cannot remove Virtumonde/vundo

alan5577 · November 29, 2008

(I am reposting this since I originally posted it in the incorrect forum)

My computer is affected by several viruses.

I originally tried to run your product several times but the viruses kept comming back.

I then read your forum and did what it said.

I (hope that I) have followed the directions correctly.

My MBAM SCAN

-----------------------------------------------------------------

Malwarebytes' Anti-Malware 1.30

Database version: 1433

Windows 5.1.2600 Service Pack 3

11/28/2008 5:48:58 PM

mbam-log-2008-11-28 (17-48-58).txt

Scan type: Quick Scan

Objects scanned: 63126

Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\savobaro.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zadidatebo (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\savobaro.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\savobaro.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\savobaro.dll -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\savobaro.dll (Trojan.Vundo) -> Delete on reboot.

---------------------------------------------------------------------------------------------

MY PANDA ACTIVE SCAN

;*************************************************************************

***

********************************************************************************

*

**********************

ANALYSIS: 2008-11-29 10:10:46

PROTECTIONS: 1

MALWARE: 26

SUSPECTS: 0

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Symantec Antivirus Corporate Edition 9.0 No Yes

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00034347 dialer.su Dialers No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch

00048526 spyware/web3000 Spyware No 0 Yes No c:\windows\hh.ico

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.trafficmp.com/]

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Cookies\dan@trafficmp[2].txt

00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.casalemedia.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\xf8tj1fa.default\cookies.txt[.atdmt.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.atdmt.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Cookies\dan@atdmt[2].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.247realmedia.com/]

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.fastclick.net/]

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.mediaplex.com/]

00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.toplist.cz/]

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.statcounter.com/]

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.perf.overture.com/]

00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.burstnet.com/]

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[www.burstbeacon.com/]

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.advertising.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.ads.pointroll.com/]

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.overture.com/]

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.realmedia.com/]

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.zedo.com/]

00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.bluestreak.com/]

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[.target.com/]

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\cookies-1.txt[citi.bridgetrack.com/]

00456116 Adware/Antivirus2009 Adware No 0 Yes No C:\Documents and Settings\Dan\Local Settings\Temporary Internet Files\Content.IE5\4ZNMQGJC\freescan[1].htm

01048936 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81B97F51-08EC-4BF7-B467-C437DF027378}\RP6\A0002200.dll

03508074 Adware/Zenosearch Adware No 0 Yes No C:\WINDOWS\system32\rswnw64l.exe.bak

03548697 Trj/Clicker.ALY Virus/Trojan No 1 No No C:\WINDOWS\system32\g73.exe[

Katana · December 1, 2008

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.

Be assured, any links I give are safe

----------------------------------------------------------------------------------------

OTMoveIt

Please download OTMoveIt3 by OldTimer and save it to your desktop

Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below. ( Make sure you include :Reg )

:Reg

[-hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch]

:Files

C:\WINDOWS\system32\tukejavi.dll

c:\windows\hh.ico

C:\WINDOWS\system32\rswnw64l.exe.bak

C:\WINDOWS\system32\g73.exe

C:\download\psp_video_express.exe

:Commands

[Purity]

[EmptyTemp]

Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt3

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
[*]Please post the contents of both log.txt and info.txt.

alan5577 · December 2, 2008

Hello

Thank you very much for your help. I appreciate it.

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

here is the MOVE IT log

========== REGISTRY ==========

Registry key hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch\\ deleted successfully.

========== FILES ==========

File/Folder C:\WINDOWS\system32\tukejavi.dll not found.

c:\windows\hh.ico moved successfully.

C:\WINDOWS\system32\rswnw64l.exe.bak moved successfully.

C:\WINDOWS\system32\g73.exe moved successfully.

C:\download\psp_video_express.exe moved successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\etilqs_fXYvf166cfkfmot2MfkY scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\Magnesium Oxide Lab.doc scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\~DF3B1B.tmp scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\~DF6AC9.tmp scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\~DFC903.tmp scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\~DFF885.tmp scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~2\Dan\LOCALS~1\Temp\~DFFC9.tmp scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.

Local Service Temp folder emptied.

Local Service Temporary Internet Files folder emptied.

Windows Temp folder emptied.

Java cache emptied.

File delete failed. C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\XUL.mfl scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 12012008_214333

Files moved on Reboot...

File C:\DOCUME~2\Dan\LOCALS~1\Temp\etilqs_fXYvf166cfkfmot2MfkY not found!

C:\DOCUME~2\Dan\LOCALS~1\Temp\Magnesium Oxide Lab.doc moved successfully.

File C:\DOCUME~2\Dan\LOCALS~1\Temp\~DF3B1B.tmp not found!

File C:\DOCUME~2\Dan\LOCALS~1\Temp\~DF6AC9.tmp not found!

File C:\DOCUME~2\Dan\LOCALS~1\Temp\~DFC903.tmp not found!

File C:\DOCUME~2\Dan\LOCALS~1\Temp\~DFF885.tmp not found!

File C:\DOCUME~2\Dan\LOCALS~1\Temp\~DFFC9.tmp not found!

File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot.

File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.

C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_001_ moved successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_002_ moved successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_003_ moved successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\Cache\_CACHE_MAP_ moved successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\urlclassifier3.sqlite moved successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\XUL.mfl moved successfully.

------------------------------------------------------------------------------------

HERE IS THE RSIT LOG

Logfile of random's system information tool 1.04 (written by random/random)

Run by Dan at 2008-12-01 21:51:49

Microsoft Windows XP Professional Service Pack 3

System drive C: has 239 GB (78%) free of 305 GB

Total RAM: 1535 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:52:01 PM, on 12/1/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\notepad.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Unlocker\UnlockerAssistant.exe

C:\Program Files\QuickTime\QTTask.exe

C:\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\Mozilla Firefox\firefox.exe

C:\virus\RSIT.exe

C:\Trend Micro\HijackThis\Dan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll

O2 - BHO: {b39cb5b4-12f4-e87a-0474-99e999b416d0} - {0d614b99-9e99-4740-a78e-4f214b5bc93b} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {dbb3a987-2b74-4016-b739-ec382a5ae944} - C:\WINDOWS\system32\tukejavi.dll (file missing)

O2 - BHO: (no name) - {F220DA67-7CA4-4597-863A-1BDA38BAD1D4} - (no file)

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

O4 - HKUS\S-1-5-19\..\Run: [zadidatebo] Rundll32.exe "C:\WINDOWS\system32\wajivegu.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [zadidatebo] Rundll32.exe "C:\WINDOWS\system32\wajivegu.dll",s (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: Kodak EasyShare software.lnk = C:\Kodak\Kodak EasyShare software\bin\EasyShare.exe

O4 - Global Startup: MA111 Configuration Utility.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02

\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Spybot\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\Spybot\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-

secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/windowsupdate/...b?1228082309437

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) -

http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdat...b?1177777250390

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: vfpvpm.dll

O20 - Winlogon Notify: yayyWonM - yayyWonM.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec

AntiVirus\DefWatch.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\SNDSrvc.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog

Devices\SoundMAX\SMAgent.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 9819 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-

FCE54AD9C208}]

SnagIt Toolbar Loader - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll [2008-05-15 66888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0d614b99-9e99-4740-a78e-

4f214b5bc93b}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-

206D7942484F}]

