm

c:\windows\system32\cache329\B_329_3_3_529100.swf

c:\windows\system32\cache329\B_329_3_3_531800.htm

c:\windows\system32\cache329\B_329_3_3_531800.swf

c:\windows\system32\cache329\B_329_3_3_536200.htm

c:\windows\system32\cache329\B_329_3_3_536200.swf

c:\windows\system32\cache329\B_329_4_0_517100.htm

c:\windows\system32\cache329\B_329_4_0_573500.htm

c:\windows\system32\cache329\B_329_4_1_505100.htm

c:\windows\system32\cache329\B_329_4_1_505100.swf

c:\windows\system32\cache329\B_329_4_1_512500.htm

c:\windows\system32\cache329\B_329_4_1_547300.gif

c:\windows\system32\cache329\B_329_4_1_547300.htm

c:\windows\system32\cache329\B_329_4_1_548900.gif

c:\windows\system32\cache329\B_329_4_1_548900.htm

c:\windows\system32\cache329\B_329_4_1_557900.htm

c:\windows\system32\cache329\B_329_4_1_567400.htm

c:\windows\system32\cache329\B_329_4_1_567400.swf

c:\windows\system32\cache329\B_329_4_1_570700.htm

c:\windows\system32\cache329\B_329_4_1_570700.swf

c:\windows\system32\cache329\B_329_4_1_573500.htm

c:\windows\system32\cache329\B_329_4_1_576700.gif

c:\windows\system32\cache329\B_329_4_1_576700.htm

c:\windows\system32\cache329\B_329_4_1_579200.htm

c:\windows\system32\cache329\B_329_4_1_581800.htm

c:\windows\system32\cache329\B_329_4_1_588200.htm

c:\windows\system32\cache329\B_329_4_1_593000.gif

c:\windows\system32\cache329\B_329_4_1_593000.htm

c:\windows\system32\cache329\B_329_4_1_601500.gif

c:\windows\system32\cache329\B_329_4_1_601500.htm

c:\windows\system32\cache329\B_329_4_1_611800.htm

c:\windows\system32\cache329\B_329_4_1_634900.htm

c:\windows\system32\cache329\B_329_4_1_634900.swf

c:\windows\system32\cache329\B_329_4_1_642300.htm

c:\windows\system32\cache329\B_329_4_1_657300.htm

c:\windows\system32\cache329\B_329_4_1_657300.swf

c:\windows\system32\cache329\B_329_4_1_675600.htm

c:\windows\system32\cache329\B_329_4_1_675700.htm

c:\windows\system32\cache329\B_329_4_1_678500.htm

c:\windows\system32\cache329\B_329_4_1_678700.htm

c:\windows\system32\cache329\B_329_4_1_678900.htm

c:\windows\system32\cache329\B_329_4_1_683100.gif

c:\windows\system32\cache329\B_329_4_1_683100.htm

c:\windows\system32\cache329\B_329_4_2_502800.htm

c:\windows\system32\cache329\B_329_4_2_503700.htm

c:\windows\system32\cache329\B_329_4_2_504300.htm

c:\windows\system32\cache329\B_329_4_2_510600.htm

c:\windows\system32\cache329\B_329_4_2_511500.gif

c:\windows\system32\cache329\B_329_4_2_511500.htm

c:\windows\system32\cache329\B_329_4_2_512000.htm

c:\windows\system32\cache329\B_329_4_2_512700.htm

c:\windows\system32\cache329\B_329_4_2_517700.htm

c:\windows\system32\cache329\B_329_4_2_533000.htm

c:\windows\system32\cache329\B_329_4_2_533800.htm

c:\windows\system32\cache329\B_329_4_2_546500.htm

c:\windows\system32\cache329\B_329_4_2_552400.htm

c:\windows\system32\cache329\B_329_4_2_552400.swf

c:\windows\system32\cache329\B_329_4_2_552600.htm

c:\windows\system32\cache329\B_329_4_2_552600.swf

c:\windows\system32\cache329\B_329_4_2_553200.htm

c:\windows\system32\cache329\B_329_4_2_553200.swf

c:\windows\system32\cache329\B_329_4_2_553400.gif

c:\windows\system32\cache329\B_329_4_2_553400.htm

c:\windows\system32\cache329\B_329_4_2_578000.htm

c:\windows\system32\cache329\B_329_4_2_578000.swf

c:\windows\system32\cache329\B_329_4_2_582000.htm

c:\windows\system32\cache329\B_329_4_2_582000.jpg

c:\windows\system32\cache329\B_329_4_2_582600.htm

c:\windows\system32\cache329\B_329_4_2_582600.jpg

c:\windows\system32\cache329\B_329_4_2_583100.htm

c:\windows\system32\cache329\B_329_4_2_583100.swf

c:\windows\system32\cache329\B_329_4_2_583300.htm

c:\windows\system32\cache329\B_329_4_2_583300.swf

c:\windows\system32\cache329\B_329_4_2_583700.htm

c:\windows\system32\cache329\B_329_4_2_583700.swf

c:\windows\system32\cache329\B_329_4_2_584100.htm

c:\windows\system32\cache329\B_329_4_2_584100.swf

c:\windows\system32\cache329\B_329_4_2_585000.htm

c:\windows\system32\cache329\B_329_4_2_585000.swf

c:\windows\system32\cache329\B_329_4_2_585100.htm

c:\windows\system32\cache329\B_329_4_2_585100.swf

c:\windows\system32\cache329\B_329_4_2_587800.gif

c:\windows\system32\cache329\B_329_4_2_587800.htm

c:\windows\system32\cache329\B_329_4_2_587900.gif

c:\windows\system32\cache329\B_329_4_2_587900.htm

c:\windows\system32\cache329\B_329_4_2_591900.gif

c:\windows\system32\cache329\B_329_4_2_591900.htm

c:\windows\system32\cache329\B_329_4_2_592500.htm

c:\windows\system32\cache329\B_329_4_2_592500.jpg

c:\windows\system32\cache329\B_329_4_2_593000.gif

c:\windows\system32\cache329\B_329_4_2_593000.htm

c:\windows\system32\cache329\B_329_4_2_607000.htm

c:\windows\system32\cache329\B_329_4_2_617600.htm

c:\windows\system32\cache329\B_329_4_2_628400.gif

c:\windows\system32\cache329\B_329_4_2_628400.htm

c:\windows\system32\cache329\B_329_4_2_628900.gif

c:\windows\system32\cache329\B_329_4_2_628900.htm

c:\windows\system32\cache329\B_329_4_2_630100.htm

c:\windows\system32\cache329\B_329_4_2_630100.jpg

c:\windows\system32\cache329\B_329_4_2_632600.htm

c:\windows\system32\cache329\B_329_4_2_632600.swf

c:\windows\system32\cache329\B_329_4_2_632800.htm

c:\windows\system32\cache329\B_329_4_2_632800.swf

c:\windows\system32\cache329\B_329_4_2_635700.htm

c:\windows\system32\cache329\B_329_4_2_635700.jpg

c:\windows\system32\cache329\B_329_4_2_641500.htm

c:\windows\system32\cache329\B_329_4_2_641500.swf

c:\windows\system32\cache329\B_329_4_2_644100.htm

c:\windows\system32\cache329\B_329_4_2_644100.swf

c:\windows\system32\cache329\B_329_4_2_644200.htm

c:\windows\system32\cache329\B_329_4_2_644200.swf

c:\windows\system32\cache329\B_329_4_2_645400.htm

c:\windows\system32\cache329\B_329_4_2_645400.swf

c:\windows\system32\cache329\B_329_4_2_668800.htm

c:\windows\system32\cache329\B_329_4_2_669100.gif

c:\windows\system32\cache329\B_329_4_2_669100.htm

c:\windows\system32\cache329\B_329_4_2_669200.gif

c:\windows\system32\cache329\B_329_4_2_669200.htm

c:\windows\system32\cache329\B_329_4_2_669300.gif

c:\windows\system32\cache329\B_329_4_2_669300.htm

c:\windows\system32\cache329\B_329_4_2_673100.gif

c:\windows\system32\cache329\B_329_4_2_673100.htm

c:\windows\system32\cache329\B_329_4_2_673300.gif

c:\windows\system32\cache329\B_329_4_2_673300.htm

c:\windows\system32\cache329\B_329_4_2_673800.htm

c:\windows\system32\cache329\B_329_4_2_673800.swf

c:\windows\system32\cache329\B_329_4_2_673900.htm

c:\windows\system32\cache329\B_329_4_2_673900.swf

