Jump to content

Infected items keep coming back on reboot

spally
 Share

Recommended Posts

spally

spally

Posted
Posted

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

01/07/2010 10:03:47

mbam-log-2010-07-01 (10-03-47).txt

Scan type: Quick scan

Objects scanned: 132443

Time elapsed: 8 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 4

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdr8gdrgdrgke49orkgsjkjfjhsd (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Compaq_Administrator\Local Settings\Temp\svchost.exe (Trojan.Agent) -> Delete on reboot.

C:\Documents and Settings\Compaq_Administrator\Local Settings\Temp\iexplarer.exe (Trojan.Agent) -> Delete on reboot.

Hi, I have run the Malwarebytes quick scan several times over the last few days. Each time it finds the above listed items (especially the registry data items), quarantines them, requests that I reboot and then when I do and run another scan, the same infections are back again, please help, I dont know what else to do.

Stuart.

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Hello ,

And :) My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the runscanbutton.png button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
    gmer_zip.gif
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • GMER log

Link to post
Share on other sites
spally

spally

Posted
  • Author
Posted

Ok, I have just run the OTL scan and below is the log files. I'm now running the GMER and will post that log shortly.

OTL logfile created on: 01/07/2010 11:58:29 - Run 1

OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Compaq_Administrator\Desktop

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

958.00 Mb Total Physical Memory | 420.00 Mb Available Physical Memory | 44.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free

Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 142.31 Gb Total Space | 110.94 Gb Free Space | 77.96% Space Free | Partition Type: NTFS

Drive D: | 6.72 Gb Total Space | 0.91 Gb Free Space | 13.59% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: YOUR-E6F02835AE

Current User Name: Compaq_Administrator

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/01 11:57:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTL.exe

PRC - [2010/06/29 23:15:21 | 000,030,001 | -H-- | M] () -- C:\Documents and Settings\Compaq_Administrator\Local Settings\Temp\obd3xfi.exe

PRC - [2010/06/03 09:58:43 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe

PRC - [2010/06/03 09:58:42 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe

PRC - [2010/06/03 09:58:11 | 000,722,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe

PRC - [2010/06/03 09:58:10 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe

PRC - [2010/05/29 11:40:42 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

PRC - [2010/03/14 11:16:19 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe

PRC - [2010/03/14 11:15:46 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe

PRC - [2009/09/24 15:41:58 | 000,434,176 | ---- | M] (Sony Ericsson Mobile Communications AB) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

PRC - [2009/04/30 13:23:26 | 000,090,112 | ---- | M] () -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

PRC - [2008/05/10 07:15:28 | 000,282,624 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005/08/02 23:19:16 | 000,058,880 | ---- | M] (Microsoft) -- C:\WINDOWS\arservice.exe

PRC - [2001/01/19 04:00:00 | 000,068,608 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S10IC2.EXE

PRC - [2000/11/17 02:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

========== Modules (SafeList) ==========

MOD - [2010/07/01 11:57:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTL.exe

MOD - [2008/04/14 01:12:08 | 000,183,296 | ---- | M] () -- C:\WINDOWS\uzisiyovupomub.dll

MOD - [2008/04/14 01:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

MOD - [2006/05/03 22:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/03/14 11:16:19 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)

SRV - [2010/03/14 11:15:46 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)

SRV - [2009/04/30 13:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)

SRV - [2007/10/25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)

SRV - [2005/08/02 23:19:16 | 000,058,880 | ---- | M] (Microsoft) [Auto | Running] -- C:\WINDOWS\arservice.exe -- (ARSVC)

SRV - [2000/11/17 02:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)

========== Driver Services (SafeList) ==========

DRV - [2010/06/03 09:58:43 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)

DRV - [2010/06/03 09:58:43 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)

DRV - [2010/03/14 11:15:45 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)

DRV - [2009/06/23 11:01:42 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)

DRV - [2009/06/23 11:01:40 | 000,072,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2009/06/23 11:01:40 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2008/11/04 02:45:44 | 000,086,696 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018bus.sys -- (s1018bus) Sony Ericsson Device 1018 driver (WDM)

DRV - [2008/04/13 17:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008/01/09 13:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)

DRV - [2007/04/03 13:57:54 | 000,099,080 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116unic.sys -- (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM)

DRV - [2007/04/03 13:57:52 | 000,098,696 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116obex.sys -- (s116obex)

DRV - [2007/04/03 13:57:52 | 000,023,176 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116nd5.sys -- (s116nd5) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS)

DRV - [2007/04/03 13:57:50 | 000,100,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116mgmt.sys -- (s116mgmt) Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM)

DRV - [2007/04/03 13:57:48 | 000,108,680 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116mdm.sys -- (s116mdm)

DRV - [2007/04/03 13:57:48 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116mdfl.sys -- (s116mdfl)

DRV - [2007/04/03 13:57:42 | 000,083,336 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116bus.sys -- (s116bus) Sony Ericsson Device 116 driver (WDM)

DRV - [2006/07/25 00:15:04 | 004,353,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2006/07/24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\system32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2006/05/09 23:50:00 | 003,535,680 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2006/03/03 23:31:04 | 000,013,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)

DRV - [2006/03/03 23:31:02 | 000,034,176 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)

DRV - [2005/12/13 01:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)

DRV - [2005/06/29 17:03:18 | 000,175,104 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys -- (ftsata2)

DRV - [2005/03/09 22:53:00 | 000,036,352 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)

DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)

DRV - [2004/02/17 11:38:06 | 000,070,688 | R--- | M] (THOMSON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl)

DRV - [2003/12/08 11:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)

DRV - [2003/11/05 07:45:12 | 000,017,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\bb-run.sys -- (bb-run)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google

IE - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8

IE - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.co.uk/

IE - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()

IE - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

FF - HKLM\software\mozilla\Firefox\extensions\\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}: C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A} [2010/07/01 07:11:41 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2010/02/24 08:44:24 | 000,000,856 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.nandp.co.uk

O1 - Hosts: 127.0.0.1 https://ib04.npbs.co.uk/netmastergoldbankin...pass=24/02/2010

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (C:\WINDOWS\system32\p68dp.dll) - {C3BA40A2-75F1-52BD-F413-04B15A2C8953} - C:\WINDOWS\system32\p68dp.dll ()

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Wanadoo) - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\Program Files\Wanadoo\WSBar\WSBar.dll ()

O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()

O3 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()

O4 - HKLM..\Run: [Kzeri] C:\WINDOWS\uzisiyovupomub.DLL ()

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe File not found

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\Run: [{AA3D3CF4-CA41-5DD1-0008-DB8C03D93B1A}] C:\Documents and Settings\Compaq_Administrator\Application Data\Kayx\afew.exe ()

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\Run: [hsef87ehf3jishfs87fhuishfsgggfdgs4g] C:\Documents and Settings\Compaq_Administrator\Local Settings\Temp\obd3xfi.exe ()

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\Run: [Lhaboqo] C:\WINDOWS\mskcrof.DLL (MaresWEB)

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\Run: [MsnMsgr] C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe File not found

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\Run: [sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007..\RunOnce: [shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\4.0 ( File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (SEIKO EPSON CORPORATION)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)

O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)

O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\PinMcLnk.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2958882662-1534658899-24013403-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_20.dll (Sun Microsystems, Inc.)