Spybot-S&D IE Protection - C:\Spybot\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-

D4DAF1D92D43}]

SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dbb3a987-2b74-4016-b739-

ec382a5ae944}]

C:\WINDOWS\system32\tukejavi.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F220DA67-7CA4-4597-863A-

1BDA38BAD1D4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - SnagIt - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll [2008-05-15 161096]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"=C:\Unlocker\UnlockerAssistant.exe [2008-05-01 15872]

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-10-04 8491008]

"iTunesHelper"=C:\iTunes\iTunesHelper.exe [2008-10-01 289576]

"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2004-02-29 66680]

"vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2004-03-12 124128]

"nwiz"=nwiz.exe /install []

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-10-04 81920]

"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-06-01 94208]

"Aim6"=C:\Program Files\AIM6\aim6.exe [2008-06-19 50528]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup

Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

Kodak EasyShare software.lnk - C:\Kodak\Kodak EasyShare software\bin\EasyShare.exe

MA111 Configuration Utility.lnk - C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe

C:\Documents and Settings\Dan\Start Menu\Programs\Startup

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLS"="vfpvpm.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]

C:\WINDOWS\system32\NavLogon.dll [2004-03-12 83176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyWonM]

yayyWonM.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"authentication packages"=msv1_0

C:\WINDOWS\system32\urqQkkjH

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplicati

ons\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Temp\HP_WebRelease\Setup\HPZnet01.exe"="C:\Temp\HP_WebRelease\Setup\HPZnet01.exe:*:Enabled:Install Consumer Experience

Network Plug in"

"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"

"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL

Loader"

"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe"="C:\Program Files\Kodak\KODAK

Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater"

"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"

"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12

\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"D:\BitTorrent\bittorrent.exe"="D:\BitTorrent\bittorrent.exe:*:Disabled:BitTorrent"

"C:\Sierra\Empire Earth\Empire Earth.exe"="C:\Sierra\Empire Earth\Empire Earth.exe:*:Disabled:Empire Earth"

"D:\Program Files\Microsoft Games\Halo\halo.exe"="D:\Program Files\Microsoft Games\Halo\halo.exe:*:Disabled:Halo"

"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT

Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil"

"C:\Kodak\Kodak EasyShare software\bin\EasyShare.exe"="C:\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare"

"C:\Symantec\pcAnywhere\awhost32.exe"="C:\Symantec\pcAnywhere\awhost32.exe:*:Enabled:pcAnywhere Host"

"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"

"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

"C:\iTunes\iTunes.exe"="C:\iTunes\iTunes.exe:*:Enabled:iTunes"

"C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui"

"C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"="C:\Program Files\Common

Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe:*:Enabled:AppleMobileDeviceService"

"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon"

"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplication

s\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e09e446-6318-11dc-a490-00095b670f99}]

shell\AutoRun\command - G:\setupSNK.exe

======List of files/folders created in the last 1 months======

2008-12-01 21:51:49 ----D---- C:\rsit

2008-12-01 21:43:33 ----D---- C:\_OTMoveIt

2008-11-30 17:05:57 ----A---- C:\WINDOWS\system32\MRT.exe

2008-11-30 17:05:51 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$

2008-11-30 17:05:25 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$

2008-11-30 17:04:57 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$

2008-11-30 17:04:46 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$

2008-11-30 17:04:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$

2008-11-30 17:04:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$

2008-11-30 17:04:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$

2008-11-30 17:04:23 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$

2008-11-30 17:04:17 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$

2008-11-30 17:04:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$

2008-11-30 17:04:04 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$

2008-11-30 17:03:59 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$

2008-11-30 17:03:54 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$

2008-11-30 17:03:41 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$

2008-11-30 17:03:36 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$

2008-11-30 17:03:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$

2008-11-30 17:03:23 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$

2008-11-30 17:02:57 ----N---- C:\WINDOWS\system32\spmsg.dll

2008-11-30 17:02:56 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$

2008-11-30 12:31:40 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$

2008-11-30 12:31:19 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$

2008-11-30 12:28:25 ----A---- C:\WINDOWS\system32\wups2.dll

2008-11-30 10:34:02 ----ASH---- C:\BOOT.BAK

2008-11-30 10:33:22 ----RSHD---- C:\cmdcons

2008-11-30 10:33:04 ----D---- C:\WINDOWS\setupupd

2008-11-28 23:51:16 ----D---- C:\Trend Micro

2008-11-28 18:01:05 ----D---- C:\Program Files\Panda Security

2008-11-28 17:48:06 ----D---- C:\virus

2008-11-28 17:20:29 ----A---- C:\WINDOWS\wininit.ini

2008-11-28 16:51:06 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy

2008-11-28 16:45:39 ----D---- C:\Spybot

2008-11-27 14:30:34 ----D---- C:\Documents and Settings\Dan\Application Data\Malwarebytes

2008-11-27 14:30:28 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes

2008-11-27 14:30:27 ----D---- C:\Malwarebytes' Anti-Malware

2008-11-27 13:54:10 ----D---- C:\Documents and Settings\Dan\Application Data\Twain

2008-11-27 12:21:14 ----D---- C:\Program Files\Support Tools

2008-11-27 11:33:16 ----D---- C:\WINDOWS\Prefetch

2008-11-27 11:24:40 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest

2008-11-27 11:24:05 ----A---- C:\WINDOWS\system32\bitsprx4.dll

2008-11-27 11:10:26 ----A---- C:\WINDOWS\system32\spxcoins.dll

2008-11-27 11:10:26 ----A---- C:\WINDOWS\system32\irclass.dll

2008-11-27 11:09:48 ----RA---- C:\WINDOWS\SETC5.tmp

2008-11-27 11:09:43 ----RA---- C:\WINDOWS\SETB9.tmp

2008-11-27 11:09:40 ----RA---- C:\WINDOWS\SETB8.tmp

2008-11-27 05:59:12 ----D---- C:\WINDOWS\system32\scripting

2008-11-27 05:59:12 ----D---- C:\WINDOWS\system32\en

2008-11-27 05:59:12 ----D---- C:\WINDOWS\L2Schemas

2008-11-26 22:25:43 ----RA---- C:\WINDOWS\SET102.tmp

2008-11-26 22:25:42 ----RA---- C:\WINDOWS\SET101.tmp

2008-11-26 22:25:29 ----RA---- C:\WINDOWS\SETC6.tmp

2008-11-26 22:25:25 ----RA---- C:\WINDOWS\SETBA.tmp

2008-11-26 22:25:23 ----RA---- C:\WINDOWS\SETB7.tmp

2008-11-26 22:07:00 ----D---- C:\WINDOWS\CSC

2008-11-26 22:06:46 ----A---- C:\WINDOWS\ntbtlog.txt

2008-11-26 19:37:33 ----A---- C:\WINDOWS\OEWABLog.txt

2008-11-26 18:51:08 ----RA---- C:\WINDOWS\SET132.tmp

2008-11-26 18:51:08 ----RA---- C:\WINDOWS\SET12F.tmp

2008-11-26 18:50:54 ----RA---- C:\WINDOWS\SETF4.tmp

2008-11-26 18:50:50 ----RA---- C:\WINDOWS\SETE8.tmp

2008-11-26 18:50:47 ----RA---- C:\WINDOWS\SETE5.tmp

2008-11-26 18:49:20 ----A---- C:\WINDOWS\setuplog.txt

2008-11-26 18:18:11 ----A---- C:\WINDOWS\system32\licwmi.dll

2008-11-26 18:12:50 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL

2008-11-26 18:04:26 ----A---- C:\WINDOWS\imsins.BAK

2008-11-25 21:27:50 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files

2008-11-24 22:10:04 ----D---- C:\CCleaner

2008-11-24 07:56:11 ----D---- C:\Documents and Settings\Dan\Application Data\Desktopicon