c:\windows\system32\cache329\B_329_4_2_682300.gif

c:\windows\system32\cache329\B_329_4_2_682300.htm

c:\windows\system32\cache329\B_329_4_2_683100.gif

c:\windows\system32\cache329\B_329_4_2_683100.htm

c:\windows\system32\cache329\B_329_4_3_512600.htm

c:\windows\system32\cache329\B_329_4_3_553300.gif

c:\windows\system32\cache329\B_329_4_3_553300.htm

c:\windows\system32\cache329\B_329_4_3_554500.gif

c:\windows\system32\cache329\B_329_4_3_554500.htm

c:\windows\system32\cache329\B_329_4_3_577200.htm

c:\windows\system32\cache329\B_329_4_3_583000.htm

c:\windows\system32\cache329\B_329_4_3_583000.jpg

c:\windows\system32\cache329\B_329_4_3_583500.htm

c:\windows\system32\cache329\B_329_4_3_583500.jpg

c:\windows\system32\cache329\B_329_4_3_584000.htm

c:\windows\system32\cache329\B_329_4_3_584000.jpg

c:\windows\system32\cache329\B_329_4_3_584200.htm

c:\windows\system32\cache329\B_329_4_3_584200.swf

c:\windows\system32\cache329\B_329_4_3_585600.htm

c:\windows\system32\cache329\B_329_4_3_585600.jpg

c:\windows\system32\cache329\B_329_4_3_617600.htm

c:\windows\system32\cache329\B_329_4_3_629200.htm

c:\windows\system32\cache329\B_329_4_3_641500.htm

c:\windows\system32\cache329\B_329_4_3_641500.swf

c:\windows\system32\cache329\B_329_4_3_644100.htm

c:\windows\system32\cache329\B_329_4_3_644100.swf

c:\windows\system32\cache329\B_329_4_3_644200.htm

c:\windows\system32\cache329\B_329_4_3_644200.swf

c:\windows\system32\cache329\B_329_4_3_673100.gif

c:\windows\system32\cache329\B_329_4_3_673100.htm

c:\windows\system32\cache329\B_329_4_3_673200.gif

c:\windows\system32\cache329\B_329_4_3_673200.htm

c:\windows\system32\cache329\B_329_4_3_673300.gif

c:\windows\system32\cache329\B_329_4_3_673300.htm

c:\windows\system32\cache329\B_329_4_3_678500.htm

c:\windows\system32\cache329\B_329_4_3_678700.htm

c:\windows\system32\cache329\B_329_4_3_688600.gif

c:\windows\system32\cache329\B_329_4_3_688600.htm

c:\windows\system32\cache329\B_329_4_4_503700.htm

c:\windows\system32\cache329\B_329_4_4_551300.htm

c:\windows\system32\cache329\B_329_4_4_551300.swf

c:\windows\system32\cache329\B_329_4_4_585100.htm

c:\windows\system32\cache329\B_329_4_4_585100.swf

c:\windows\system32\cache329\B_329_4_4_612300.htm

c:\windows\system32\cache329\B_329_4_4_618600.htm

c:\windows\system32\cache329\B_329_4_4_623400.gif

c:\windows\system32\cache329\B_329_4_4_623400.htm

c:\windows\system32\cache329\B_329_4_4_623600.gif

c:\windows\system32\cache329\B_329_4_4_623600.htm

c:\windows\system32\cache329\B_329_4_4_638500.htm

c:\windows\system32\cache329\B_329_4_4_648300.htm

c:\windows\system32\cache329\B_329_4_4_648300.swf

c:\windows\system32\cache329\B_329_4_4_656500.gif

c:\windows\system32\cache329\B_329_4_4_656500.htm

c:\windows\system32\cache329\B_329_4_4_657000.htm

c:\windows\system32\cache329\B_329_4_4_657000.jpg

c:\windows\system32\cache329\B_329_4_4_658100.htm

c:\windows\system32\cache329\B_329_4_4_663900.htm

c:\windows\system32\cache329\B_329_4_4_663900.swf

c:\windows\system32\cache329\B_329_4_4_664700.htm

c:\windows\system32\cache329\B_329_4_4_664700.swf

c:\windows\system32\cache329\B_329_4_4_667100.htm

c:\windows\system32\cache329\B_329_4_4_667100.swf

c:\windows\system32\cache329\B_329_4_4_739300.htm

c:\windows\system32\cache329\B_329_4_4_739300.jpg

c:\windows\system32\cache329\B_502100.htm

c:\windows\system32\cache329\B_502600.htm

c:\windows\system32\cache329\B_513400.htm

c:\windows\system32\cache329\B_517800.htm

c:\windows\system32\cache329\B_518700.htm

c:\windows\system32\cache329\B_518800.htm

c:\windows\system32\cache329\B_519600.htm

c:\windows\system32\cache329\B_524800.htm

c:\windows\system32\cache329\B_525100.htm

c:\windows\system32\cache329\B_527100.htm

c:\windows\system32\cache329\B_528500.htm

c:\windows\system32\cache329\B_537000.htm

c:\windows\system32\cache329\B_537400.htm

c:\windows\system32\cache329\B_537600.htm

c:\windows\system32\cache329\B_540500.htm

c:\windows\system32\cache329\B_540700.htm

c:\windows\system32\cache329\B_544700.htm

c:\windows\system32\cache329\B_549500.htm

c:\windows\system32\cache329\B_550700.htm

c:\windows\system32\cache329\B_551200.htm

c:\windows\system32\cache329\B_551700.htm

c:\windows\system32\cache329\B_553400.htm

c:\windows\system32\cache329\B_553500.htm

c:\windows\system32\cache329\B_554000.htm

c:\windows\system32\cache329\B_555300.htm

c:\windows\system32\cache329\B_555600.htm

c:\windows\system32\cache329\B_556000.htm

c:\windows\system32\cache329\B_556800.htm

c:\windows\system32\cache329\B_561100.htm

c:\windows\system32\cache329\B_565700.htm

c:\windows\system32\cache329\B_569300.htm

c:\windows\system32\cache329\B_575200.htm

c:\windows\system32\cache329\B_576500.htm

c:\windows\system32\cache329\B_576800.htm

c:\windows\system32\cache329\B_584000.htm

c:\windows\system32\cache329\B_591300.htm

c:\windows\system32\cache329\B_597700.htm

c:\windows\system32\cache329\B_604700.htm

c:\windows\system32\cache329\B_605500.htm

c:\windows\system32\cache329\B_606200.htm

c:\windows\system32\cache329\B_609900.htm

c:\windows\system32\cache329\B_618300.htm

c:\windows\system32\cache329\B_618800.htm

c:\windows\system32\cache329\B_620000.htm

c:\windows\system32\cache329\B_625100.htm

c:\windows\system32\cache329\B_631900.htm

c:\windows\system32\cache329\B_634700.htm

c:\windows\system32\cache329\B_636500.htm

c:\windows\system32\cache329\B_637600.htm

c:\windows\system32\cache329\B_642100.htm

c:\windows\system32\cache329\B_644900.htm

c:\windows\system32\cache329\B_654000.htm

c:\windows\system32\cache329\B_658100.htm

c:\windows\system32\cache329\B_665300.htm

c:\windows\system32\cache329\B_665500.htm

c:\windows\system32\cache329\B_668100.htm

c:\windows\system32\cache329\B_671500.htm

c:\windows\system32\cache329\B_671600.htm

c:\windows\system32\cache329\B_671900.htm

c:\windows\system32\cache329\B_672800.htm

c:\windows\system32\cache329\B_674000.htm

c:\windows\system32\cache329\B_677100.htm

c:\windows\system32\cache329\B_677300.htm

c:\windows\system32\cache329\B_677500.htm

c:\windows\system32\cache329\B_677700.htm

c:\windows\system32\cache329\B_677900.htm

c:\windows\system32\cache329\B_679800.htm

c:\windows\system32\cache329\B_685300.htm

c:\windows\system32\cache329\B_686800.htm

c:\windows\system32\cache329\B_686900.htm

c:\windows\system32\cache329\B_704700.htm

c:\windows\system32\cache329\B_704800.htm

c:\windows\system32\cache329\B_705100.htm