O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()

O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2...78f/wvc1dmo.cab (Reg Error: Key error.)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} http://webalbum.bonusprint.com/ukipc01/dow...geUploader6.cab (Bonusprint Image Uploader Version 6.x Control)

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://skyonline.oberon-media.com/Gameshel...ronGameHost.cab (Oberon Flash Game Host)

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://3dlifeplayer.dl.3dvia.com/player/in...r_installer.exe (Virtools WebPlayer Class)

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} https://signin9.valueactive.com/Register/Br...018/flashax.cab (FlashXControl Object)

O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} http://wanadoouk.oberon-media.com/online/o...sh.1.0.0.80.cab (CPlayFirstDinerDashControl Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://bellerock.microgaming.com/freeplay/FlashAX2.cab (Flash Casino Helper Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

O22 - SharedTaskScheduler: {C3BA40A2-75F1-52BD-F413-04B15A2C8953} - jahs8973fioafnh98fasfw3gadfgjdsdf - C:\WINDOWS\system32\p68dp.dll ()

O22 - SharedTaskScheduler: ThreadingModel - Apartment - Reg Error: Key error. File not found

O24 - Desktop WallPaper: C:\WINDOWS

O24 - Desktop BackupWallPaper: C:\WINDOWS

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2001/07/27 08:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]

O32 - AutoRun File - [2004/04/30 00:01:14 | 000,000,053 | ---- | M] () - D:\Autorun.inf -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/01 11:58:03 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTL.exe

[2010/07/01 08:33:51 | 000,023,552 | ---- | C] (PunkTools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\MsnVirRem.exe

[2010/07/01 07:11:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}

[2010/06/30 12:15:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Administrator\Application Data\AVG9

[2010/06/30 11:26:52 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Virus Remover

[2010/06/30 11:01:35 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy

[2010/06/30 10:22:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Uniblue

[2010/06/30 10:22:45 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue

[2010/06/30 09:31:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Registry Patrol

[2010/06/30 09:30:37 | 000,000,000 | ---D | C] -- C:\Program Files\Registry Patrol

[2010/06/30 00:43:58 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010/06/30 00:01:04 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC

[2010/06/29 23:15:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\wigxpuacv

[2010/06/29 23:15:36 | 000,000,000 | ---D | C] -- C:\Program Files\$NtUninstallWTF1012$

[2010/06/27 10:28:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Administrator\Application Data\Doctor Who

[2010/06/27 10:26:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Doctor Who

[2010/06/27 10:25:34 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_5.dll

[2010/06/27 10:25:34 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_3.dll

[2010/06/27 10:25:33 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_5.dll

[2010/06/27 10:25:32 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_42.dll

[2010/06/27 10:25:31 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dcsx_42.dll

[2010/06/27 10:25:30 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx11_42.dll

[2010/06/27 10:25:29 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_42.dll

[2010/06/27 10:25:08 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_42.dll

[2010/06/27 10:24:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs

[2010/06/27 10:22:12 | 000,000,000 | ---D | C] -- C:\Program Files\Doctor Who - The Adventure Games

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/01 12:01:42 | 000,772,096 | ---- | M] () -- C:\WINDOWS\System32\drivers\bappijbk.sys

[2010/07/01 11:57:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\OTL.exe

[2010/07/01 11:17:53 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Pzolifuci.dat

[2010/07/01 11:05:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/07/01 10:52:37 | 061,560,572 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm

[2010/07/01 10:11:56 | 000,000,452 | RHS- | M] () -- C:\Documents and Settings\Compaq_Administrator\ntuser.pol

[2010/07/01 10:05:49 | 000,043,531 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2010/07/01 10:05:32 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/07/01 10:05:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/07/01 10:05:25 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/07/01 10:05:24 | 1005,113,344 | -HS- | M] () -- C:\hiberfil.sys

[2010/07/01 10:04:07 | 004,616,192 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\ntuser.dat

[2010/07/01 10:04:07 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Compaq_Administrator\ntuser.ini

[2010/07/01 08:33:51 | 000,023,552 | ---- | M] (PunkTools) -- C:\Documents and Settings\Compaq_Administrator\Desktop\MsnVirRem.exe

[2010/07/01 07:11:41 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Htiguzehobiqoba.bin

[2010/06/30 23:02:02 | 000,002,477 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\HiJackThis.lnk

[2010/06/30 22:48:41 | 000,001,341 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\regtools.vbs

[2010/06/30 12:06:36 | 000,000,566 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol

[2010/06/30 11:31:21 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\UnHookExec.inf

[2010/06/30 11:26:55 | 000,000,956 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\Smart Virus Remover.lnk

[2010/06/30 11:06:52 | 000,000,248 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat

[2010/06/30 10:22:50 | 000,000,757 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\RegistryBooster.lnk

[2010/06/30 10:22:49 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\RegistryBooster.lnk

[2010/06/30 00:26:37 | 000,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\malwarebytes.lnk

[2010/06/30 00:15:45 | 000,002,744 | ---- | M] () -- C:\WINDOWS\afeyotevok.dll

[2010/06/29 23:42:30 | 000,002,744 | ---- | M] () -- C:\WINDOWS\ewitijokilomini.dll

[2010/06/29 23:15:14 | 000,030,000 | ---- | M] () -- C:\WINDOWS\System32\p68dp.dll

[2010/06/28 18:59:18 | 000,017,088 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\My Documents\Lady_GaGa_-_The_Fame_Monster_2CDRip_2009_[Cov_2CD][bubanee].5212783.TPB.torrent

[2010/06/27 10:24:46 | 000,000,873 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play Doctor Who - The Adventure Games.lnk

[2010/06/26 12:12:13 | 000,042,640 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\gameSheep.com - Free Action-Adventure Games.url

[2010/06/24 01:13:14 | 000,503,592 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/06/24 01:13:14 | 000,442,602 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/06/24 01:13:14 | 000,071,868 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/06/22 01:30:17 | 002,359,350 | ---- | M] () -- C:\WINDOWS\wallpaper.bmp

[2010/06/18 13:48:56 | 000,040,617 | ---- | M] () -- C:\WINDOWS\System32\qmudt.exe

[2010/06/17 11:10:20 | 000,016,812 | ---- | M] () -- C:\Documents and Settings\Compaq_Administrator\My Documents\Eminem-Recovery-(Retail)-2010-[NoFS].5614343.TPB.torrent