2008-11-24 07:56:10 ----D---- C:\Unlocker

2008-11-23 20:34:14 ----D---- C:\WINDOWS\pss

2008-11-23 17:52:14 ----A---- C:\WINDOWS\system32\wlxbilvoudhtlts.exe

2008-11-23 17:51:57 ----SHD---- C:\WINDOWS\RGFu

2008-11-23 17:51:26 ----D---- C:\WINDOWS\system32\ID2

2008-11-23 17:51:26 ----D---- C:\WINDOWS\system32\gp2

2008-11-23 17:51:26 ----D---- C:\WINDOWS\system32\dim

2008-11-02 10:12:46 ----A---- C:\WINDOWS\VPC32.INI

2008-11-02 09:55:16 ----D---- C:\Program Files\Symantec AntiVirus

======List of files/folders modified in the last 1 months======

2008-12-01 21:49:26 ----D---- C:\Mozilla Firefox

2008-12-01 21:48:43 ----D---- C:\WINDOWS\Temp

2008-12-01 21:46:04 ----A---- C:\WINDOWS\SchedLgU.Txt

2008-12-01 21:43:33 ----D---- C:\WINDOWS\system32

2008-12-01 21:43:33 ----D---- C:\WINDOWS

2008-12-01 21:43:33 ----D---- C:\download

2008-11-30 22:14:16 ----RASH---- C:\boot.ini

2008-11-30 22:14:16 ----A---- C:\WINDOWS\win.ini

2008-11-30 22:14:16 ----A---- C:\WINDOWS\SYSTEM.INI

2008-11-30 18:07:26 ----RSHDC---- C:\WINDOWS\system32\dllcache

2008-11-30 18:07:21 ----D---- C:\WINDOWS\system32\CatRoot2

2008-11-30 18:06:55 ----HD---- C:\Config.Msi

2008-11-30 18:06:55 ----D---- C:\Program Files\Internet Explorer

2008-11-30 17:05:58 ----D---- C:\WINDOWS\Debug

2008-11-30 17:05:55 ----HD---- C:\WINDOWS\inf

2008-11-30 17:05:49 ----SHD---- C:\WINDOWS\Installer

2008-11-30 17:05:49 ----D---- C:\WINDOWS\WinSxS

2008-11-30 17:05:16 ----D---- C:\WINDOWS\system32\en-us

2008-11-30 17:04:59 ----D---- C:\WINDOWS\system32\drivers

2008-11-30 17:04:32 ----D---- C:\WINDOWS\system32\CatRoot

2008-11-30 17:03:48 ----HD---- C:\WINDOWS\$hf_mig$

2008-11-30 17:02:43 ----D---- C:\Program Files\Windows Media Player

2008-11-30 16:58:57 ----D---- C:\WINDOWS\SoftwareDistribution

2008-11-30 16:58:33 ----SD---- C:\WINDOWS\Downloaded Program Files

2008-11-30 12:18:57 ----D---- C:\WINDOWS\Help

2008-11-30 10:54:49 ----D---- C:\WINDOWS\WBEM

2008-11-30 10:54:44 ----D---- C:\WINDOWS\Media

2008-11-30 10:54:31 ----HDC---- C:\WINDOWS\ie7

2008-11-30 10:33:22 ----A---- C:\WINDOWS\UPGRADE.TXT

2008-11-29 16:43:16 ----D---- C:\Documents and Settings\Dan\Application Data\U3

2008-11-29 12:22:43 ----AD---- C:\musicBackup

2008-11-28 18:01:05 ----RD---- C:\Program Files

2008-11-28 17:20:27 ----D---- C:\TEMP

2008-11-28 16:54:30 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

2008-11-28 16:54:26 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft

2008-11-27 13:50:22 ----A---- C:\WINDOWS\system32\wpa.bak

2008-11-27 13:01:11 ----D---- C:\WINDOWS\security

2008-11-27 12:58:40 ----D---- C:\WINDOWS\system32\oobe

2008-11-27 12:31:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2008-11-27 12:09:51 ----HD---- C:\Program Files\InstallShield Installation Information

2008-11-27 11:36:43 ----D---- C:\WINDOWS\Registration

2008-11-27 11:33:30 ----SHD---- C:\System Volume Information

2008-11-27 11:33:30 ----D---- C:\WINDOWS\system32\Restore

2008-11-27 11:32:25 ----D---- C:\WINDOWS\system32\config

2008-11-27 11:32:23 ----D---- C:\WINDOWS\nview

2008-11-27 11:25:42 ----A---- C:\WINDOWS\ODBCINST.INI

2008-11-27 11:25:10 ----D---- C:\WINDOWS\system32\ias

2008-11-27 11:24:42 ----RD---- C:\WINDOWS\Web

2008-11-27 11:24:34 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest

2008-11-27 11:24:15 ----D---- C:\WINDOWS\srchasst

2008-11-27 11:24:05 ----D---- C:\Program Files\Movie Maker

2008-11-27 11:23:49 ----D---- C:\Program Files\NetMeeting

2008-11-27 11:23:45 ----D---- C:\Program Files\Outlook Express

2008-11-27 11:23:44 ----D---- C:\Program Files\Common Files\System

2008-11-27 11:22:24 ----D---- C:\WINDOWS\system32\Com

2008-11-27 11:21:51 ----D---- C:\WINDOWS\system32\wbem

2008-11-27 11:21:47 ----D---- C:\Program Files\Windows NT

2008-11-27 11:10:25 ----D---- C:\WINDOWS\system

2008-11-27 11:10:07 ----ASH---- C:\Documents and Settings\All Users.WINDOWS\Application Data\desktop.ini

2008-11-27 06:05:59 ----D---- C:\WINDOWS\system32\Setup

2008-11-27 06:05:50 ----D---- C:\WINDOWS\system32\usmt

2008-11-27 06:05:40 ----D---- C:\WINDOWS\AppPatch

2008-11-27 06:05:31 ----D---- C:\WINDOWS\mui

2008-11-27 06:05:30 ----D---- C:\WINDOWS\ime

2008-11-27 06:05:30 ----D---- C:\WINDOWS\ehome

2008-11-27 06:05:28 ----RSD---- C:\WINDOWS\Fonts

2008-11-27 06:05:27 ----D---- C:\WINDOWS\network diagnostic

2008-11-27 06:05:13 ----D---- C:\WINDOWS\PeerNet

2008-11-27 06:05:00 ----D---- C:\WINDOWS\system32\npp

2008-11-27 06:04:52 ----D---- C:\WINDOWS\msagent

2008-11-27 06:01:26 ----D---- C:\WINDOWS\twain_32

2008-11-27 06:00:40 ----D---- C:\WINDOWS\system32\icsxml

2008-11-27 06:00:07 ----D---- C:\WINDOWS\system32\1033

2008-11-27 05:59:12 ----D---- C:\WINDOWS\Driver Cache

2008-11-27 05:59:12 ----D---- C:\WINDOWS\dell

2008-11-26 20:18:46 ----D---- C:\Documents and Settings

2008-11-26 19:25:26 ----D---- C:\WINDOWS\system32\ReinstallBackups

2008-11-26 18:14:00 ----D---- C:\Program Files\Common Files\Symantec Shared

2008-11-26 18:13:28 ----D---- C:\Program Files\Symantec

2008-11-26 18:12:30 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec

2008-11-25 06:28:36 ----D---- C:\Documents

2008-11-24 23:03:57 ----D---- C:\WINDOWS\Minidump

2008-11-18 17:45:15 ----D---- C:\Documents and Settings\Dan\Application Data\ZoomBrowser EX