c:\windows\system32\cache329\B_753400.htm

c:\windows\system32\cache329\B_791300.htm

c:\windows\system32\cache329\t_B_329_0_1_561000.htm

c:\windows\system32\cache329\t_B_329_4_0_517100.htm

c:\windows\system32\cache329\t_B_329_4_0_540900.htm

c:\windows\system32\cache329\t_B_329_4_0_543200.htm

c:\windows\system32\cache329\t_B_329_4_0_573500.htm

c:\windows\system32\cache329\t_B_329_4_1_512500.htm

c:\windows\system32\cache329\t_B_329_4_1_551200.htm

c:\windows\system32\cache329\t_B_329_4_1_557900.htm

c:\windows\system32\cache329\t_B_329_4_1_573500.htm

c:\windows\system32\cache329\t_B_329_4_1_579200.htm

c:\windows\system32\cache329\t_B_329_4_1_581800.htm

c:\windows\system32\cache329\t_B_329_4_1_588200.htm

c:\windows\system32\cache329\t_B_329_4_1_611800.htm

c:\windows\system32\cache329\t_B_329_4_1_642300.htm

c:\windows\system32\cache329\t_B_329_4_1_675600.htm

c:\windows\system32\cache329\t_B_329_4_1_675700.htm

c:\windows\system32\cache329\t_B_329_4_1_678500.htm

c:\windows\system32\cache329\t_B_329_4_1_678700.htm

c:\windows\system32\cache329\t_B_329_4_1_678900.htm

c:\windows\system32\cache329\t_B_329_4_2_502800.htm

c:\windows\system32\cache329\t_B_329_4_2_503700.htm

c:\windows\system32\cache329\t_B_329_4_2_504300.htm

c:\windows\system32\cache329\t_B_329_4_2_510600.htm

c:\windows\system32\cache329\t_B_329_4_2_512000.htm

c:\windows\system32\cache329\t_B_329_4_2_512700.htm

c:\windows\system32\cache329\t_B_329_4_2_517700.htm

c:\windows\system32\cache329\t_B_329_4_2_533000.htm

c:\windows\system32\cache329\t_B_329_4_2_533800.htm

c:\windows\system32\cache329\t_B_329_4_2_546500.htm

c:\windows\system32\cache329\t_B_329_4_2_556400.htm

c:\windows\system32\cache329\t_B_329_4_2_607000.htm

c:\windows\system32\cache329\t_B_329_4_2_617600.htm

c:\windows\system32\cache329\t_B_329_4_2_668800.htm

c:\windows\system32\cache329\t_B_329_4_3_512600.htm

c:\windows\system32\cache329\t_B_329_4_3_577200.htm

c:\windows\system32\cache329\t_B_329_4_3_617600.htm

c:\windows\system32\cache329\t_B_329_4_3_629200.htm

c:\windows\system32\cache329\t_B_329_4_3_678500.htm

c:\windows\system32\cache329\t_B_329_4_3_678700.htm

c:\windows\system32\cache329\t_B_329_4_4_503700.htm

c:\windows\system32\cache329\t_B_329_4_4_612300.htm

c:\windows\system32\cache329\t_B_329_4_4_618600.htm

c:\windows\system32\cache329\t_B_329_4_4_638500.htm

c:\windows\system32\cache329\t_B_329_4_4_658100.htm

c:\windows\system32\cache329\t_B_502100.htm

c:\windows\system32\cache329\t_B_502600.htm

c:\windows\system32\cache329\t_B_513400.htm

c:\windows\system32\cache329\t_B_517800.htm

c:\windows\system32\cache329\t_B_518700.htm

c:\windows\system32\cache329\t_B_518800.htm

c:\windows\system32\cache329\t_B_519600.htm

c:\windows\system32\cache329\t_B_524800.htm

c:\windows\system32\cache329\t_B_525100.htm

c:\windows\system32\cache329\t_B_527100.htm

c:\windows\system32\cache329\t_B_528500.htm

c:\windows\system32\cache329\t_B_537000.htm

c:\windows\system32\cache329\t_B_537400.htm

c:\windows\system32\cache329\t_B_537600.htm

c:\windows\system32\cache329\t_B_540500.htm

c:\windows\system32\cache329\t_B_540700.htm

c:\windows\system32\cache329\t_B_544700.htm

c:\windows\system32\cache329\t_B_549500.htm

c:\windows\system32\cache329\t_B_550700.htm

c:\windows\system32\cache329\t_B_551200.htm

c:\windows\system32\cache329\t_B_551700.htm

c:\windows\system32\cache329\t_B_553400.htm

c:\windows\system32\cache329\t_B_553500.htm

c:\windows\system32\cache329\t_B_554000.htm

c:\windows\system32\cache329\t_B_555300.htm

c:\windows\system32\cache329\t_B_555600.htm

c:\windows\system32\cache329\t_B_556000.htm

c:\windows\system32\cache329\t_B_556800.htm

c:\windows\system32\cache329\t_B_561000.htm

c:\windows\system32\cache329\t_B_561100.htm

c:\windows\system32\cache329\t_B_565700.htm

c:\windows\system32\cache329\t_B_569300.htm

c:\windows\system32\cache329\t_B_575200.htm

c:\windows\system32\cache329\t_B_576500.htm

c:\windows\system32\cache329\t_B_576800.htm

c:\windows\system32\cache329\t_B_584000.htm

c:\windows\system32\cache329\t_B_589000.htm

c:\windows\system32\cache329\t_B_591300.htm

c:\windows\system32\cache329\t_B_595500.htm

c:\windows\system32\cache329\t_B_597700.htm

c:\windows\system32\cache329\t_B_604700.htm

c:\windows\system32\cache329\t_B_605500.htm

c:\windows\system32\cache329\t_B_606200.htm

c:\windows\system32\cache329\t_B_609900.htm

c:\windows\system32\cache329\t_B_618300.htm

c:\windows\system32\cache329\t_B_618800.htm

c:\windows\system32\cache329\t_B_620000.htm

c:\windows\system32\cache329\t_B_625100.htm

c:\windows\system32\cache329\t_B_631900.htm

c:\windows\system32\cache329\t_B_634700.htm

c:\windows\system32\cache329\t_B_636500.htm

c:\windows\system32\cache329\t_B_637600.htm

c:\windows\system32\cache329\t_B_642100.htm

c:\windows\system32\cache329\t_B_644900.htm

c:\windows\system32\cache329\t_B_654000.htm

c:\windows\system32\cache329\t_B_658100.htm

c:\windows\system32\cache329\t_B_665300.htm

c:\windows\system32\cache329\t_B_665500.htm

c:\windows\system32\cache329\t_B_668100.htm

c:\windows\system32\cache329\t_B_671500.htm

c:\windows\system32\cache329\t_B_671600.htm

c:\windows\system32\cache329\t_B_671900.htm

c:\windows\system32\cache329\t_B_672800.htm

c:\windows\system32\cache329\t_B_674000.htm

c:\windows\system32\cache329\t_B_677100.htm

c:\windows\system32\cache329\t_B_677300.htm

c:\windows\system32\cache329\t_B_677500.htm

c:\windows\system32\cache329\t_B_677700.htm

c:\windows\system32\cache329\t_B_677900.htm

c:\windows\system32\cache329\t_B_679800.htm

c:\windows\system32\cache329\t_B_685300.htm

c:\windows\system32\cache329\t_B_686800.htm

c:\windows\system32\cache329\t_B_686900.htm

c:\windows\system32\cache329\t_B_704700.htm

c:\windows\system32\cache329\t_B_704800.htm

c:\windows\system32\cache329\t_B_705100.htm

c:\windows\system32\cache329\t_B_753400.htm

c:\windows\system32\cache329\t_B_791300.htm

c:\windows\system32\critical_warning.html

c:\windows\system32\fosutozi.dll

c:\windows\system32\gabowuto.dll.tmp

c:\windows\system32\logon.exe

c:\windows\system32\lolajeyo.dll

c:\windows\system32\nusoyeta.dll

c:\windows\system32\tatiberu.dll.tmp

c:\windows\system32\tudotipi.dll

c:\windows\system32\warosami.dll.tmp

c:\windows\system32\winhelper86.dll

c:\windows\system32\wininit.dll

c:\windows\system32\winlogon86.exe

c:\windows\system32\winupdate86.exe

c:\windows\system32\zudeyuwi.dll

c:\windows\Tasks\maacwtqs.job

.