[2010/06/17 06:56:14 | 000,310,784 | ---- | M] () -- C:\WINDOWS\System32\zmucv.dll

[2010/06/12 08:48:11 | 000,190,592 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/06/12 01:58:23 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/06/11 11:17:18 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/06/08 15:51:54 | 000,040,629 | ---- | M] () -- C:\WINDOWS\System32\qmucv.exe

[2010/06/03 09:58:43 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys

[2010/06/03 09:58:43 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/30 22:48:49 | 000,001,341 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\regtools.vbs

[2010/06/30 16:33:26 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Pzolifuci.dat

[2010/06/30 16:33:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Htiguzehobiqoba.bin

[2010/06/30 11:35:02 | 000,000,610 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\UnHookExec.inf

[2010/06/30 11:26:55 | 000,000,956 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\Smart Virus Remover.lnk

[2010/06/30 11:18:39 | 000,000,452 | RHS- | C] () -- C:\Documents and Settings\Compaq_Administrator\ntuser.pol

[2010/06/30 11:02:33 | 000,000,566 | RHS- | C] () -- C:\Documents and Settings\All Users\ntuser.pol

[2010/06/30 10:22:50 | 000,000,757 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\RegistryBooster.lnk

[2010/06/30 10:22:49 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\RegistryBooster.lnk

[2010/06/30 00:43:58 | 000,002,477 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\Desktop\HiJackThis.lnk

[2010/06/30 00:41:32 | 1005,113,344 | -HS- | C] () -- C:\hiberfil.sys

[2010/06/30 00:15:45 | 000,002,744 | ---- | C] () -- C:\WINDOWS\afeyotevok.dll

[2010/06/29 23:42:30 | 000,002,744 | ---- | C] () -- C:\WINDOWS\ewitijokilomini.dll

[2010/06/29 23:15:14 | 000,030,000 | ---- | C] () -- C:\WINDOWS\System32\p68dp.dll

[2010/06/28 18:59:17 | 000,017,088 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\My Documents\Lady_GaGa_-_The_Fame_Monster_2CDRip_2009_[Cov_2CD][bubanee].5212783.TPB.torrent

[2010/06/27 10:24:46 | 000,000,873 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play Doctor Who - The Adventure Games.lnk

[2010/06/18 13:48:56 | 000,040,617 | ---- | C] () -- C:\WINDOWS\System32\qmudt.exe

[2010/06/17 11:10:20 | 000,016,812 | ---- | C] () -- C:\Documents and Settings\Compaq_Administrator\My Documents\Eminem-Recovery-(Retail)-2010-[NoFS].5614343.TPB.torrent

[2010/06/17 06:56:14 | 000,310,784 | ---- | C] () -- C:\WINDOWS\System32\zmucv.dll

[2010/06/08 15:51:54 | 000,040,629 | ---- | C] () -- C:\WINDOWS\System32\qmucv.exe

[2010/05/29 12:30:39 | 000,772,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\bappijbk.sys

[2010/01/01 13:46:16 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2010/01/01 13:46:16 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2009/08/31 14:00:22 | 000,021,504 | ---- | C] () -- C:\WINDOWS\System32\WBCustomizer.dll

[2009/08/31 14:00:21 | 000,185,344 | ---- | C] () -- C:\WINDOWS\System32\MemWarp.dll

[2009/04/17 15:10:31 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2009/01/05 17:44:26 | 000,065,536 | ---- | C] () -- C:\WINDOWS\qt3wrap.dll

[2009/01/05 17:44:26 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll

[2008/09/01 15:13:02 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI

[2008/07/13 10:40:06 | 000,001,152 | ---- | C] () -- C:\WINDOWS\System32\windrv.sys

[2008/07/08 11:59:50 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll

[2007/08/21 23:17:12 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2007/06/23 11:26:18 | 000,000,321 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI

[2007/02/22 21:43:42 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI

[2007/02/02 12:30:27 | 000,000,029 | ---- | C] () -- C:\WINDOWS\AlphaPlayer.INI

[2006/11/12 15:29:29 | 000,018,807 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2006/09/01 14:31:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2006/09/01 14:08:04 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys

[2006/09/01 14:01:13 | 000,012,977 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS

[2006/09/01 14:01:08 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll

[2006/09/01 13:54:32 | 000,000,108 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2006/09/01 13:48:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2006/09/01 13:45:18 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006/09/01 13:45:18 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2006/09/01 13:45:18 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006/09/01 13:45:18 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006/09/01 13:45:18 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006/09/01 13:45:17 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006/09/01 13:45:17 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2006/09/01 13:43:49 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2006/09/01 13:21:24 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll

[2006/09/01 13:21:24 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll

[2006/09/01 13:21:05 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll

[2006/06/16 19:58:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

[2005/08/05 21:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2005/08/02 23:19:16 | 000,050,176 | ---- | C] () -- C:\WINDOWS\armcex.dll

[2004/08/10 05:00:00 | 000,183,296 | ---- | C] () -- C:\WINDOWS\uzisiyovupomub.dll

[2004/07/08 21:37:36 | 000,000,573 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38849DE5

@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CF5C4195

@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CF61E54

< End of report >

OTL Extras logfile created on: 01/07/2010 11:58:29 - Run 1

OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Compaq_Administrator\Desktop

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

958.00 Mb Total Physical Memory | 420.00 Mb Available Physical Memory | 44.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free

Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 142.31 Gb Total Space | 110.94 Gb Free Space | 77.96% Space Free | Partition Type: NTFS

Drive D: | 6.72 Gb Total Space | 0.91 Gb Free Space | 13.59% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: YOUR-E6F02835AE

Current User Name: Compaq_Administrator

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" %*

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- File not found

"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- File not found

"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe" = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe:*:Enabled:backWeb-7288971 -- File not found

"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- (Eastman Kodak Company)

"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- File not found

"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found

"C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)

"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)

"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Disabled:AOL -- File not found

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Disabled:Windows Live Messenger -- File not found

"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Disabled:Windows Live Messenger (Phone) -- File not found

"C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe" = C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.2 -- (Sony Creative Software Inc.)

