Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

"advertisement" Pop Up Malware


  • This topic is locked This topic is locked
3 replies to this topic

#1 srg999999

srg999999

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:09 AM

Posted 17 April 2008 - 08:52 PM

Help. I keep having Advertisement pop up on my screen.
I have tried everything. Vundo Fix, ComboFix, Panda's PQRemove., AVG. I've run these in Safe Mode and regular boot up mode.
The latest attempt at Combofix seemed to cut down on the pop ups but I still get an advertisement pop up that says "Advertisement- Microsoft INternet Explorer" at the top of the window. Even if I have not opened the internet explorer program. I am guessing that internet explorer is not acutally opened but the malware is trying to get me to open it. Anyway I've attached the Hijack this log and the Combofix log below. ( I know I am not supposed to post a combofix log, but since I already ran the program I figured it may help to figure out how to resolve my problem), Please help me remove this software. THanks.

Hijack this log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:29 PM, on 4/17/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe
C:\Program Files\Twain\Twain.exe
C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\ApvxdWin.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WebProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimreal.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {584C5668-9E23-4BC2-989D-2FCA1A07B3E3} - C:\WINDOWS\System32\vtutu.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: BndBlock5 BHO Class - {82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B} - C:\Program Files\QdrDrive\QdrDrive10.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: (no name) - {E0E765A4-74A2-45BD-B1AF-AE07F2A174E7} - C:\WINDOWS\System32\vturr.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EF7D8850-CA99-405C-987C-3380ADE566A7} - C:\WINDOWS\System32\awvtr.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe"
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [AdwareProMFC] C:\Program Files\Ad-Ware Pro\Ad-Ware Pro.exe
O4 - HKCU\..\Run: [Rndo] "C:\DOCUME~1\ADMINI~1\APPLIC~1\RACLE~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe"
O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe"
O4 - HKCU\..\Run: [Smcse] C:\WINDOWS\?racle\u?erinit.exe
O4 - HKCU\..\Run: [Twain] C:\Program Files\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcxplode.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://modsecgat.dimeshare.com/mod/cds/ICA...ca32/ica32t.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.app...meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1135874778312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1172429600125
O16 - DPF: {A609CB6E-FEB5-47C3-966C-1B916842BD01} (Nlopflash Class) - http://poker.nlop.com/poker/PokerCreations.cab
O20 - Winlogon Notify: efcayyy - efcayyy.dll (file missing)
O20 - Winlogon Notify: ohjqxnbv - ohjqxnbv.dll (file missing)
O21 - SSODL: Cmpaplib - {CF7DC1AC-4560-46DC-A054-17CDF20F3692} - C:\WINDOWS\System32\bitamdel.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe

--
End of file - 9481 bytes

ComboFix Log:

ComboFix 08-04-13.1 - Administrator 2008-04-17 20:04:50.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.608 [GMT -4:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\RACLE~1
C:\Documents and Settings\Administrator\Application Data\RACLE~1\?racle\
C:\Documents and Settings\Administrator\Application Data\RACLE~1\javaw.exe
C:\Documents and Settings\Administrator\Application Data\WinTouch
C:\Documents and Settings\Administrator\Application Data\WinTouch\wintouch.cfg
C:\Documents and Settings\Administrator\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Administrator\Application Data\WinTouch\WTUninstaller.exe
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\CPV
C:\Program Files\CPV\CPV8.dll
C:\Program Files\CPV\CPV8.dll.lzma
C:\Program Files\inetget2
C:\Program Files\inetget2\SRInstaller.exe
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive15.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\dicy.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrModule\kwdy.gz
C:\Program Files\QdrModule\QdrModule15.exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\dicts.gz
C:\Program Files\QdrPack\QdrPack15.exe
C:\Program Files\QdrPack\trgts.gz
C:\Program Files\Temporary
C:\Program Files\Temporary\InsiDERInst.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\racle~1
C:\WINDOWS\racle~1\u?erinit.exe
C:\WINDOWS\system32\000070.exe
C:\WINDOWS\system32\000080.exe
C:\WINDOWS\system32\000090.exe
C:\WINDOWS\system32\eajeftfp.ini
C:\WINDOWS\system32\fncmapyo.ini
C:\WINDOWS\system32\fuomqsmg.dll
C:\WINDOWS\system32\jbwrbogw.dll
C:\WINDOWS\system32\kjukkdej.dll
C:\WINDOWS\system32\nnnnNDtS.dll
C:\WINDOWS\system32\omscsntm.dll
C:\WINDOWS\system32\pmnmkHaW.dll
C:\WINDOWS\system32\pngemrja.dll
C:\WINDOWS\system32\StDNnnnn.ini
C:\WINDOWS\system32\StDNnnnn.ini2
C:\WINDOWS\system32\stqvlpqe.dll
C:\WINDOWS\system32\tnntmmrh.ini
C:\WINDOWS\system32\wgobrwbj.ini
C:\WINDOWS\system32\xpcqljri.dll
C:\WINDOWS\system32\xpghck.dll
C:\WINDOWS\system32\ymsmtuhb.dll
C:\WINDOWS\system32\ypbwdnvm.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 )))))))))))))))))))))))))))))))
.