((((((((((((((((((((((((( Files Created from 2009-11-23 to 2009-12-23 )))))))))))))))))))))))))))))))

.

2009-12-22 12:11 . 2009-12-03 22:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-22 12:11 . 2009-12-03 22:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-22 12:11 . 2009-12-22 12:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-12-22 00:46 . 2009-12-22 00:46 97792 ----a-w- c:\windows\system32\ULISSvPFvF.dll

2009-12-20 10:37 . 2009-12-20 10:37 -------- d--h--w- c:\windows\PIF

2009-12-19 13:14 . 2009-12-19 13:14 552 ----a-w- c:\windows\system32\d3d8caps.dat

2009-12-02 22:49 . 2009-12-02 22:50 -------- dc----w- C:\holiday card 3

2009-11-26 00:40 . 2009-11-26 00:40 -------- dc----w- C:\nov 25, 2009

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-23 02:52 . 2009-04-20 22:32 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype

2009-12-23 01:55 . 2009-04-04 06:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-12-20 20:54 . 2009-02-05 22:56 7912 ----a-w- c:\windows\system32\d3d9caps.dat

2009-12-14 12:50 . 2009-11-25 09:25 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-11-22 18:00 . 2008-11-23 19:47 -------- d-----w- c:\program files\Veetle

2009-11-20 02:49 . 2006-05-05 03:42 223672 -c-ha-w- c:\windows\system32\mlfcache.dat

2009-11-06 21:01 . 2009-11-06 21:01 188928 ----a-w- c:\documents and settings\Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll

2009-11-02 01:01 . 2004-10-30 06:47 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer

2009-11-02 00:39 . 2009-11-02 00:37 -------- d-----w- c:\program files\iTunes

2009-11-02 00:39 . 2009-11-02 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-11-02 00:38 . 2004-10-30 06:47 -------- d-----w- c:\program files\iPod

2009-11-02 00:38 . 2007-08-17 00:23 -------- d-----w- c:\program files\Common Files\Apple

2009-11-02 00:36 . 2009-11-02 00:35 -------- d-----w- c:\program files\QuickTime

2009-10-29 05:48 . 2004-08-04 12:00 662016 ----a-w- c:\windows\system32\wininet.dll

2009-10-29 02:58 . 2009-10-29 02:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2009-10-24 19:15 . 2004-09-23 21:55 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-21 06:00 . 2004-08-04 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 06:00 . 2004-08-04 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 14:58 . 2004-08-04 12:00 263552 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-13 10:53 . 2004-08-04 12:00 266752 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:54 . 2004-08-04 12:00 69632 ----a-w- c:\windows\system32\raschap.dll

2009-10-12 13:54 . 2004-08-04 12:00 112128 ----a-w- c:\windows\system32\rastls.dll

2009-09-25 05:56 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll

2006-09-27 02:46 . 2006-09-26 22:07 152 --sha-r- c:\windows\system32\2F0320EBFA.dll

2006-04-03 15:50 . 2005-10-29 04:50 104 --sha-r- c:\windows\system32\2F0320EBFA.sys

2009-09-22 01:03 . 2009-09-22 01:03 92160 --sha-w- c:\windows\system32\doriyubi.dll

2008-05-16 04:01 . 2005-10-29 04:40 4184 -csha-w- c:\windows\system32\KGyGaAvL.sys

2009-09-20 13:36 . 2009-09-20 13:36 51712 --sha-w- c:\windows\system32\lizasaja.dll

2009-09-20 01:36 . 2009-09-20 01:36 39424 --sha-w- c:\windows\system32\mahagiyu.dll

2009-09-23 01:55 . 2009-09-23 01:55 92160 --sha-w- c:\windows\system32\mazileve.dll

2009-09-22 01:03 . 2009-09-22 01:03 61440 --sha-w- c:\windows\system32\mivojova.dll

2009-09-20 13:36 . 2009-09-20 13:36 39424 --sha-w- c:\windows\system32\ruyupuno.dll

2009-09-21 01:36 . 2009-09-21 01:36 92160 --sha-w- c:\windows\system32\sadokike.dll

2009-09-20 13:36 . 2009-09-20 13:36 51712 --sha-w- c:\windows\system32\wibotelo.dll

2009-09-20 01:36 . 2009-09-20 01:36 93184 --sha-w- c:\windows\system32\yaladuri.dll

2009-09-20 13:36 . 2009-09-20 13:36 94208 --sha-w- c:\windows\system32\yudegoku.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{976be64d-2a63-482c-b389-eb86607128c9}]

2009-09-20 13:36 51712 --sha-w- c:\windows\system32\wibotelo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SansaDispatch"="c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2008-12-06 79872]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]

"IntelliType"="c:\program files\Microsoft Hardware\Keyboard\type32.exe" [2001-06-12 69632]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"VTTimer"="VTTimer.exe" [2005-03-08 53248]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-21 148888]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]

"vorigarup"="c:\windows\system32\doriyubi.dll" [2009-09-22 92160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Event Planner Reminder.lnk - c:\program files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe [2005-8-30 25896]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe [2009-8-26 1634304]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{f79e15ba-5c4e-475f-8695-ead91ac3fbb9}"= "c:\windows\system32\doriyubi.dll" [2009-09-22 92160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"gitimeyaw"= {f79e15ba-5c4e-475f-8695-ead91ac3fbb9} - c:\windows\system32\doriyubi.dll [2009-09-22 92160]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk

backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

2009-02-03 13:22 1004544 ----a-w- c:\program files\Ares\Ares.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DACSMiniApp]

2008-03-13 18:05 128256 -c--a-w- c:\program files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dwStart]

2004-08-05 01:13 405504 -c--a-w- c:\program files\PCSecurityShield\The Shield Firewall\FireWall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2008-11-16 21:50 133104 ----atw- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-10-29 02:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]

2008-06-09 16:16 2363392 -c--a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

2006-03-30 21:45 313472 -c--a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

"c:\\Program Files\\TVAnts\\Tvants.exe"=

"c:\\Program Files\\Ares\\Ares.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\Ralink\Common\RalinkRegistryWriter.exe [8/26/2009 3:49 PM 75040]

R3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [8/24/2006 4:44 AM 477696]

S2 gupdate1c9b4ecb122e84a;Google Update Service (gupdate1c9b4ecb122e84a);c:\program files\Google\Update\GoogleUpdate.exe [4/4/2009 12:14 AM 133104]

S3 athrusb;Wireless LAN USB device driver;c:\windows\system32\drivers\athrusb.sys [7/14/2008 5:31 PM 446976]

S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [7/19/2008 8:31 AM 20608]

S3 FarStoneFireWallDrive;FarStoneFireWallDrive;c:\windows\system32\drivers\FarDrive.sys [5/19/2004 10:53 PM 142169]

S3 PhSerUsb;PHILOG USB Serial Driver;c:\windows\system32\drivers\PhSerUsb.sys [6/29/2006 5:20 PM 48896]

S3 RAPIProtocol;Ralink RAPI Protocol Driver;c:\windows\system32\drivers\RAPIProtocol.sys [8/26/2009 3:49 PM 16512]

S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/21/2009 7:38 PM 644096]

S3 u2kg54;BUFFALO WLI-U2-KG54 Wireless LAN Adapter Service;c:\windows\system32\drivers\rt2500usb.sys [6/9/2008 7:49 PM 104320]

S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 16:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dogpile.com/

uSearch Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\PlaySushi\PSText.dll

LSP: c:\windows\system32\ULISSvPFvF.dll

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\snfg2ydz.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Veetle\Player\npvlc.dll

FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

HKCU-Run-Internet Security 2010 - c:\program files\InternetSecurity2010\IS2010.exe

HKLM-Run-POINTER - point32.exe

HKLM-Run-mijarorevo - bokenayo.dll

HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe

SharedTaskScheduler-{4ec3e989-8fdd-4fc0-bd0d-60284cd40d15} - c:\windows\system32\zudeyuwi.dll