"C:\Program Files\Streamer\streamer.exe" = C:\Program Files\Streamer\streamer.exe:*:Disabled:streamer -- File not found

"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost -- File not found

"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)

"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"$NtUninstallMTF1011$" = Street-Ads Browser Enhancer

"$NtUninstallWTF1012$" = Sky-Banners browser enhancer

"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC

"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data

"{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow

"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0

"{1341D838-719C-4A05-B50F-49420CA1B4BB}" = HP Boot Optimizer

"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD

"{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail

"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress

"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java 6 Update 20

"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt

"{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}" = Windows Live Photo Gallery

"{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK

"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.009.00

"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager

"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6

"{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder

"{3852F039-CBC7-4AC8-8A09-293885E2473B}" = MostFun - Cooking Academy

"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works

"{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1

"{428102E6-8A39-48B9-8389-847F5A44A600}" = MSXML 4.0

"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore

"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2

"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 5.0

"{5066E836-D960-45A2-AB12-81545003451D}" = Jurassic Park Operation Genesis Demo

"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001

"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder

"{54BB0384-1C33-488F-A95B-877E480D3EDC}" = MSXML 4.0

"{5CFD7508-7774-48FE-8280-7A3C0AE71755}" = Internet Services

"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA

"{62F71124-ACF9-4025-BCCD-16823EBE6C1E}" = MostFun - Super Granny 4

"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr

"{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap

"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{82081779-4175-4666-A457-AB711CD37EF0}" = cp_LightScribeConfig

"{829DAAD6-BB11-4BB7-921B-07FFB703F944}" = CP_Package_Variety3

"{82E55892-6FFD-403F-AA97-D726846768AA}" = CP_AtenaShokunin1Config

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{866A0078-DEA7-4348-9C9A-999AF2991EAA}" = SlideShowMusic

"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS

"{8A534F71-3202-4464-A422-B767295E67B9}" = CP_Package_Variety2

"{8CD0B297-122D-4718-9CE1-B72E796F7B21}" = Sony Ericsson Media Manager 1.2

"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload

"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini

"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui

"{93E5A317-24EC-4744-812C-16FECFE86E6A}" = CP_Package_Variety1

"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant

"{9600B88C-BE14-4BEA-A529-F5F312900BA3}" = Samsung PC Studio 3

"{979D6936-7F2C-411E-B095-B027A920470B}" = MostFun - Dr. Daisy Pet Vet

"{98CB24AD-52FB-DB5F-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 CRT (x86) WinSXS MSM

"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL

"{9F73FDEF-DDC1-4307-9D96-13AB3254641A}_is1" = Doctor Who: The Adventure Games

"{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe

Link to post
Share on other sites
spally

spally

Posted
  • Author
Posted

Here is the contents of the GMER scan that I did:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-07-01 15:23:12

Windows 5.1.2600 Service Pack 3

Running: c2cb4vrs.exe; Driver: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\axncqaow.sys

---- Kernel code sections - GMER 1.0.15 ----

.text bappijbk.sys F72AE012 25 Bytes [FF, 35, 0B, E3, 2A, F7, 8F, ...]

.text bappijbk.sys F72AE02C 68 Bytes [29, F7, 66, D3, DE, 8B, 74, ...]

.text bappijbk.sys F72AE071 409 Bytes [00, F6, C2, F2, 84, DD, 68, ...]

.text bappijbk.sys F72AE20B 222 Bytes [74, 24, 1C, 8F, 45, 00, 68, ...]

.text bappijbk.sys F72AE2EA 18 Bytes [66, 89, 45, 00, 66, C7, 04, ...]

.text ...

? C:\WINDOWS\system32\drivers\bappijbk.sys A device attached to the system is not functioning.

PAGE Ntfs.sys F7143E55 4 Bytes CALL 86361F49

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF63AF360, 0x20574D, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[1588] ntdll.dll!NtCreateThread 7C90D1AE 3 Bytes JMP 02912D36

.text C:\WINDOWS\Explorer.EXE[1588] ntdll.dll!NtCreateThread + 4 7C90D1B2 1 Byte [86]

.text C:\WINDOWS\Explorer.EXE[1588] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 02912F20

.text C:\WINDOWS\Explorer.EXE[1588] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 02912FC7

.text C:\WINDOWS\Explorer.EXE[1588] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0291D8BB

.text C:\WINDOWS\Explorer.EXE[1588] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 0291DA27

.text C:\WINDOWS\Explorer.EXE[1588] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 029204BE

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 02921476

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 02921582

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 029214BE

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 02921551

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 029212DB

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 02921334

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 02921282

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 02921502

.text C:\WINDOWS\Explorer.EXE[1588] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 029213D5

.text C:\WINDOWS\Explorer.EXE[1588] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02922DAD

.text C:\WINDOWS\Explorer.EXE[1588] WS2_32.dll!send 71AB4C27 5 Bytes JMP 02922DEA

.text C:\WINDOWS\Explorer.EXE[1588] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02922E10

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00132D36

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00132F20

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 00132FC7

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0013D8BB

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 0013DA27

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00142DAD

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00142DEA

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00142E10

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 001404BE

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 00141476

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 00141582

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 001414BE

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 00141551

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 001412DB

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 00141334

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 00141282

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 00141502

.text C:\Documents and Settings\Compaq_Administrator\Desktop\c2cb4vrs.exe[2180] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 001413D5

.text C:\WINDOWS\system32\wscntfy.exe[3144] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00AE2D36

.text C:\WINDOWS\system32\wscntfy.exe[3144] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00AE2F20

.text C:\WINDOWS\system32\wscntfy.exe[3144] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 00AE2FC7

.text C:\WINDOWS\system32\wscntfy.exe[3144] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00AED8BB

.text C:\WINDOWS\system32\wscntfy.exe[3144] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00AEDA27

.text C:\WINDOWS\system32\wscntfy.exe[3144] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00AF2DAD

.text C:\WINDOWS\system32\wscntfy.exe[3144] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00AF2DEA

.text C:\WINDOWS\system32\wscntfy.exe[3144] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00AF2E10

.text C:\WINDOWS\system32\wscntfy.exe[3144] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00AF04BE

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 00AF1476

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 00AF1582

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 00AF14BE

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 00AF1551

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 00AF12DB

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 00AF1334

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 00AF1282

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 00AF1502

.text C:\WINDOWS\system32\wscntfy.exe[3144] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 00AF13D5

.text C:\WINDOWS\system32\ctfmon.exe[3360] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00A92D36

.text C:\WINDOWS\system32\ctfmon.exe[3360] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A92F20

.text C:\WINDOWS\system32\ctfmon.exe[3360] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 00A92FC7

.text C:\WINDOWS\system32\ctfmon.exe[3360] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00A9D8BB

.text C:\WINDOWS\system32\ctfmon.exe[3360] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00A9DA27

.text C:\WINDOWS\system32\ctfmon.exe[3360] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00AA2DAD

.text C:\WINDOWS\system32\ctfmon.exe[3360] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00AA2DEA

.text C:\WINDOWS\system32\ctfmon.exe[3360] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00AA2E10

.text C:\WINDOWS\system32\ctfmon.exe[3360] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00AA04BE

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 00AA1476

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 00AA1582

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 00AA14BE

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 00AA1551

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 00AA12DB

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 00AA1334

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 00AA1282

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 00AA1502

.text C:\WINDOWS\system32\ctfmon.exe[3360] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 00AA13D5