2008-11-18 17:42:03 ----A---- C:\WINDOWS\NeroDigital.ini

2008-11-17 06:43:35 ----A---- C:\WINDOWS\PhotoSnapViewer.INI

2008-11-16 20:44:48 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\ZoomBrowser

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]

R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]

R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys []

R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2004-03-11 263616]

R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14

12032]

R2 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys []

R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []

R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2005-03-04 127872]

R3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-01-13 12500]

R3 E1000;Intel® PRO/1000 Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1000325.sys [2004-11-22 176128]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]

R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]

R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-04-14 12160]

R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081130.004\naveng.sys []

R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081130.004\navex15.sys []

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-10-04 6854464]

R3 PCANDIS5;PCANDIS5 Protocol Driver; \??\C:\PROGRA~1\NETGEAR\MA111C~1\PCANDIS5.SYS []

R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2008-04-14 5888]

R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2005-03-01 392704]

R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-08-03 221376]

R3 StillCam;Still Serial Digital Camera Driver; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-08-17 6784]

R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []

R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2004-03-11 16288]

R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14

30208]

R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]

R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]

R3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]

R3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2004-11-05 82148]

S1 cbidf2kk;cbidf2kk; C:\WINDOWS\System32\drivers\cbidf2kk.sys []

S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-08-03 701440]

S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2004-10-19 20096]

S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2004-09-21 10804]

S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-01-17 23000]

S3 BTNetFilter;Bluetooth Network Filter; \??\C:\WINDOWS\system32\drivers\BTNetFilter.sys []

S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]

S3 EraserUtilDrvI2;EraserUtilDrvI2; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI2.sys []

S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2004-09-14 88960]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]

S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]

S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]

S3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys []

S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]

S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-10-01 32000]

S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]

S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

S3 WlanUIB;NETGEAR 802.11b USB Driver; C:\WINDOWS\system32\DRIVERS\MA111nd5.sys [2004-09-29 666624]

S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-

09-28 77568]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28

82944]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]

R2 BlueSoleil Hid Service;BlueSoleil Hid Service; C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe [2005-01-27

106496]

R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]

R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2007-01-31 96370]

R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2004-02-29 255096]

R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2004-02-29 242808]

R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2004-03-12 29928]

R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-10-04 155716]

R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]

R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20

45056]

R2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2004-03-12 1228923]

R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2007-06-07 1174664]

R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04

24652]

R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]

S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-08-23

68096]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]

S3 ccPwdSvc;Symantec Password Validation; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2004-02-29 87160]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86;

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0

\WPF\PresentationFontCache.exe [2007-10-09 36864]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11

864256]

S3 LiveUpdate;LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE [2008-08-01 3220856]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26

441136]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 PPCtlPriv;PPCtlPriv; C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-01 185608]

S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2004-03-12 169192]

S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2004-03-11 193760]

S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18

913408]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

S4 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

[2008-08-01 238968]

S4 Inenumtwsw;Inenumtwsw; C:\WINDOWS\system32\drivers\ntfs.sys [2008-04-14 574976]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication

Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

----------------------------------------------------------------------------------------------------------------

HERE IS THE RSIT INFO

info.txt logfile of random's system information tool 1.04 2008-12-01 21:52:03

======Uninstall list======

-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U

-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL

-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL

-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL

-->MsiExec.exe /I{219B0DA4-8F1A-499D-8795-4A07C632521E}

-->MsiExec.exe /I{644B991F-B109-4360-9DA3-40CDAD13961C}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

7-Zip 4.52 beta-->"D:\AIM\7-Zip\Uninstall.exe"

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program

Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x9

Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}

Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log

AIM 6-->C:\Program Files\AIM6\uninst.exe

AIM Pro-->MsiExec.exe /X{D3A04D2F-28C4-4D9C-8487-DAB75992AE09}

Amazon MP3 Downloader 1.0.3-->C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe

Apple Mobile Device Support-->MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

BlueSoleil-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield

Installation Information\{B9F499B8-D1F0-42FC-84BE-CC552123CCCB}\setup.exe" -l0x9

Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}

Canon Camera Access Library-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CAL\Uninst.ini"

Canon Camera Support Core Library-->"C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program

Files\Canon\CSCLIB\Uninst.ini"

Canon Camera Window DC_DV 5 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini"

Canon G.726 WMP-Decoder-->"C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\Program

Files\Canon\G726Decoder\G726DecUnInstall.ini"

Canon MovieEdit Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini"

Canon RAW Image Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\RAW Image Task\Uninst.ini"

Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe"

"C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"

Canon Utilities CameraWindow DC-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\CameraWindowDC\Uninst.ini"

Canon Utilities CameraWindow-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\CameraWindowLauncher\Uninst.ini"

Canon Utilities MyCamera DC-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\MyCameraDC\Uninst.ini"

Canon Utilities MyCamera-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\MyCamera\Uninst.ini"

Canon Utilities RemoteCapture DC-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\RemoteCaptureDC\Uninst.ini"

Canon Utilities RemoteCapture Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"

Canon Utilities ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\ZoomBrowser EX\Program\Uninst.ini"

Canon ZoomBrowser EX Memory Card Utility-->"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program

Files\Canon\ZoomBrowser EX MCU\Uninst.ini"

CCleaner (remove only)-->"C:\CCleaner\uninst.exe"

CCScore-->MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}

Crazy Taxi 3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield

Installation Information\{831ADB7A-8882-41B1-82F7-2746FEC3FA91}\setup.exe"

DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER

DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN

Empire Earth-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield

Installation Information\{2447500B-22D7-47BD-9B13-1A927F43A267}\Setup.exe"

Encore LaunchPad 6.8.25.100-->"C:\Program Files\Encore\LaunchPad\unins000.exe"

Encyclopaedia Britannica 2005 Ultimate Reference Suite CD-ROM-->"C:\Britannica 2005\Ultimate Reference Suite

CD\UninstallerData\Uninstall Encyclopaedia Britannica 2005 Ultimate Reference Suite CD-ROM.exe"

ESSBrwr-->MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}

ESSCDBK-->MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}

ESScore-->MsiExec.exe /I{42938595-0D83-404D-9F73-F8177FDD531A}

ESSgui-->MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}

ESSini-->MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}

ESSPCD-->MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}

ESSPDock-->MsiExec.exe /I{FCDB1C92-03C6-4C76-8625-371224256091}

ESSSONIC-->MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34}

ESSTOOLS-->MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}

essvatgt-->MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}

Express Rip-->C:\Program Files\NCH Swift Sound\ExpressRip\uninst.exe

FreeRIP v3.01-->"C:\Program Files\FreeRIP3\unins000.exe"

GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG

HijackThis 2.0.2-->"C:\Trend Micro\HijackThis\HijackThis.exe" /uninstall

Hotfix for Microsoft .NET Framework 3.0 (KB932471)-->c:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-

4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}

Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

Hoyle Card Games 2007-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program

Files\InstallShield Installation Information\{D361C406-ED11-4A88-AD42-4A749BBAE6F9}\setup.exe" -l0x9 -removeonly

HP Image Zone 4.7-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat

HP PSC & OfficeJet 4.7-->"C:\Program Files\HP\Digital Imaging\{342C7C88-D335-4bc2-8CF1-281857629CE2}\setup\hpzscr01.exe" -

datfile hposcr05.dat

HP PSC & OfficeJet 4.7-->"C:\Program Files\HP\Digital Imaging\{5469D537-9B44-4c78-BF2D-5F9807564F74}\setup\hpzscr01.exe" -

datfile hposcr05.dat

Intel® PRO Network Connections Drivers-->Prounstl.exe

InterActual Player-->C:\Program Files\InterActual\InterActual Player\inuninst.exe

iTunes-->MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}

Java 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}

Java SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}

kgcbase-->MsiExec.exe /I{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}

Kodak EasyShare software-->C:\Documents and Settings\All Users.WINDOWS\Application

Data\Kodak\EasyShareSetup\$SETUP_1e0002_42c44391\Setup.exe /APR-REMOVE

LiveReg (Symantec Corporation)-->C:\Program Files\Common Files\Symantec Shared\LiveReg\VcSetup.exe /REMOVE

LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\Documents and Settings\All

Users.WINDOWS\Application Data\LuUninstall.LiveUpdate"

LiveUpdate (Symantec Corporation)-->MsiExec.exe /X{E80F62FF-5D3C-4A19-8409-9721F2928206}

MA111 Configuration Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program

Files\InstallShield Installation Information\{93352A14-437E-4DB2-9CB8-463D0649B5DE}\Setup.exe" -l0x9

MA111 Configuration Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program

Files\InstallShield Installation Information\{B35E04CF-3A12-4F91-9981-ECF1915BCE76}\Setup.exe" -l0x9

Macromedia Flash Player 8-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\swflash.inf,DefaultUninstall,5

Malwarebytes' Anti-Malware-->"C:\Malwarebytes' Anti-Malware\unins000.exe"

MaxBlast 4-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield

Installation Information\{639858DD-4966-40F3-A706-7C838BCF3A2B}\setup.exe"

Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe"

"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}

Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}

Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"

Microsoft Halo-->"D:\Program Files\Microsoft Games\Halo\UNINSTAL.EXE" /runtemp /addremove

Microsoft Internationalized Domain Names Mitigation APIs--

>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"

Microsoft MapPoint North America 2006-->MsiExec.exe /I{83ED1E80-A1B7-4246-BCF1-AC4A88151A6B}

Microsoft National Language Support Downlevel APIs--

>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"

Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}

Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}

Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe"

/uninstall ENTERPRISER /dll OSETUP.DLL

Microsoft Office Enterprise 2007-->MsiExec.exe /X{91120000-0030-0000-0000-0000000FF1CE}

Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}

Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}

Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}

Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}

Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}

Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}

Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}

Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}

Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}

Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}

Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}

Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs-->MsiExec.exe /X{90120000-00B2-0409-0000-0000000FF1CE}

Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft WorldWide Telescope-->MsiExec.exe /I{A5C16084-032F-4A6D-B19A-2E700421F9FB}

Monopoly-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Hasbro Interactive\Monopoly\Uninst.isu"

Mozilla Firefox (3.0.4)-->C:\Mozilla Firefox\uninstall\helper.exe

MP3 Splitter & Joiner 3.27-->"D:\Experiment\MP3 Splitter & Joiner\unins000.exe"

MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}

MSXML 6.0 Parser (KB927977)-->MsiExec.exe /I{5A710547-B58E-488B-828D-CA9A25A0533C}

MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}

Myst Uru - Complete Chronicles-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup

"C:\Program Files\InstallShield Installation Information\{69BA7792-853B-45A3-A29F-539C0D7A2A62}\setup.exe" -l0x9

Nero 7 Essentials-->MsiExec.exe /I{A79A8EC1-2D17-43D2-AE27-6C1131F61033}

netbrdg-->MsiExec.exe /I{4537EA4B-F603-4181-89FB-2953FC695AB1}

NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI

OfotoXMI-->MsiExec.exe /I{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}

Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe

PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield

Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall

Project64 1.6-->MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}

PSP Video Express(remove only)-->"C:\download\PSPVideoExpress\bt-uninst.exe"

QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}

RON Tool Agadoo-->C:\WINDOWS\system32\wlxbilvoudhtlts.exe

Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

Security Update for Excel 2007 (KB936509)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {A00724F5-82C4-

4924-B707-0E5A84B52471}

Security Update for Office 2007 (KB934062)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-

4638-9F0F-D9E4C05F9D33}

Security Update for Office 2007 (KB936514)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {C7A78F7F-EF32-

4477-BAD7-3439EA7571BF}

Security Update for Publisher 2007 (KB936646)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {A32E4BAF-

6477-45FA-B8AB-E743FA8D63FF}

Security Update for the 2007 Microsoft Office System (KB936960)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE}

/uninstall {5E5BD655-7AA9-47F9-BB6D-A1D8CE29AC86}

Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"

Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32

\MacroMed\Flash\KB923789.inf

Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"

Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"

Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"

Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

SFR-->MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}

SHASTA-->MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237}

ShowIP v1.6.6-->"C:\ShowIP\unins000.exe"

skin0001-->MsiExec.exe /I{5316DFC9-CE99-4458-9AB3-E8726EDE0210}

SKINXSDK-->MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}

Skype

Katana · December 2, 2008

Step 1

Malwarebytes' Anti-Malware

I notice that you have MBAM installed, please do the following

Start MalwareBytes AntiMalware
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
[*]When the update is complete, select the Scanner tab
[*]Select Perform full scan, then click Scan.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Be sure that everything is checked, and click Remove Selected.
[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

----------------------------------------------------------- -----------------------------------------------------------

Step 2

Download and Run ComboFix (by sUBs)

Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.

This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

----------------------------------------------------------- -----------------------------------------------------------

Step 3

Fix With HJT

Close all other windows and then start HiJack This

Click Do A System Scan Only

When it has finished scanning put a check next to the following lines IF still present

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: {b39cb5b4-12f4-e87a-0474-99e999b416d0} - {0d614b99-9e99-4740-a78e-4f214b5bc93b} - (no file)
O2 - BHO: (no name) - {dbb3a987-2b74-4016-b739-ec382a5ae944} - C:\WINDOWS\system32\tukejavi.dll (file missing)
O2 - BHO: (no name) - {F220DA67-7CA4-4597-863A-1BDA38BAD1D4} - (no file)
O4 - HKUS\S-1-5-19\..\Run: [zadidatebo] Rundll32.exe "C:\WINDOWS\system32\wajivegu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [zadidatebo] Rundll32.exe "C:\WINDOWS\system32\wajivegu.dll",s (User 'NETWORK SERVICE')
O20 - AppInit_DLLs: vfpvpm.dll
O20 - Winlogon Notify: yayyWonM - yayyWonM.dll (file missing)

- Close ALL open windows (especially Internet Explorer!)-

Now click Fix checked

Click yes to any prompts

Close HijackThis

----------------------------------------------------------- -----------------------------------------------------------

Step 4

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.