SharedTaskScheduler-{8299c28c-711c-405b-96f3-134ad57fed0e} - c:\windows\system32\zudeyuwi.dll

SharedTaskScheduler-{df775481-ea70-4450-a999-a905f555122a} - c:\windows\system32\zudeyuwi.dll

SSODL-kasoyasaj-{4ec3e989-8fdd-4fc0-bd0d-60284cd40d15} - c:\windows\system32\zudeyuwi.dll

SSODL-bihosibir-{8299c28c-711c-405b-96f3-134ad57fed0e} - c:\windows\system32\zudeyuwi.dll

SSODL-tagurudef-{df775481-ea70-4450-a999-a905f555122a} - c:\windows\system32\zudeyuwi.dll

AddRemove-CareBearsDKey - c:\program files\ValuSoft\CareBears\DeIsL1.isu

AddRemove-Playsushi - c:\program files\PlaySushi\psuninst.exe

AddRemove-_{91CABF8F-A81C-4CB0-A1B0-D55B25F1B150} - c:\program files\Corel\Corel Painter X\MSILauncher {91CABF8F-A81C-4CB0-A1B0-D55B25F1B150}

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-22 20:51

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SansaDispatch = c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?.lnk?tform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_conten

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(652)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4040)

c:\windows\system32\doriyubi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\msi.dll

c:\windows\system32\shdoclc.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\PSIService.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\wscntfy.exe

c:\program files\Microsoft Hardware\Mouse\point32.exe

c:\windows\system32\VTTimer.exe

c:\program files\Microsoft ActiveSync\wcescomm.exe

c:\progra~1\MI3AA1~1\rapimgr.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2009-12-22 21:05:19 - machine was rebooted

ComboFix-quarantined-files.txt 2009-12-23 03:05

Pre-Run: 9,363,369,984 bytes free

Post-Run: 9,173,590,016 bytes free

- - End Of File - - 9F2A454C66FFBBB1471863853E76C24A

Link to post
Share on other sites

HiJack This! Forum Policy

We will not be party to obvious use of key gens, cracks, warez or other illegal means of downloading software, music, videos ect. This means no P2P evidence will be supported. Logs that show these in them, will given the option to remove the P2P items. Keygens, cracks, warez and similar will have the thread closed period. It's theft and against the law.

Please remove Ares before proceeding.

You can do this via add\remove programs.

=============================

1. Open notepad and copy/paste the text in the codebox below into it:

http://www.malwarebytes.org/forums/index.php?showtopic=34245

Collect::
c:\windows\system32\doriyubi.dll
c:\windows\system32\lizasaja.dll
c:\windows\system32\mahagiyu.dll
c:\windows\system32\mazileve.dll
c:\windows\system32\mivojova.dll
c:\windows\system32\ruyupuno.dll
c:\windows\system32\sadokike.dll
c:\windows\system32\wibotelo.dll
c:\windows\system32\yaladuri.dll
c:\windows\system32\yudegoku.dll

Save this as CFScript.txt

CFScriptB-4.gif

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

  • Ensure you are connected to the internet and click OK on the message box.
  • A browser will open.
  • Simply follow the instructions to copy/paste/send the requested file.

===========

Note::

If Combofix fails to upload anything please do the following:

Go to Start > My Computer > C:\

Then Navigate to C:\Qoobox\Quarantine\[4]-Submit_Date_Time.zip

Click Here to upload the submit.zip please.

Link to post
Share on other sites

After the first time I ran combofix, malwarebytes opened so I ran that. Sorry if I wasn't supposed to do that.

Here is the Malwarebytes log:

Malwarebytes' Anti-Malware 1.42

Database version: 3413

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

12/23/2009 6:28:37 AM

mbam-log-2009-12-23 (06-28-37).txt

Scan type: Full Scan (C:\|I:\|)

Objects scanned: 291791

Time elapsed: 1 hour(s), 53 minute(s), 49 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 3

Registry Values Infected: 3

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 43

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\system32\doriyubi.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{976be64d-2a63-482c-b389-eb86607128c9} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{976be64d-2a63-482c-b389-eb86607128c9} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{f79e15ba-5c4e-475f-8695-ead91ac3fbb9} (Trojan.Vundo.H) -> Delete on reboot.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vorigarup (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{f79e15ba-5c4e-475f-8695-ead91ac3fbb9} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\gitimeyaw (Trojan.Vundo.H) -> Delete on reboot.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\doriyubi.dll -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\doriyubi.dll -> Delete on reboot.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\wibotelo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\doriyubi.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\lizasaja.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mahagiyu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mazileve.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mivojova.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ruyupuno.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\sadokike.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yaladuri.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yudegoku.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP39\A0022513.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP39\A0023514.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0023523.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0023532.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0023569.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0023570.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0023571.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0024532.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0024534.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0024543.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP40\A0024545.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0024554.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0024557.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0025554.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026554.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026576.exe (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026625.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026626.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026631.dll (Trojan.Fakeinit) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026632.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026665.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\C9MNKD6J\exe[1].exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\InternetSecurity2010\IS2010.exe.vir (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\bawayeka.dll.vir (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\bokenayo.dll.vir (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\gabowuto.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\tatiberu.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\warosami.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\winhelper86.dll.vir (Trojan.Fakeinit) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\winlogon86.exe.vir (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\winupdate86.exe.vir (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Local.dtd (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Ui.dtd (Malware.Trace) -> Quarantined and deleted successfully.

Link to post
Share on other sites

Okay so I just finished running the code you sent in combofix here is the log:

ComboFix 09-12-21.08 - Owner 12/23/2009 7:10.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.200 [GMT -6:00]

Running from: c:\documents and settings\Owner\Desktop\kahdah.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\wininit.dll

I:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2009-11-23 to 2009-12-23 )))))))))))))))))))))))))))))))

.

2009-12-22 12:11 . 2009-12-03 22:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-22 12:11 . 2009-12-03 22:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-22 12:11 . 2009-12-23 03:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-12-22 00:46 . 2009-12-22 00:46 97792 ----a-w- c:\windows\system32\ULISSvPFvF.dll

2009-12-20 10:37 . 2009-12-20 10:37 -------- d--h--w- c:\windows\PIF

2009-12-19 13:14 . 2009-12-19 13:14 552 ----a-w- c:\windows\system32\d3d8caps.dat

2009-12-02 22:49 . 2009-12-02 22:50 -------- dc----w- C:\holiday card 3

2009-11-26 00:40 . 2009-11-26 00:40 -------- dc----w- C:\nov 25, 2009

2009-11-25 09:25 . 2009-12-14 12:50 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-23 12:52 . 2009-04-20 22:32 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype

2009-12-23 01:55 . 2009-04-04 06:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-12-20 20:54 . 2009-02-05 22:56 7912 ----a-w- c:\windows\system32\d3d9caps.dat

2009-11-22 18:00 . 2008-11-23 19:47 -------- d-----w- c:\program files\Veetle

2009-11-20 02:49 . 2006-05-05 03:42 223672 -c-ha-w- c:\windows\system32\mlfcache.dat

2009-11-06 21:01 . 2009-11-06 21:01 188928 ----a-w- c:\documents and settings\Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll

2009-11-02 01:01 . 2004-10-30 06:47 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer

2009-11-02 00:39 . 2009-11-02 00:37 -------- d-----w- c:\program files\iTunes

2009-11-02 00:39 . 2009-11-02 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-11-02 00:38 . 2004-10-30 06:47 -------- d-----w- c:\program files\iPod

2009-11-02 00:38 . 2007-08-17 00:23 -------- d-----w- c:\program files\Common Files\Apple

2009-11-02 00:36 . 2009-11-02 00:35 -------- d-----w- c:\program files\QuickTime

2009-10-29 05:48 . 2004-08-04 12:00 662016 ------w- c:\windows\system32\wininet.dll

2009-10-29 02:58 . 2009-10-29 02:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2009-10-24 19:15 . 2004-09-23 21:55 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-10-21 06:00 . 2004-08-04 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 06:00 . 2004-08-04 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 14:58 . 2004-08-04 12:00 263552 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-13 10:53 . 2004-08-04 12:00 266752 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:54 . 2004-08-04 12:00 69632 ----a-w- c:\windows\system32\raschap.dll