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01F72D36

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 01F72F20

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 01F72FC7

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 01F7D8BB

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] USER32.dll!DefWindowProcA + 11A 7E42C298 7 Bytes JMP 10031D10 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] USER32.dll!SetWindowRgn + 2BD 7E42E7E5 7 Bytes JMP 10031C80 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 01F7DA27

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] USER32.dll!SetClipboardData + 19D 7E43113B 7 Bytes JMP 10031CF0 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 01F81476

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 01F81582

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 01F814BE

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 01F81551

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 01F812DB

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 01F81334

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 01F81282

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 01F81502

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 01F813D5

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01F82DAD

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WS2_32.dll!send 71AB4C27 5 Bytes JMP 01F82DEA

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 01F82E10

.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[3368] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 01F804BE

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01792D36

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 01792F20

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 01792FC7

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0179D8BB

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 0179DA27

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 017A2DAD

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WS2_32.dll!send 71AB4C27 5 Bytes JMP 017A2DEA

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 017A2E10

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 017A1476

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 017A1582

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 017A14BE

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 017A1551

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 017A12DB

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 017A1334

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 017A1282

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 017A1502

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 017A13D5

.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3376] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 017A04BE

.text C:\WINDOWS\system32\rundll32.exe[3384] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00B82D36

.text C:\WINDOWS\system32\rundll32.exe[3384] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00B82F20

.text C:\WINDOWS\system32\rundll32.exe[3384] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 00B82FC7

.text C:\WINDOWS\system32\rundll32.exe[3384] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00B8D8BB

.text C:\WINDOWS\system32\rundll32.exe[3384] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00B8DA27

.text C:\WINDOWS\system32\rundll32.exe[3384] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00B92DAD

.text C:\WINDOWS\system32\rundll32.exe[3384] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00B92DEA

.text C:\WINDOWS\system32\rundll32.exe[3384] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00B92E10

.text C:\WINDOWS\system32\rundll32.exe[3384] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00B904BE

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 00B91476

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 00B91582

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 00B914BE

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 00B91551

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 00B912DB

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 00B91334

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 00B91282

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 00B91502

.text C:\WINDOWS\system32\rundll32.exe[3384] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 00B913D5

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 02252D36

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 02252F20

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 02252FC7

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0225D8BB

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 0225DA27

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 02261476

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 02261582

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 022614BE

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 02261551

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 022612DB

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 02261334

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 02261282

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 02261502

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!HttpSendRequestExA 3D9AA92E 3 Bytes JMP 022613D5

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] WININET.dll!HttpSendRequestExA + 4 3D9AA932 1 Byte [C4]

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] ws2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02262DAD

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] ws2_32.dll!send 71AB4C27 5 Bytes JMP 02262DEA

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] ws2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02262E10

.text C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\obd3xfi.exe[3396] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 022604BE

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00BB2D36

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00BB2F20

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 00BB2FC7

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00BBD8BB

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00BBDA27

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00BC2DAD

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00BC2DEA

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00BC2E10

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00BC04BE

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 00BC1476

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 00BC1582

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 00BC14BE

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 00BC1551

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 00BC12DB

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 00BC1334

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 00BC1282

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 00BC1502

.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[3444] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 00BC13D5

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 04BD2D36

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 04BD2F20

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 04BD2FC7

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 04BE2DAD

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WS2_32.dll!send 71AB4C27 5 Bytes JMP 04BE2DEA

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 04BE2E10

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 04BDD8BB

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 04BDDA27

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 04BE1476

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 04BE1582

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 04BE14BE

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 04BE1551

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 04BE12DB

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 04BE1334

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 04BE1282

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 04BE1502

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 04BE13D5

.text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3480] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 04BE04BE

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00922D36

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes JMP 00922F20

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] ntdll.dll!LdrLoadDll + 4 7C9163C7 1 Byte [84]

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] kernel32.dll!GetFileAttributesExW 7C811195 5 Bytes JMP 00922FC7

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0092D8BB

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 0092DA27

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00932DAD

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00932DEA

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00932E10

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 009304BE

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 00931476

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!HttpQueryInfoA 3D947425 5 Bytes JMP 00931582

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 009314BE

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!InternetQueryDataAvailable 3D951615 5 Bytes JMP 00931551

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!HttpSendRequestA 3D953558 5 Bytes JMP 009312DB

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!HttpSendRequestExW 3D958C49 5 Bytes JMP 00931334

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!HttpSendRequestW 3D95FDF9 5 Bytes JMP 00931282

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!InternetReadFileExA 3D963384 5 Bytes JMP 00931502

.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE[3712] WININET.dll!HttpSendRequestExA 3D9AA92E 5 Bytes JMP 009313D5

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 863122E0

AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Services - GMER 1.0.15 ----

Service (*** hidden *** ) [bOOT] bappijbk <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\bappijbk@Type 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\bappijbk@Start 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\bappijbk@ErrorControl 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\bappijbk@Group Boot Bus Extender

Reg HKLM\SYSTEM\ControlSet002\Services\bappijbk@Type 1

Reg HKLM\SYSTEM\ControlSet002\Services\bappijbk@Start 0

Reg HKLM\SYSTEM\ControlSet002\Services\bappijbk@ErrorControl 0

Reg HKLM\SYSTEM\ControlSet002\Services\bappijbk@Group Boot Bus Extender

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Sorry, my internet connection is a bit unreliable at the moment due to bad weather, so I missed your post :)

Seems like we have a rootkit on board.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites
spally

spally

Posted
  • Author
Posted

ComboFix is complete and here is the log:

ComboFix 10-06-30.03 - Compaq_Administrator 01/07/2010 15:56:17.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.958.484 [GMT 1:00]

Running from: c:\documents and settings\Compaq_Administrator\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\hpe4.dll

c:\documents and settings\Compaq_Administrator\Application Data\iniasd.txt

c:\documents and settings\Compaq_Administrator\Application Data\Kayx

c:\documents and settings\Compaq_Administrator\Application Data\Kayx\afew.exe

c:\documents and settings\Compaq_Administrator\Desktop\Smart Virus Remover.lnk

c:\documents and settings\Compaq_Administrator\Local Settings\Temporary Internet Files\ovoxas.sys