Now download and install Java Runtime Environment (JRE) .

----------------------------------------------------------- -----------------------------------------------------------

Step 5

Logs/Information to Post in Reply

Please post the following logs/Information in your reply

MalwareBytes Log
Combofix Log
How are things running now ?

----------------------------------------------------------- -----------------------------------------------------------

Additional Notes

Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Adobe Reader is a large program and uses unnecessary space.

If you prefer a smaller program you can get Foxit 2.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended

There is a newer version of Adobe Acrobat Reader available.

Please go to this link Adobe Acrobat Reader Download Link
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts

When the installation is complete go to Add/Remove Programs and uninstall all previous versions.

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)

Adobe Reader 8.1.2

alan5577 · December 3, 2008

Thanks for your continuing support.

Other than the fact that Malwarebytes tells me that I still have a virus, my computer is not displaying any obvious symptoms now (like popping up internet sites).

However, I have noticed that my wireless internet does not work anymore (hard wired does work). Before the virus it used to work fine but now i get "unable to contact your DHCP server ". I have tried running netdiag /test:winsock and it says everything passed.

When I ran HJT, the only line that i saw to remove was

"R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank"

Anyway, here are the requested logs.

----------------------------------------------------------------

MALWAREBYTES LOG

Malwarebytes' Anti-Malware 1.30

Database version: 1451

Windows 5.1.2600 Service Pack 3

12/2/2008 10:46:23 PM

mbam-log-2008-12-02 (22-46-23).txt

Scan type: Full Scan (C:\|)

Objects scanned: 156863

Time elapsed: 53 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{dbb3a987-2b74-4016-b739-ec382a5ae944} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0d614b99-9e99-4740-a78e-4f214b5bc93b} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{dbb3a987-2b74-4016-b739-ec382a5ae944} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0d614b99-9e99-4740-a78e-4f214b5bc93b} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dbb3a987-2b74-4016-b739-ec382a5ae944} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

---------------------------------------------------------------------------------------------------------

COMBOFIX LOGS

ComboFix 08-12-01.03 - Dan 2008-12-02 22:56:51.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.920 [GMT -5:00]

Running from: c:\virus\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Dan\Local Settings\Temporary Internet Files\bestwiner.stt

c:\documents and settings\Dan\Local Settings\Temporary Internet Files\fbk.sts

c:\temp\tn3

c:\windows\system32\TDSSitpe.dat

c:\windows\wiaserviv.log

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_TDSSSERV.SYS

-------\Service_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 )))))))))))))))))))))))))))))))

.

2008-12-01 21:51 . 2008-12-01 21:52 <DIR> d-------- C:\rsit

2008-12-01 21:43 . 2008-12-01 21:43 <DIR> d-------- C:\_OTMoveIt

2008-11-30 12:28 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll

2008-11-30 10:16 . 2008-04-14 05:42 116,224 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll

2008-11-30 10:16 . 2001-08-17 22:36 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll

2008-11-30 10:16 . 2008-04-14 05:42 18,944 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll

2008-11-30 10:15 . 2008-04-13 22:05 154,624 --a--c--- c:\windows\system32\dllcache\wlluc48.sys

2008-11-30 10:15 . 2001-08-17 22:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe

2008-11-30 10:15 . 2001-08-17 22:37 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe

2008-11-30 10:15 . 2008-04-13 22:04 19,455 --a--c--- c:\windows\system32\dllcache\wvchntxx.sys

2008-11-30 10:15 . 2001-08-17 12:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys

2008-11-30 10:15 . 2008-04-13 22:04 12,063 --a--c--- c:\windows\system32\dllcache\wsiintxx.sys

2008-11-30 10:15 . 2008-04-14 00:06 8,832 --a--c--- c:\windows\system32\dllcache\wmiacpi.sys

2008-11-30 10:15 . 2008-04-14 05:42 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll

2008-11-30 10:15 . 2001-08-17 22:37 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe

2008-11-30 10:13 . 2001-08-17 13:28 794,654 --a--c--- c:\windows\system32\dllcache\usr1801.sys

2008-11-30 10:12 . 2001-08-17 22:36 216,064 --a--c--- c:\windows\system32\dllcache\um34scan.dll

2008-11-30 10:12 . 2001-08-17 22:36 211,968 --a--c--- c:\windows\system32\dllcache\um54scan.dll

2008-11-30 10:12 . 2001-08-17 12:51 166,784 --a--c--- c:\windows\system32\dllcache\tridxpm.sys

2008-11-30 10:12 . 2001-08-17 22:36 94,720 --a--c--- c:\windows\system32\dllcache\umaxud32.dll

2008-11-30 10:12 . 2001-08-17 22:36 69,632 --a--c--- c:\windows\system32\dllcache\umaxu12.dll

2008-11-30 10:12 . 2001-08-17 22:36 50,688 --a--c--- c:\windows\system32\dllcache\umaxscan.dll

2008-11-30 10:12 . 2001-08-17 22:36 50,176 --a--c--- c:\windows\system32\dllcache\umaxp60.dll

2008-11-30 10:12 . 2001-08-17 22:36 47,616 --a--c--- c:\windows\system32\dllcache\umaxcam.dll

2008-11-30 10:12 . 2001-08-17 13:52 36,736 --a--c--- c:\windows\system32\dllcache\ultra.sys

2008-11-30 10:12 . 2001-08-17 22:36 28,160 --a--c--- c:\windows\system32\dllcache\umaxu40.dll

2008-11-30 10:12 . 2001-08-17 22:36 26,624 --a--c--- c:\windows\system32\dllcache\umaxu22.dll

2008-11-30 10:12 . 2001-08-17 13:58 22,912 --a--c--- c:\windows\system32\dllcache\umaxpcls.sys

2008-11-30 10:12 . 2001-08-17 13:48 11,520 --a--c--- c:\windows\system32\dllcache\twotrack.sys

2008-11-30 10:10 . 2001-08-17 14:56 172,768 --a--c--- c:\windows\system32\dllcache\t2r4disp.dll

2008-11-30 10:09 . 2001-08-17 12:18 285,760 --a--c--- c:\windows\system32\dllcache\stlnata.sys

2008-11-30 10:08 . 2008-04-13 23:53 404,990 --a--c--- c:\windows\system32\dllcache\slntamr.sys

2008-11-30 10:07 . 2001-08-17 22:36 386,560 --a--c--- c:\windows\system32\dllcache\sgiul50.dll

2008-11-30 10:06 . 2001-08-17 22:36 495,616 --a--c--- c:\windows\system32\dllcache\sblfx.dll

2008-11-30 10:05 . 2001-08-17 13:28 899,146 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys

2008-11-30 10:04 . 2008-04-14 05:42 363,520 --a--c--- c:\windows\system32\dllcache\psisdecd.dll

2008-11-30 10:03 . 2008-04-14 05:40 259,328 --a--c--- c:\windows\system32\dllcache\perm3dd.dll

2008-11-30 10:02 . 2008-08-14 04:33 2,066,048 --a--c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2008-11-30 10:01 . 2008-04-13 22:05 132,695 --a--c--- c:\windows\system32\dllcache\netwlan5.sys

2008-11-30 10:00 . 2008-04-14 05:42 1,737,856 --a--c--- c:\windows\system32\dllcache\mtxparhd.dll

2008-11-30 09:59 . 2001-08-17 12:50 320,384 --a--c--- c:\windows\system32\dllcache\mgaum.sys