2009-10-12 13:54 . 2004-08-04 12:00 112128 ----a-w- c:\windows\system32\rastls.dll

2009-09-25 05:56 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll

2006-09-27 02:46 . 2006-09-26 22:07 152 --sha-r- c:\windows\system32\2F0320EBFA.dll

2006-04-03 15:50 . 2005-10-29 04:50 104 --sha-r- c:\windows\system32\2F0320EBFA.sys

2008-05-16 04:01 . 2005-10-29 04:40 4184 -csha-w- c:\windows\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SansaDispatch"="c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2008-12-06 79872]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]

"IntelliType"="c:\program files\Microsoft Hardware\Keyboard\type32.exe" [2001-06-12 69632]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"VTTimer"="VTTimer.exe" [2005-03-08 53248]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-21 148888]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Event Planner Reminder.lnk - c:\program files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe [2005-8-30 25896]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe [2009-8-26 1634304]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk

backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DACSMiniApp]

2008-03-13 18:05 128256 -c--a-w- c:\program files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dwStart]

2004-08-05 01:13 405504 -c--a-w- c:\program files\PCSecurityShield\The Shield Firewall\FireWall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2008-11-16 21:50 133104 ----atw- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-10-29 02:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]

2008-06-09 16:16 2363392 -c--a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

2006-03-30 21:45 313472 -c--a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

"c:\\Program Files\\TVAnts\\Tvants.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\Ralink\Common\RalinkRegistryWriter.exe [8/26/2009 3:49 PM 75040]

R3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [8/24/2006 4:44 AM 477696]

S2 gupdate1c9b4ecb122e84a;Google Update Service (gupdate1c9b4ecb122e84a);c:\program files\Google\Update\GoogleUpdate.exe [4/4/2009 12:14 AM 133104]

S3 athrusb;Wireless LAN USB device driver;c:\windows\system32\drivers\athrusb.sys [7/14/2008 5:31 PM 446976]

S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [7/19/2008 8:31 AM 20608]

S3 FarStoneFireWallDrive;FarStoneFireWallDrive;c:\windows\system32\drivers\FarDrive.sys [5/19/2004 10:53 PM 142169]

S3 PhSerUsb;PHILOG USB Serial Driver;c:\windows\system32\drivers\PhSerUsb.sys [6/29/2006 5:20 PM 48896]

S3 RAPIProtocol;Ralink RAPI Protocol Driver;c:\windows\system32\drivers\RAPIProtocol.sys [8/26/2009 3:49 PM 16512]

S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/21/2009 7:38 PM 644096]

S3 u2kg54;BUFFALO WLI-U2-KG54 Wireless LAN Adapter Service;c:\windows\system32\drivers\rt2500usb.sys [6/9/2008 7:49 PM 104320]

S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 16:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dogpile.com/

uSearch Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\PlaySushi\PSText.dll

LSP: c:\windows\system32\ULISSvPFvF.dll

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\snfg2ydz.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Veetle\Player\npvlc.dll

FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ares - c:\program files\Ares\Ares.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-23 07:20

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SansaDispatch = c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?.lnk?tform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_conten

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(656)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-12-23 07:24:38

ComboFix-quarantined-files.txt 2009-12-23 13:24

ComboFix2.txt 2009-12-23 03:05

Pre-Run: 9,141,927,936 bytes free

Post-Run: 9,115,074,560 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /noexecute=optin

- - End Of File - - 56ACC2FBF661C5D1D75F4278A9DE583E

Link to post
Share on other sites

Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.

  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

Link to post
Share on other sites

KASPERSKY ONLINE SCANNER 7.0: scan report

Wednesday, December 23, 2009

Operating system: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Wednesday, December 23, 2009 18:09:47

Records in database: 3404437

Scan settings

scan using the following database extended

Scan archives yes

Scan e-mail databases yes

Scan area My Computer

A:\

C:\

D:\

E:\

I:\

Scan statistics

Objects scanned 167881

Threats found 13

Infected objects found 22

Suspicious objects found 0

Scan duration 05:57:31

File name Threat Threats count

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\5facab1f-5ad921e7 Infected: Trojan-Downloader.Java.OpenConnection.ap 1

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\5facab1f-75b5bcd8 Infected: Trojan-Downloader.Java.OpenConnection.ap 1

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\50\2ce40a72-35d73af9 Infected: Trojan-Downloader.Java.OpenConnection.ap 1

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\50\2ce40a72-6006b500 Infected: Trojan-Downloader.Java.OpenConnection.ap 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\critical_warning.html.vir Infected: Trojan.JS.Hoax.b 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\fosutozi.dll.vir Infected: Trojan.Win32.Monder.cvpj 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\lolajeyo.dll.vir Infected: Trojan.Win32.Monder.cvqs 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\nusoyeta.dll.vir Infected: Trojan.Win32.Monder.cvqe 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\_logon_.exe.zip Infected: Trojan.Win32.Vilsel.pqd 1

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026628.dll Infected: Trojan.Win32.Monder.cvpj 1

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026629.dll Infected: Trojan.Win32.Monder.cvqs 1

C:\System Volume Information\_restore{6588E4C1-2551-4389-B877-3C5A50F92FD7}\RP41\A0026630.dll Infected: Trojan.Win32.Monder.cvqe 1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CL2VGTQR\102[1].exe Infected: Trojan.Win32.Swisyn.srb 1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OHU3GH2F\102[1].exe Infected: Trojan.Win32.Swisyn.srb 1

I:\funny shows\because you love me instrumental.wmv Infected: Trojan-Downloader.WMA.Wimad.t 1

I:\Incomplete\T-3545425-better.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1

I:\LimeWire\big girls dont cry.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

I:\LimeWire\lost boys golden girls 192kb.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1

I:\LimeWire\my name is christmas carol.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

I:\music downloads\blue october independently happy live.wm Infected: Trojan-Downloader.WMA.Wimad.m 1

I:\music downloads\garbage as heaven is wide.wm Infected: Trojan-Downloader.WMA.Wimad.m 1

I:\My Documents\Preston\Little_Shop_of_Treasures_msgh-setup.exe Infected: Trojan.Win32.Inject.tqm 1

Selected area has been scanned.

Link to post
Share on other sites

HiJack This! Forum Policy

We will not be party to obvious use of key gens, cracks, warez or other illegal means of downloading software, music, videos ect. This means no P2P evidence will be supported. Logs that show these in them, will given the option to remove the P2P items. Keygens, cracks, warez and similar will have the thread closed period. It's theft and against the law.
In your case it is Limewire.

Alot of infections were found in that folder.

==========================

Please download OTM

  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    :Files
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\5facab1f-5ad921e7
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\5facab1f-75b5bcd8
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\50\2ce40a72-35d73af9
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\50\2ce40a72-6006b500
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CL2VGTQR
    C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OHU3GH2F
    I:\funny shows\because you love me instrumental.wmv
    I:\Incomplete\T-3545425-better.mp3
    I:\LimeWire\big girls dont cry.mp3
    I:\LimeWire\lost boys golden girls 192kb.mp3
    I:\LimeWire\my name is christmas carol.mp3
    I:\music downloads\blue october independently happy live.wm
    I:\music downloads\garbage as heaven is wide.wm
    I:\My Documents\Preston\Little_Shop_of_Treasures_msgh-setup.exe


    :Commands
    [emptytemp]


  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

=======================================

Please download DDS and save it to your desktop.

  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open as well as attach.txt.
  • Save both reports to your desktop.

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

attach.txt

Link to post
Share on other sites

I completed the uninstall of Limewire after running OTM so that it would not affect your code.

All processes killed

========== FILES ==========

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\5facab1f-5ad921e7 moved successfully.

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\5facab1f-75b5bcd8 moved successfully.

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\50\2ce40a72-35d73af9 moved successfully.

C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\50\2ce40a72-6006b500 moved successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CL2VGTQR folder moved successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OHU3GH2F folder moved successfully.

I:\funny shows\because you love me instrumental.wmv moved successfully.

I:\Incomplete\T-3545425-better.mp3 moved successfully.

I:\LimeWire\big girls dont cry.mp3 moved successfully.

I:\LimeWire\lost boys golden girls 192kb.mp3 moved successfully.