C:\p2hhr.bat

c:\program files\$NtUninstallWTF1012$

c:\program files\$NtUninstallWTF1012$\elUninstall.exe

c:\windows\$NtUninstallMTF1011$

c:\windows\$NtUninstallMTF1011$\apUninstall.exe

c:\windows\afeyotevok.dll

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\cup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\customer_cup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\heart.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_down.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_up.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\plates.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\ticket.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\tray.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\music\mainmenumusic.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_bring_check_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_food_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_order_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_diner.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_food_ready_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_gain_heart_1.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_get_drinks_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_party_arrive_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pencil_write_2.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pickup_food_1_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_rollover_1.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_seat_people_snd.ogg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\choosedifficulty.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\credits.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_lose.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_win.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help1.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help2.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\highscores.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro_mask.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover_mask.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\mainmenu.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup_mask.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradegrid.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradetitle.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upsell.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalk.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalkup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancel.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancelup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\close.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\closeup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continueover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_blue.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_yellow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplay.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplayover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfo.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfoup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off_on.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on_on.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pause.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pauseover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quit.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgame.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgameover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegame.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegameover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submit.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submitup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagain.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagainover.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_over.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_up.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobal.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobalup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscore.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscoreon.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocal.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocalup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\comics\webcomic.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\career.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\customer.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\endless.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\global.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\powerups.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\stove.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\arrow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click2.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\grab.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\open.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\sit_legs.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\arial.mvec

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\komikaaxis.mvec

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt2top.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt4top.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_off.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on1.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on2.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdown.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdownon.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowleft.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowlefton.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowright.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowrighton.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowupon.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\p1icon.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\textedit.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\title.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_a.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_b.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_c.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_a.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_b.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_c.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_d.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_a.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_b.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_c.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_d.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fifth_level_diner.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\first_level_diner.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fourth_level_diner.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\second_level_diner.txt

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\playfirst_logo.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\background.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\frames\upgrade_0001.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\upgrades.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\tableshadow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\choosedifficulty.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooseplayer.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooserestaurant.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\credits.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\game.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\gothighscore.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help2.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscore.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoreinfo.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoresubmit.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelintro.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelover.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\loading.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainloop.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainmenu.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\ok.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\pause.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\style.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\tutorialintro.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upgrade.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upsell.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\webcomic.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\yesno.lua

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\aol_logo.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\gamelabsplash.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\playfirst_logo.jpg

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\strings.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\check.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\checkmark.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\clock.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closed.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closingtime.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\dollar.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\coffee.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\tables.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\wallpaper.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expert.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expertscore.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\fork_timer.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\goalcompleted.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level_career.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\score.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\sound.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staroff.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staron.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumber.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumberup.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\traynumber.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorial_character.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialarrow.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialbox.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.xml

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\drinks.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\maitred.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\oven.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\select.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\shoes.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\stereo.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\table.png

c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\dinerdash.exe

c:\windows\ewitijokilomini.dll

c:\windows\mskcrof.dll

c:\windows\system32\p68dp.dll

c:\windows\system32\qmucv.exe

c:\windows\system32\zmucv.dll

c:\windows\uzisiyovupomub.dll

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2010-06-01 to 2010-07-01 )))))))))))))))))))))))))))))))

.

2010-07-01 06:11 . 2010-07-01 06:11 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}

2010-06-30 15:33 . 2010-07-01 14:25 120 ----a-w- c:\windows\Pzolifuci.dat

2010-06-30 15:33 . 2010-07-01 06:11 0 ----a-w- c:\windows\Htiguzehobiqoba.bin

2010-06-30 11:15 . 2010-06-30 11:15 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\AVG9

2010-06-30 10:26 . 2010-06-30 10:26 -------- d-----w- c:\program files\Smart Virus Remover

2010-06-30 10:01 . 2010-06-30 10:01 -------- d--h--w- c:\windows\system32\GroupPolicy

2010-06-30 09:22 . 2010-06-30 09:22 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Uniblue

2010-06-30 09:22 . 2010-06-30 09:22 -------- d-----w- c:\program files\Uniblue

2010-06-30 08:31 . 2010-06-30 08:31 -------- d-----w- c:\windows\system32\Registry Patrol

2010-06-30 08:30 . 2010-06-30 09:17 -------- d-----w- c:\program files\Registry Patrol

2010-06-29 23:43 . 2010-06-29 23:43 -------- d-----w- c:\program files\Trend Micro

2010-06-29 23:31 . 2010-06-29 23:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-06-29 22:15 . 2010-06-29 23:39 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\wigxpuacv

2010-06-27 09:28 . 2010-06-27 09:28 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Doctor Who

2010-06-27 09:26 . 2010-06-27 09:26 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\Doctor Who

2010-06-27 09:25 . 2009-09-04 16:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2010-06-27 09:25 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2010-06-27 09:25 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll

2010-06-27 09:25 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2010-06-27 09:24 . 2010-06-27 09:25 -------- d-----w- c:\windows\Logs

2010-06-27 09:22 . 2010-06-27 17:54 -------- d-----w- c:\program files\Doctor Who - The Adventure Games

2010-06-18 12:48 . 2010-06-18 12:48 40617 ----a-w- c:\windows\system32\qmudt.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-01 15:15 . 2010-05-29 11:30 772096 ----a-w- c:\windows\system32\drivers\bappijbk.sys

2010-07-01 14:27 . 2008-09-20 22:16 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Moyc

2010-07-01 09:49 . 2009-02-07 01:15 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\uTorrent

2010-07-01 09:25 . 2006-09-01 12:30 -------- d-----w- c:\program files\Java

2010-06-29 23:43 . 2010-06-29 23:43 388096 ----a-r- c:\documents and settings\Compaq_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-06-29 23:32 . 2009-07-25 00:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-22 23:22 . 2010-06-22 23:22 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb40.tmp.exe

2010-06-17 09:37 . 2008-07-26 13:10 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\PlayFirst

2010-06-17 09:37 . 2008-07-26 13:10 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst

2010-06-03 08:59 . 2010-06-03 08:59 29512 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgmfx86.sys

2010-06-03 08:59 . 2010-06-03 08:59 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys

2010-06-03 08:58 . 2008-07-14 15:47 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-06-03 08:58 . 2008-07-14 15:47 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-05-29 23:37 . 2010-05-29 23:37 61440 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ee4070d-n\decora-sse.dll

2010-05-29 23:37 . 2010-05-29 23:37 503808 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-41996763-n\msvcp71.dll

2010-05-29 23:37 . 2010-05-29 23:37 499712 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-41996763-n\jmc.dll

2010-05-29 23:37 . 2010-05-29 23:37 348160 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-41996763-n\msvcr71.dll

2010-05-29 23:37 . 2010-05-29 23:37 12800 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ee4070d-n\decora-d3d.dll

2010-05-29 23:37 . 2006-09-01 12:30 -------- d-----w- c:\program files\Common Files\Java

2010-05-29 11:30 . 2010-05-29 11:30 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\vqdlkr.dat

2010-05-29 10:40 . 2006-09-01 13:13 -------- d-----w- c:\program files\Google

2010-05-28 23:26 . 2007-11-29 00:16 -------- d-----w- c:\program files\Championship Manager 01-02