2008-11-30 09:58 . 2001-08-17 13:28 802,683 --a--c--- c:\windows\system32\dllcache\ltsm.sys

2008-11-30 09:57 . 2008-04-14 05:42 151,552 --a--c--- c:\windows\system32\dllcache\irftp.exe

2008-11-30 09:56 . 2008-04-14 05:41 702,845 --a--c--- c:\windows\system32\dllcache\i81xdnt5.dll

2008-11-30 09:55 . 2008-04-13 23:53 1,041,536 --a--c--- c:\windows\system32\dllcache\hsfdpsp2.sys

2008-11-30 09:54 . 2001-08-17 14:56 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll

2008-11-30 09:53 . 2001-08-17 12:15 455,680 --a--c--- c:\windows\system32\dllcache\fus2base.sys

2008-11-30 09:52 . 2001-08-17 13:28 634,134 --a--c--- c:\windows\system32\dllcache\el656ct5.sys

2008-11-30 09:51 . 2001-08-17 12:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys

2008-11-30 09:50 . 2001-08-17 12:13 980,034 --a--c--- c:\windows\system32\dllcache\cicap.sys

2008-11-30 09:49 . 2001-08-17 13:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys

2008-11-30 09:48 . 2001-08-17 13:28 762,780 --a--c--- c:\windows\system32\dllcache\3cwmcru.sys

2008-11-30 09:47 . 2008-08-14 05:11 2,189,184 --a--c--- c:\windows\system32\dllcache\ntoskrnl.exe

2008-11-30 09:47 . 2001-08-17 14:56 66,048 --a--c--- c:\windows\system32\dllcache\s3legacy.dll

2008-11-28 23:51 . 2008-11-28 23:51 <DIR> d-------- C:\Trend Micro

2008-11-28 18:01 . 2008-11-28 18:01 <DIR> d-------- c:\program files\Panda Security

2008-11-28 18:01 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys

2008-11-28 17:48 . 2008-12-02 22:55 <DIR> d-------- C:\virus

2008-11-28 17:20 . 2008-11-28 17:20 95 --a------ c:\windows\wininit.ini

2008-11-28 16:51 . 2008-11-28 17:05 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy

2008-11-28 16:45 . 2008-11-28 16:55 <DIR> d-------- C:\Spybot

2008-11-27 14:30 . 2008-11-27 14:30 <DIR> d-------- C:\Malwarebytes' Anti-Malware

2008-11-27 14:30 . 2008-11-27 14:30 <DIR> d-------- c:\documents and settings\Dan\Application Data\Malwarebytes

2008-11-27 14:30 . 2008-11-27 14:30 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes

2008-11-27 14:30 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-11-27 14:30 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-11-27 13:54 . 2008-11-27 14:37 <DIR> d-------- c:\documents and settings\Dan\Application Data\Twain

2008-11-27 13:16 . 2008-12-02 23:04 13,646 --a------ c:\windows\system32\wpa.dbl

2008-11-27 13:13 . 2008-04-13 21:16 91,215 --a------ c:\windows\system32\actshell.ht_

2008-11-27 13:13 . 2001-07-21 14:17 2,126 --a------ c:\windows\system32\wpa.db_

2008-11-27 13:12 . 2008-04-14 05:41 423,936 --a------ c:\windows\system32\licdll.dl_

2008-11-27 13:12 . 2008-04-14 05:42 32,256 --a------ c:\windows\system32\wpabaln.ex_

2008-11-27 13:11 . 2008-04-14 05:42 397,824 --a------ c:\windows\system32\regwizc.dl_

2008-11-27 13:11 . 2008-04-14 05:41 58,880 --a------ c:\windows\system32\licwmi.dl_

2008-11-27 12:21 . 2008-11-27 12:21 <DIR> d-------- c:\program files\Support Tools

2008-11-27 12:09 . 2004-09-29 10:28 666,624 --a------ c:\windows\system32\drivers\MA111nd5.sys

2008-11-27 11:28 . 2008-04-14 07:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex

2008-11-27 11:27 . 2008-04-14 07:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll

2008-11-27 11:26 . 2008-04-14 07:00 2,134,528 --a--c--- c:\windows\system32\dllcache\smtpsnap.dll

2008-11-27 11:24 . 2008-04-14 07:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe

2008-11-27 11:24 . 2008-04-14 07:00 7,168 --a--c--- c:\windows\system32\dllcache\bitsprx4.dll

2008-11-27 11:24 . 2008-04-14 07:00 7,168 --a------ c:\windows\system32\bitsprx4.dll

2008-11-27 11:24 . 2008-11-27 11:24 749 -rah----- c:\windows\WindowsShell.Manifest

2008-11-27 11:24 . 2008-11-27 11:24 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest

2008-11-27 11:24 . 2008-11-27 11:24 749 -rah----- c:\windows\system32\sapi.cpl.manifest

2008-11-27 11:24 . 2008-11-27 11:24 749 -rah----- c:\windows\system32\nwc.cpl.manifest

2008-11-27 11:24 . 2008-11-27 11:24 749 -rah----- c:\windows\system32\ncpa.cpl.manifest

2008-11-27 11:24 . 2008-11-27 11:24 488 -rah----- c:\windows\system32\logonui.exe.manifest

2008-11-27 11:23 . 2008-04-14 07:00 32,768 --a--c--- c:\windows\system32\dllcache\icwdl.dll

2008-11-27 11:10 . 2008-04-14 07:00 24,661 --a------ c:\windows\system32\spxcoins.dll

2008-11-27 11:10 . 2008-04-14 07:00 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll

2008-11-27 11:10 . 2008-04-14 07:00 13,312 --a------ c:\windows\system32\irclass.dll

2008-11-27 11:10 . 2008-04-14 07:00 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll

2008-11-27 11:10 . 2008-11-27 11:10 4,444 --a------ c:\windows\system32\pid.PNF

2008-11-27 05:59 . 2008-11-27 06:05 <DIR> d-------- c:\windows\system32\scripting

2008-11-27 05:59 . 2008-11-27 06:04 <DIR> d-------- c:\windows\system32\en

2008-11-27 05:59 . 2008-11-27 06:05 <DIR> d-------- c:\windows\L2Schemas

2008-11-26 22:25 . 2004-08-04 05:00 1,086,058 -ra------ c:\windows\SETBA.tmp

2008-11-26 22:25 . 2004-08-04 05:00 1,042,903 -ra------ c:\windows\SETB7.tmp

2008-11-26 22:25 . 2006-03-30 05:03 22,339 -ra------ c:\windows\SET101.tmp

2008-11-26 22:25 . 2004-08-04 05:00 13,753 -ra------ c:\windows\SETC6.tmp

2008-11-26 22:25 . 2005-03-30 12:54 10,559 -ra------ c:\windows\SET102.tmp

2008-11-26 20:18 . 2008-11-26 20:18 <DIR> d-------- c:\documents and settings\Alan

2008-11-26 19:29 . 2007-10-04 17:14 136,260 --a------ c:\windows\system32\nvapps.nvb