I:\LimeWire\my name is christmas carol.mp3 moved successfully.

I:\music downloads\blue october independently happy live.wm moved successfully.

I:\music downloads\garbage as heaven is wide.wm moved successfully.

I:\My Documents\Preston\Little_Shop_of_Treasures_msgh-setup.exe moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 376899 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Owner

->Temp folder emptied: 92905638 bytes

->Temporary Internet Files folder emptied: 9781449 bytes

->Java cache emptied: 121073773 bytes

->FireFox cache emptied: 87982929 bytes

->Google Chrome cache emptied: 86845699 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 3346091 bytes

%systemroot%\System32 .tmp files removed: 5528081 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 43128 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 389.00 mb

OTM by OldTimer - Version 3.1.3.0 log created on 12232009_233004

Files moved on Reboot...

Registry entries deleted on Reboot...

Link to post
Share on other sites

.txt posted, attach attached

DDS (Ver_09-12-01.01) - NTFSx86

Run by Owner at 23:39:14.60 on Wed 12/23/2009

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_12

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.46 [GMT -6:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PSIService.exe

C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Microsoft Hardware\Keyboard\type32.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\VTTimer.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Documents and Settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe

C:\Program Files\Ralink\Common\RaUI.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Java\jre6\bin\java.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dogpile.com/

uSearch Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: EyeOnIE Class: {316aef8d-3c37-423e-9e6e-13820a9dc37a} - c:\progra~1\pcsecu~1\theshi~1\IrlOnIE.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll

BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: PopupBlocker Class: {e22f9b9d-1a1f-473e-bed6-d8bc152441f4} - c:\progra~1\pcsecu~1\theshi~1\FARPOP~1.DLL

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File

TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

TB: {119DBEDA-9C41-4F97-94B4-B6BCD01133CF} - No File

TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"

uRun: [sansaDispatch] c:\documents and settings\owner\application data\sandisk\sansa updater\SansaDispatch.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"

mRun: [intelliType] "c:\program files\microsoft hardware\keyboard\type32.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [VTTimer] VTTimer.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 6.0\apdproxy.exe"

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\eventp~1.lnk - c:\program files\creative home\hallmark card studio 2006\planner\PLNRnote.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ralink~1.lnk - c:\program files\ralink\common\RaUI.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\playsushi\PSText.dll

LSP: c:\windows\system32\ULISSvPFvF.dll

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} - hxxp://forms.real.com/real/player/download.html?f=windows/mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab

DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab

DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.snapfish.com/SnapfishActivia.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095969599519

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} - hxxp://web1.shutterfly.com/downloads/Uploader.cab

DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} - hxxp://hgtv3.view22.com/view22/app/view22rte.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98}

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} - hxxp://www.scrapbookpictures.com/ImageUploader4.cab

Notify: AtiExtEvent - Ati2evxx.dll

Notify: WRNotifier - WRLogonNTF.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\snfg2ydz.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RalinkRegistryWriter.exe [2009-8-26 75040]

R3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [2006-8-24 477696]

S2 gupdate1c9b4ecb122e84a;Google Update Service (gupdate1c9b4ecb122e84a);c:\program files\google\update\GoogleUpdate.exe [2009-4-4 133104]

S3 athrusb;Wireless LAN USB device driver;c:\windows\system32\drivers\athrusb.sys [2008-7-14 446976]

S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [2008-7-19 20608]

S3 FarStoneFireWallDrive;FarStoneFireWallDrive;c:\windows\system32\drivers\FarDrive.sys [2004-5-19 142169]

S3 PhSerUsb;PHILOG USB Serial Driver;c:\windows\system32\drivers\PhSerUsb.sys [2006-6-29 48896]

S3 RAPIProtocol;Ralink RAPI Protocol Driver;c:\windows\system32\drivers\RAPIProtocol.sys [2009-8-26 16512]

S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2009-8-21 644096]

S3 u2kg54;BUFFALO WLI-U2-KG54 Wireless LAN Adapter Service;c:\windows\system32\drivers\rt2500usb.sys [2008-6-9 104320]

S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\zdcndis5.sys --> c:\windows\system32\ZDCndis5.SYS [?]

=============== Created Last 30 ================

2009-12-24 05:30:04 0 dc----w- C:\_OTM

2009-12-23 13:25:18 744 ----a-w- c:\windows\system32\wininit.dll

2009-12-23 13:01:22 0 dcsha-r- C:\cmdcons

2009-12-23 02:04:01 98816 ----a-w- c:\windows\sed.exe

2009-12-23 02:04:01 77312 ----a-w- c:\windows\MBR.exe

2009-12-23 02:04:01 261632 ----a-w- c:\windows\PEV.exe

2009-12-23 02:04:01 161792 ----a-w- c:\windows\SWREG.exe

2009-12-22 12:11:17 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-22 12:11:15 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-22 12:11:14 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-12-22 00:46:20 97792 ----a-w- c:\windows\system32\ULISSvPFvF.dll

2009-12-20 10:37:09 0 d--h--w- c:\windows\PIF

2009-12-19 13:14:02 552 ----a-w- c:\windows\system32\d3d8caps.dat

2009-12-02 22:49:56 0 dc----w- C:\holiday card 3

2009-11-26 00:40:13 0 dc----w- C:\nov 25, 2009

==================== Find3M ====================

2009-12-24 05:35:52 7912 ----a-w- c:\windows\system32\d3d9caps.dat

2009-11-20 02:49:04 223672 -c-ha-w- c:\windows\system32\mlfcache.dat

2009-10-29 05:48:04 662016 ------w- c:\windows\system32\wininet.dll

2009-10-21 06:00:55 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 06:00:55 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-13 10:53:29 266752 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:54:17 69632 ----a-w- c:\windows\system32\raschap.dll

2009-10-12 13:54:17 112128 ----a-w- c:\windows\system32\rastls.dll

2009-09-25 05:56:32 81920 ----a-w- c:\windows\system32\ieencode.dll

2006-09-27 02:46:14 152 --sha-r- c:\windows\system32\2F0320EBFA.dll

2006-04-03 15:50:32 104 --sha-r- c:\windows\system32\2F0320EBFA.sys

2008-05-16 04:01:00 4184 -csha-w- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 23:40:16.50 ===============

Attach.zip

Link to post
Share on other sites

Does it happen only with FIrefox?

Please download GooredFix from one of the locations below and save it to your Desktop

Download Mirror #1

Download Mirror #2

  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  • When prompted to run the scan, click Yes.
  • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

Link to post
Share on other sites

I use Firefox 90% of the time, but I haven't had it happen once with Chrome (I never use IE). Here is the log. Again, thank you soooo much.

GooredFix by jpshortstuff (06.12.09.1)

Log created at 10:48 on 24/12/2009 (Owner)

Firefox version 3.5.6 (en-US)

========== GooredScan ==========

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\

{972ce4c6-7e08-4474-a285-3208198ce6fd} [21:56 02/01/2007]

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [04:54 21/03/2008]

C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\snfg2ydz.default\extensions\

{20a82645-c095-46ed-80e3-08825760534b} [12:27 01/10/2009]

{517ca167-b6e8-4397-a0b4-a0074bbe3d5b} [23:58 19/12/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [12:56 21/03/2009]

"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [23:03 13/08/2009]

-=E.O.F=-

Link to post
Share on other sites

Please submit the following file to one of these online file scanners.

(All you have to do is copy and paste the file path into the box when you click on Browse then once you have done that click on the open button then submit)

c:\windows\system32\ULISSvPFvF.dll

Jotti File Scan
VirusTotal File Scan

This will produce a report after the scan is complete, please copy and paste those results in your next post.