2010-05-22 11:37 . 2010-03-07 10:04 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-05-04 17:20 . 2004-08-10 04:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-05-04 17:20 . 2004-08-10 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-05-04 17:20 . 2004-08-10 04:00 17408 ------w- c:\windows\system32\corpol.dll

2010-05-04 07:11 . 2008-08-09 14:23 -------- d-----w- c:\program files\Microsoft Silverlight

2010-05-02 05:22 . 2004-08-10 04:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 14:39 . 2009-07-25 00:50 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 14:39 . 2009-07-25 00:50 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-24 07:30 . 2006-11-17 22:47 2702 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat

2010-04-20 05:30 . 2004-08-10 04:00 285696 ----a-w- c:\windows\system32\atmfd.dll

2010-04-12 16:29 . 2010-05-29 23:36 411368 ----a-w- c:\windows\system32\deployJava1.dll

2009-09-30 09:41 . 2009-09-30 09:41 16760 ----a-w- c:\program files\Common Files\aqeheqo.sys

2009-09-30 09:41 . 2009-09-30 09:41 14605 ----a-w- c:\program files\Common Files\nyfubome.ban

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-29 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2009-2-5 127488]

Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-5-10 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-03-14 10:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=

"%windir%\\system32\\drivers\\svchost.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/07/2008 16:47 216200]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/07/2008 16:47 242896]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/06/2009 11:01 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/06/2009 11:01 72944]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [14/03/2010 11:15 916760]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [14/03/2010 11:16 308064]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [14/03/2010 11:26 27632]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/02/2010 09:49 135664]

S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [14/03/2010 11:25 90112]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [17/04/2009 12:14 86696]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/06/2009 11:01 7408]

--- Other Services/Drivers In Memory ---

*Deregistered* - bappijbk

.

Contents of the 'Scheduled Tasks' folder

2010-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 08:49]

2010-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 08:49]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://www.orange.co.uk/

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} - hxxp://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader6.cab

DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - hxxp://wanadoouk.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe

HKCU-Run-Lhaboqo - c:\windows\mskcrof.dll

HKCU-Run-{AA3D3CF4-CA41-5DD1-0008-DB8C03D93B1A} - c:\documents and settings\Compaq_Administrator\Application Data\Kayx\afew.exe

HKLM-Run-Kzeri - c:\windows\uzisiyovupomub.dll

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

SharedTaskScheduler-ThreadingModel - (no file)

AddRemove-$NtUninstallMTF1011$ - c:\windows\$NtUninstallMTF1011$\apUninstall.exe

AddRemove-$NtUninstallWTF1012$ - c:\program files\$NtUninstallWTF1012$\elUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-01 16:12

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bappijbk]

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(568)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\WININET.dll

.

Completion time: 2010-07-01 16:19:30

ComboFix-quarantined-files.txt 2010-07-01 15:19

Pre-Run: 119,091,257,344 bytes free

Post-Run: 124,332,011,520 bytes free

- - End Of File - - 09563A7CB33FFBF0CC7B25348B85542D

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Hello again, please execute the following script and let me know afterwards how things are running.

CF-SCRIPT

-------------

We need to execute a CF-script.

  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Rootkit::
C:\WINDOWS\system32\drivers\bappijbk.sys

Driver::
bappijbk

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Link to post
Share on other sites
spally

spally

Posted
  • Author
Posted

Ok, thats done and the new log is listed below:

ComboFix 10-06-30.03 - Compaq_Administrator 01/07/2010 18:05:06.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.958.412 [GMT 1:00]

Running from: c:\documents and settings\Compaq_Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Compaq_Administrator\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Compaq_Administrator\Application Data\Kayx\afew.exe

c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}

c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}\chrome.manifest

c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}\chrome\content\_cfg.js

c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}\chrome\content\overlay.xul

c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{33AFEC0F-AACA-4394-B07A-72AD5BA5835A}\install.rdf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_BAPPIJBK

-------\Service_bappijbk

((((((((((((((((((((((((( Files Created from 2010-06-01 to 2010-07-01 )))))))))))))))))))))))))))))))

.

2010-06-30 15:33 . 2010-07-01 14:25 120 ----a-w- c:\windows\Pzolifuci.dat

2010-06-30 15:33 . 2010-07-01 06:11 0 ----a-w- c:\windows\Htiguzehobiqoba.bin

2010-06-30 11:15 . 2010-06-30 11:15 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\AVG9

2010-06-30 10:26 . 2010-06-30 10:26 -------- d-----w- c:\program files\Smart Virus Remover

2010-06-30 10:01 . 2010-06-30 10:01 -------- d--h--w- c:\windows\system32\GroupPolicy

2010-06-30 09:22 . 2010-06-30 09:22 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Uniblue

2010-06-30 09:22 . 2010-06-30 09:22 -------- d-----w- c:\program files\Uniblue

2010-06-30 08:31 . 2010-06-30 08:31 -------- d-----w- c:\windows\system32\Registry Patrol

2010-06-30 08:30 . 2010-06-30 09:17 -------- d-----w- c:\program files\Registry Patrol

2010-06-29 23:43 . 2010-06-29 23:43 -------- d-----w- c:\program files\Trend Micro

2010-06-29 23:31 . 2010-06-29 23:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-06-29 22:15 . 2010-06-29 23:39 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\wigxpuacv

2010-06-27 09:28 . 2010-06-27 09:28 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Doctor Who

2010-06-27 09:26 . 2010-06-27 09:26 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\Doctor Who

2010-06-27 09:25 . 2009-09-04 16:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2010-06-27 09:25 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2010-06-27 09:25 . 2009-09-04 16:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll

2010-06-27 09:25 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2010-06-27 09:25 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2010-06-27 09:24 . 2010-06-27 09:25 -------- d-----w- c:\windows\Logs

2010-06-27 09:22 . 2010-06-27 17:54 -------- d-----w- c:\program files\Doctor Who - The Adventure Games

2010-06-18 12:48 . 2010-06-18 12:48 40617 ----a-w- c:\windows\system32\qmudt.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-01 17:05 . 2008-09-20 22:16 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Moyc

2010-07-01 09:49 . 2009-02-07 01:15 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\uTorrent

2010-07-01 09:25 . 2006-09-01 12:30 -------- d-----w- c:\program files\Java

2010-06-29 23:43 . 2010-06-29 23:43 388096 ----a-r- c:\documents and settings\Compaq_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-06-29 23:32 . 2009-07-25 00:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-22 23:22 . 2010-06-22 23:22 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb40.tmp.exe

2010-06-17 09:37 . 2008-07-26 13:10 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\PlayFirst

2010-06-17 09:37 . 2008-07-26 13:10 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst

2010-06-03 08:59 . 2010-06-03 08:59 29512 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgmfx86.sys

2010-06-03 08:59 . 2010-06-03 08:59 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys

2010-06-03 08:58 . 2008-07-14 15:47 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-06-03 08:58 . 2008-07-14 15:47 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-05-29 23:37 . 2010-05-29 23:37 61440 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ee4070d-n\decora-sse.dll

2010-05-29 23:37 . 2010-05-29 23:37 503808 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-41996763-n\msvcp71.dll

2010-05-29 23:37 . 2010-05-29 23:37 499712 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-41996763-n\jmc.dll

2010-05-29 23:37 . 2010-05-29 23:37 348160 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-41996763-n\msvcr71.dll

2010-05-29 23:37 . 2010-05-29 23:37 12800 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3ee4070d-n\decora-d3d.dll

2010-05-29 23:37 . 2006-09-01 12:30 -------- d-----w- c:\program files\Common Files\Java

2010-05-29 11:30 . 2010-05-29 11:30 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\vqdlkr.dat

2010-05-29 10:40 . 2006-09-01 13:13 -------- d-----w- c:\program files\Google

2010-05-28 23:26 . 2007-11-29 00:16 -------- d-----w- c:\program files\Championship Manager 01-02

2010-05-22 11:37 . 2010-03-07 10:04 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-05-04 17:20 . 2004-08-10 04:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-05-04 17:20 . 2004-08-10 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-05-04 17:20 . 2004-08-10 04:00 17408 ------w- c:\windows\system32\corpol.dll

2010-05-04 07:11 . 2008-08-09 14:23 -------- d-----w- c:\program files\Microsoft Silverlight

2010-05-02 05:22 . 2004-08-10 04:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 14:39 . 2009-07-25 00:50 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 14:39 . 2009-07-25 00:50 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-24 07:30 . 2006-11-17 22:47 2702 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat

2010-04-20 05:30 . 2004-08-10 04:00 285696 ----a-w- c:\windows\system32\atmfd.dll

2010-04-12 16:29 . 2010-05-29 23:36 411368 ----a-w- c:\windows\system32\deployJava1.dll

2009-09-30 09:41 . 2009-09-30 09:41 16760 ----a-w- c:\program files\Common Files\aqeheqo.sys

2009-09-30 09:41 . 2009-09-30 09:41 14605 ----a-w- c:\program files\Common Files\nyfubome.ban

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-29 39408]

"{AA3D3CF4-CA41-5DD1-0008-DB8C03D93B1A}"="c:\documents and settings\Compaq_Administrator\Application Data\Kayx\afew.exe" [bU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2009-2-5 127488]

Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-5-10 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-03-14 10:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=

"%windir%\\system32\\drivers\\svchost.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/07/2008 16:47 216200]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/07/2008 16:47 242896]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/06/2009 11:01 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/06/2009 11:01 72944]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [14/03/2010 11:15 916760]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [14/03/2010 11:16 308064]

R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [14/03/2010 11:25 90112]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [14/03/2010 11:26 27632]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/02/2010 09:49 135664]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [17/04/2009 12:14 86696]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/06/2009 11:01 7408]

.

Contents of the 'Scheduled Tasks' folder

2010-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 08:49]

2010-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 08:49]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://www.orange.co.uk/

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} - hxxp://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader6.cab

DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - hxxp://wanadoouk.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-01 18:16

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(564)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1260)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\arservice.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-07-01 18:21:05 - machine was rebooted

ComboFix-quarantined-files.txt 2010-07-01 17:21

ComboFix2.txt 2010-07-01 15:19

Pre-Run: 124,307,423,232 bytes free

Post-Run: 124,224,577,536 bytes free

- - End Of File - - 34971B6E7B91A0D4A215A7938419D285

Link to post
Share on other sites
spally

spally

Posted
  • Author
Posted

Well that was strange, I ran the MBAM scan and it returned results that there were 0 infections, great I thought. Then, as I was about to post the log, I realised that I hadnt updated MBAM first before I ran the scan, so I updated it and ran the scan again and it came back with 8 registry key infections???. How is that possible?, is it something I did?. The only other thing I did between the first scan and the second updated scan was to click on Start/All programs/PC help & tools/system restore to check if it would open as it wouldnt before. It opened first time and I then closed it immediately. Anyway, here is the log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4265

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

01/07/2010 20:37:53

mbam-log-2010-07-01 (20-37-53).txt

Scan type: Quick scan

Objects scanned: 135765

Time elapsed: 7 minute(s), 45 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 8

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\AppID\{84c3c236-f588-4c93-84f4-147b2abbe67b} (Adware.Adrotator) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Sky-Banners (Adware.Adrotator) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\adgj.aghlp (Adware.EZLife) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\adgj.aghlp.1 (Adware.EZLife) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\MarketPrecision\Adparatus (Adware.Adparatus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\MarketPrecision\DuhikiToolbar (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Adparatus (Adware.Adparatus) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\qmudt.exe (Adware.EZLife) -> Quarantined and deleted successfully.

Link to post
Share on other sites
Elise

Elise

Posted
Posted

No worries, these were only leftovers. However it is a good example of how important it is to keep your applications up to date. Security tools like MBAM get updated daily.

Do you have any problems left?

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    2. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    3. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    4. Check esetAcceptTerms.png
    5. Click the esetStart.png button.
    6. Accept any security warnings from your browser.
    7. Check esetScanArchives.png
    8. Push the Start button.
    9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    10. When the scan completes, push esetListThreats.png
    11. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      Note - when ESET doesn't find any threats, no report will be created.
    12. Push the esetBack.png button.
    13. Push esetFinish.png

Link to post
Share on other sites
spally

spally

Posted
  • Author
Posted

Hi again, the scan has just finished running and the results are shown below. I havent noticed any other problems and both the System Restore and Regedit that I couldnt get access to before are now both accesable:

C:\Qoobox\Quarantine\C\Program Files\$NtUninstallWTF1012$\elUninstall.exe.vir Win32/Adware.Lifze.M application deleted - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\mskcrof.dll.vir a variant of Win32/Cimag.CV trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\uzisiyovupomub.dll.vir a variant of Win32/Cimag.CK trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\$NtUninstallMTF1011$\apUninstall.exe.vir Win32/Adware.Lifze.M application deleted - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\system32\qmucv.exe.vir Win32/Adware.Lifze.M application deleted - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\system32\zmucv.dll.vir Win32/Adware.Lifze.M application cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\bappijbk.sys.vir Win32/Agent.OFB trojan cleaned by deleting - quarantined

C:\WINDOWS\acoqanejob.dll a variant of Win32/Cimag.CK trojan cleaned by deleting - quarantined

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Hello there,

Those were mostly in quarantine, so that means you are good to go :)

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :)

Please do the following to remove the remaining programs from your PC:

  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    • Delete GMER (this is a random named file) and OTL.

Please read these advices, in order to prevent reinfecting your PC:

  1. Install and update the following programs regularly:
    • an outbound firewall
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    • MVPs hosts file
      A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.