2008-11-26 18:51 . 2006-03-30 05:03 22,339 -ra------ c:\windows\SET12F.tmp

2008-11-26 18:51 . 2005-03-30 12:54 10,559 -ra------ c:\windows\SET132.tmp

2008-11-26 18:50 . 2004-08-04 05:00 1,086,058 -ra------ c:\windows\SETE8.tmp

2008-11-26 18:50 . 2004-08-04 05:00 1,042,903 -ra------ c:\windows\SETE5.tmp

2008-11-26 18:50 . 2004-08-04 05:00 13,753 -ra------ c:\windows\SETF4.tmp

2008-11-26 18:18 . 2008-04-14 07:00 58,880 --a------ c:\windows\system32\licwmi.dll

2008-11-26 18:18 . 2008-04-14 07:00 58,880 --a--c--- c:\windows\system32\dllcache\licwmi.dll

2008-11-26 18:12 . 2004-03-04 23:46 83,168 --a------ c:\windows\system32\S32EVNT1.DLL

2008-11-26 18:12 . 2004-03-04 23:46 82,832 --a------ c:\windows\system32\drivers\SYMEVENT.SYS

2008-11-26 18:04 . 2008-11-30 17:05 1,393 --a------ c:\windows\imsins.BAK

2008-11-26 16:57 . 2004-08-03 17:03 89,828 --a------ c:\windows\system32\actshell.htm

2008-11-26 08:09 . 2008-11-26 22:50 316,637 --a------ c:\windows\setupapi.old

2008-11-25 21:27 . 2008-11-25 21:27 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files

2008-11-24 22:10 . 2008-11-24 22:10 <DIR> d-------- C:\CCleaner

2008-11-24 07:56 . 2008-11-24 07:56 <DIR> d-------- C:\Unlocker

2008-11-24 07:56 . 2008-11-28 08:03 <DIR> d-------- c:\documents and settings\Dan\Application Data\Desktopicon

2008-11-23 17:52 . 2008-11-23 17:53 47,584 --a------ c:\windows\system32\wlxbilvoudhtlts.exe

2008-11-23 17:51 . 2008-11-25 23:10 <DIR> d-------- c:\windows\system32\ID2

2008-11-23 17:51 . 2008-11-23 23:49 <DIR> d-------- c:\windows\system32\gp2

2008-11-23 17:51 . 2008-11-23 23:05 <DIR> d-------- c:\windows\system32\dim

2008-11-23 17:51 . 2008-11-23 23:13 <DIR> d--hs---- c:\windows\RGFu

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-03 04:01 --------- d-----w c:\program files\Symantec AntiVirus

2008-11-29 21:43 --------- d-----w c:\documents and settings\Dan\Application Data\U3

2008-11-28 21:54 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-11-28 21:54 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft

2008-11-27 17:09 --------- d--h--w c:\program files\InstallShield Installation Information

2008-11-26 23:14 --------- d-----w c:\program files\Common Files\Symantec Shared

2008-11-26 23:13 --------- d-----w c:\program files\Symantec

2008-11-26 23:12 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Symantec

2008-11-18 22:45 --------- d-----w c:\documents and settings\Dan\Application Data\ZoomBrowser EX

2008-11-17 01:44 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\ZoomBrowser

2008-11-02 00:58 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-11-02 00:57 --------- d-----w c:\program files\iPod

2008-10-31 01:40 --------- d-----w c:\program files\Microsoft Location Finder

2008-10-27 13:31 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\CA

2008-10-27 02:17 --------- d-----w c:\program files\CA

2008-10-26 03:16 --------- d-----w c:\program files\Common Files\Scanner

2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-22 02:59 --------- d-----w c:\program files\Microsoft Silverlight

2008-10-09 18:04 --------- d-----w c:\documents and settings\Dan\Application Data\dvdcss

2008-10-03 15:25 --------- d-----w c:\documents and settings\Dan\Application Data\Skype

2007-07-24 05:00 28,672 ----a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll

2007-07-24 05:00 98,304 ----a-w c:\program files\mozilla firefox\plugins\atgpcext.dll

2007-07-24 05:00 86,016 ----a-w c:\program files\mozilla firefox\plugins\ieatgpc.dll

2007-07-24 05:00 90,112 ----a-w c:\program files\mozilla firefox\plugins\mwmcli.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]

"Aim6"="c:\program files\AIM6\aim6.exe" [2008-06-19 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]

"UnlockerAssistant"="c:\unlocker\UnlockerAssistant.exe" [2008-05-01 15872]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]

"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2008-10-01 289576]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680]

"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-03-12 124128]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]

"nwiz"="nwiz.exe" [2007-10-04 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Dan\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-23 113664]

BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-08-12 1048576]

Kodak EasyShare software.lnk - c:\kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 282624]

MA111 Configuration Utility.lnk - c:\program files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe [2008-11-27 1158144]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Sierra\\Empire Earth\\Empire Earth.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-28 28544]

R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-11-11 24652]

S0 cerc6;cerc6; []

S1 cbidf2kk;cbidf2kk;c:\windows\system32\drivers\cbidf2kk.sys []

S3 EraserUtilDrvI2;EraserUtilDrvI2;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI2.sys []

S3 PPCtlPriv;PPCtlPriv;"c:\program files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2008-10-26 185608]

S3 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" [2004-03-12 169192]

S3 WlanUIB;NETGEAR 802.11b USB Driver;c:\windows\system32\DRIVERS\MA111nd5.sys [2008-11-27 666624]

S4 Inenumtwsw;Inenumtwsw;c:\windows\system32\drivers\ntfs.sys [2008-04-14 574976]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e09e446-6318-11dc-a490-00095b670f99}]

\Shell\AutoRun\command - G:\setupSNK.exe

.

- - - - ORPHANS REMOVED - - - -

BHO-{F220DA67-7CA4-4597-863A-1BDA38BAD1D4} - (no file)

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

Notify-yayyWonM - yayyWonM.dll

.

------- Supplementary Scan -------

.

FireFox -: Profile - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\jt68c4rq.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - www.yahoo.com

FF -: plugin - c:\itunes\Mozilla Plugins\npitunes.dll

FF -: plugin - c:\mozilla firefox\plugins\np32dsw.dll

FF -: plugin - c:\mozilla firefox\plugins\npLegitCheckPlugin.dll

FF -: plugin - c:\mozilla firefox\plugins\npnul32.dll

FF -: plugin - c:\mozilla firefox\plugins\nppdf32.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin2.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin3.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin4.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin5.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin6.dll

FF -: plugin - c:\mozilla firefox\plugins\npqtplugin7.dll

FF -: plugin - c:\mozilla firefox\plugins\npViewpoint.dll

FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll

FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll

FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-02 23:04:18

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Symantec AntiVirus\DefWatch.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Analog Devices\SoundMAX\SMAgent.exe

c:\program files\Symantec AntiVirus\Rtvscan.exe

c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\program files\Canon\CAL\CALMAIN.exe

c:\windows\system32\rundll32.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\AIM6\aolsoftware.exe

.

**************************************************************************

.

Completion time: 2008-12-02 23:06:14 - machine was rebooted

ComboFix-quarantined-files.txt 2008-12-03 04:06:12

Pre-Run: 250,324,422,656 bytes free

Post-Run: 250,240,135,168 bytes free

302 --- E O F --- 2008-12-02 08:01:35

-------------------------------------------------------------------------------------------------

HIJACK THIS LOG

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:09:07 PM, on 12/2/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\QuickTime\QTTask.exe

C:\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\AIM6\aim6.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\TextPad 5\TextPad.exe

C:\Trend Micro\HijackThis\HijackThis.exe