You are welcome :)

Link to post
Share on other sites

[ArcaVir]

2009-12-28 Found nothing

[F-Secure Anti-Virus]

2009-12-28 Found nothing

[A-Squared]

2009-12-29 Trojan.Win32.Alureon!IK

[G DATA]

2009-12-28 Trojan.Generic.2874687

[Avast! antivirus]

2009-12-27 Win32:Malware-gen

[ikarus]

2009-12-29 Trojan.Win32.Alureon

[Grisoft AVG Anti-Virus]

2009-12-28 Generic16.AIL

[Kaspersky Anti-Virus]

2009-12-29 Found nothing

[Avira AntiVir]

2009-12-28 TR/Crypt.ZPACK.Gen

[ESET NOD32]

2009-12-28 Win32/Kryptik.BP

[softwin BitDefender]

2009-12-26 Trojan.Generic.2874687

[Panda Antivirus]

2009-12-28 Generic

[ClamAV]

2009-12-29 Found nothing

[Quick Heal]

2009-12-28 Trojan.Agent.ATV

[CPsecure]

2009-12-29 Found nothing

[sophos]

2009-12-29 Found nothing

[Dr.Web]

2009-12-28 Found nothing

[VirusBlokAda VBA32]

2009-12-28 Found nothing

[Frisk F-Prot Antivirus]

2009-12-28 Found nothing

[VirusBuster]

2009-12-28 Found nothing

Link to post
Share on other sites

I would like for you to submit that file for me please.

I will need to you show hidden files\folders so we can find the file.

To Set:

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK

Now: using Windows Explorer (to get there right-click your Start button and go to "Explore")

Then navigate to the below location and upload the following file.

c:\windows\system32\ULISSvPFvF.dll

Click Here to upload the file please.

Make sure to leave a link to this thread and write "found in LSP stack" in the details box.

Thank you.

Let me know when you have done this and we can continue.

Link to post
Share on other sites

1. Please open Notepad

  • Click Start , then Run
  • type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\ULISSvPFvF.dll

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScriptB-4.gif

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

  • Combofix.txt

=============

Also surf like normal then let me know if the redirects have stopped.

Link to post
Share on other sites

ComboFix 09-12-21.08 - Owner 12/29/2009 18:22:47.3.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.479.111 [GMT -6:00]

Running from: c:\documents and settings\Owner\Desktop\kahdah.exe

Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt

FILE ::

"c:\windows\system32\ULISSvPFvF.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\ULISSvPFvF.dll

c:\windows\system32\wininit.dll

.

((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-30 )))))))))))))))))))))))))))))))

.

2009-12-24 05:30 . 2009-12-24 05:30 -------- dc----w- C:\_OTM

2009-12-22 12:11 . 2009-12-03 22:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-22 12:11 . 2009-12-03 22:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-22 12:11 . 2009-12-23 03:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-12-20 10:37 . 2009-12-20 10:37 -------- d--h--w- c:\windows\PIF

2009-12-19 13:14 . 2009-12-19 13:14 552 ----a-w- c:\windows\system32\d3d8caps.dat

2009-12-02 22:49 . 2009-12-02 22:50 -------- dc----w- C:\holiday card 3

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-30 00:36 . 2009-04-20 22:32 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype

2009-12-29 12:22 . 2009-02-05 22:56 7912 ----a-w- c:\windows\system32\d3d9caps.dat

2009-12-24 05:36 . 2008-04-19 02:06 -------- d-----w- c:\program files\LimeWire

2009-12-23 01:55 . 2009-04-04 06:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-12-14 12:50 . 2009-11-25 09:25 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-11-22 18:00 . 2008-11-23 19:47 -------- d-----w- c:\program files\Veetle

2009-11-20 02:49 . 2006-05-05 03:42 223672 -c-ha-w- c:\windows\system32\mlfcache.dat

2009-11-06 21:01 . 2009-11-06 21:01 188928 ----a-w- c:\documents and settings\Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll

2009-11-02 01:01 . 2004-10-30 06:47 -------- d-----w- c:\documents and settings\Owner\Application Data\Apple Computer

2009-11-02 00:39 . 2009-11-02 00:37 -------- d-----w- c:\program files\iTunes

2009-11-02 00:39 . 2009-11-02 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-11-02 00:38 . 2004-10-30 06:47 -------- d-----w- c:\program files\iPod

2009-11-02 00:38 . 2007-08-17 00:23 -------- d-----w- c:\program files\Common Files\Apple

2009-11-02 00:36 . 2009-11-02 00:35 -------- d-----w- c:\program files\QuickTime

2009-10-29 05:48 . 2004-08-04 12:00 662016 ------w- c:\windows\system32\wininet.dll

2009-10-29 02:58 . 2009-10-29 02:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2009-10-21 06:00 . 2004-08-04 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 06:00 . 2004-08-04 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 14:58 . 2004-08-04 12:00 263552 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-13 10:53 . 2004-08-04 12:00 266752 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:54 . 2004-08-04 12:00 69632 ----a-w- c:\windows\system32\raschap.dll

2009-10-12 13:54 . 2004-08-04 12:00 112128 ----a-w- c:\windows\system32\rastls.dll

2006-09-27 02:46 . 2006-09-26 22:07 152 --sha-r- c:\windows\system32\2F0320EBFA.dll

2006-04-03 15:50 . 2005-10-29 04:50 104 --sha-r- c:\windows\system32\2F0320EBFA.sys

2008-05-16 04:01 . 2005-10-29 04:40 4184 -csha-w- c:\windows\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SansaDispatch"="c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2008-12-06 79872]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]

"IntelliType"="c:\program files\Microsoft Hardware\Keyboard\type32.exe" [2001-06-12 69632]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"VTTimer"="VTTimer.exe" [2005-03-08 53248]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-21 148888]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Event Planner Reminder.lnk - c:\program files\Creative Home\Hallmark Card Studio 2006\Planner\PLNRnote.exe [2005-8-30 25896]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe [2009-8-26 1634304]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ZDWLan Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ZDWLan Utility.lnk

backup=c:\windows\pss\ZDWLan Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DACSMiniApp]

2008-03-13 18:05 128256 -c--a-w- c:\program files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dwStart]

2004-08-05 01:13 405504 -c--a-w- c:\program files\PCSecurityShield\The Shield Firewall\FireWall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2008-11-16 21:50 133104 ----atw- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-10-29 02:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]

2008-06-09 16:16 2363392 -c--a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

2006-03-30 21:45 313472 -c--a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

"c:\\Program Files\\TVAnts\\Tvants.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\Ralink\Common\RalinkRegistryWriter.exe [8/26/2009 3:49 PM 75040]

R3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [8/24/2006 4:44 AM 477696]

S2 gupdate1c9b4ecb122e84a;Google Update Service (gupdate1c9b4ecb122e84a);c:\program files\Google\Update\GoogleUpdate.exe [4/4/2009 12:14 AM 133104]

S3 athrusb;Wireless LAN USB device driver;c:\windows\system32\drivers\athrusb.sys [7/14/2008 5:31 PM 446976]

S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [7/19/2008 8:31 AM 20608]

S3 FarStoneFireWallDrive;FarStoneFireWallDrive;c:\windows\system32\drivers\FarDrive.sys [5/19/2004 10:53 PM 142169]

S3 PhSerUsb;PHILOG USB Serial Driver;c:\windows\system32\drivers\PhSerUsb.sys [6/29/2006 5:20 PM 48896]

S3 RAPIProtocol;Ralink RAPI Protocol Driver;c:\windows\system32\drivers\RAPIProtocol.sys [8/26/2009 3:49 PM 16512]

S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [8/21/2009 7:38 PM 644096]

S3 u2kg54;BUFFALO WLI-U2-KG54 Wireless LAN Adapter Service;c:\windows\system32\drivers\rt2500usb.sys [6/9/2008 7:49 PM 104320]

S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 16:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dogpile.com/

uSearch Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\PlaySushi\PSText.dll

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\snfg2ydz.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=SOLTDF&q=

FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Veetle\Player\npvlc.dll

FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-29 18:35

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SansaDispatch = c:\documents and settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?.lnk?tform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_conten

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(652)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2364)

c:\windows\system32\ieframe.dll

c:\windows\system32\shdoclc.dll

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\PSIService.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\VTTimer.exe

c:\program files\Microsoft ActiveSync\wcescomm.exe

c:\progra~1\MI3AA1~1\rapimgr.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2009-12-29 18:44:42 - machine was rebooted

ComboFix-quarantined-files.txt 2009-12-30 00:44

ComboFix2.txt 2009-12-23 13:24

ComboFix3.txt 2009-12-23 03:05

Pre-Run: 8,897,003,520 bytes free

Post-Run: 8,952,696,832 bytes free

- - End Of File - - DB9494AF56FDD558A11539F2E6490502

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.