2008-04-17 07:05 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 07:05 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 07:05 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-17 07:05 . 2008-04-12 13:49 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-17 07:05 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-04-17 07:05 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-17 07:05 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-16 18:17 . 2008-04-16 18:25 3,660 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-16 16:28 . 2008-04-16 16:28 38,400 -ra------ C:\WINDOWS\mrofinu72.exe
2008-04-16 07:27 . 2008-04-16 07:33 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-15 20:40 . 2008-04-15 20:40 22 --a------ C:\WINDOWS\b104.exe.bin
2008-04-15 19:25 . 2008-04-15 19:25 <DIR> d-------- C:\Program Files\Inet_Get_2
2008-04-15 19:20 . 2008-04-15 20:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SpeedRunner
2008-04-15 19:15 . 2008-04-17 06:44 <DIR> d-------- C:\Program Files\Twain
2008-04-15 19:15 . 2008-04-15 19:15 9,216 --a------ C:\WINDOWS\system32\~.exe
2008-04-14 20:43 . 2008-04-14 17:43 74,240 --a------ C:\WINDOWS\b156.exe
2008-04-14 14:08 . 2008-04-14 11:08 46,592 --a------ C:\WINDOWS\b157.exe
2008-04-13 16:22 . 2008-04-13 16:22 281 --a------ C:\WINDOWS\system32\PavCPL.dat
2008-04-13 16:21 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-04-13 16:21 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-04-13 16:21 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-04-13 16:21 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-04-13 16:21 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-04-13 15:45 . 2008-04-13 15:45 3,648 --a------ C:\WINDOWS\system32\osairpsf.dll
2008-04-13 15:00 . 2008-04-13 15:00 3,648 --a------ C:\WINDOWS\system32\mehaabct.dll
2008-04-13 14:59 . 2008-04-13 20:33 <DIR> d-------- C:\Program Files\RcvSystem
2008-04-13 14:55 . 2008-04-13 16:30 <DIR> d-------- C:\WINDOWS\system32\PAV
2008-04-13 14:53 . 2008-04-13 14:55 <DIR> d-------- C:\Program Files\Mozilla Firefox(2)
2008-04-13 14:53 . 2008-04-13 14:53 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-11 10:48 . 2008-04-11 07:48 11,264 --a------ C:\WINDOWS\b138.exe
2008-04-08 19:33 . 2008-04-08 16:33 68,096 --a------ C:\WINDOWS\b155.exe
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L5807.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L53A2.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L4D97.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L4588.tmp
2008-04-04 13:25 . 2008-04-04 13:25 187,904 ---hs---- C:\Program Files\Common Files\Yazzle1552OinAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 00:01 13,880 ----a-w C:\WINDOWS\system32\drivers\COMFiltr.sys
2008-04-16 01:21 --------- d-----w C:\Program Files\TrojanHunter 4.6
2008-04-16 01:21 --------- d-----w C:\Program Files\ewido anti-malware
2008-03-30 22:19 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-03-02 14:26 73,728 ----a-w C:\WINDOWS\b153.exe
2008-02-29 11:28 --------- d-----w C:\Program Files\Google
2008-02-29 11:14 --------- d-----w C:\Program Files\Rhapsody
2008-02-29 11:12 --------- d-----w C:\Program Files\PartyGaming
2008-02-27 13:15 --------- d-----w C:\Program Files\Common Files\Panda Software
2008-02-27 12:00 --------- d-----w C:\Program Files\Panda Security
2008-02-20 13:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\sentinel
2008-02-20 12:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-30 13:25 60,968 ----a-w C:\Documents and Settings\Administrator\GoToAssistDownloadHelper.exe
2006-07-04 12:51 825,632 ----a-w C:\Documents and Settings\All Users\english.dat
2006-07-04 12:51 790,928 ----a-w C:\Documents and Settings\All Users\chinese.dat
2006-07-04 12:51 63,120 ----a-w C:\Documents and Settings\All Users\embeddedurls_new.dat
2006-07-04 12:51 596,608 ----a-w C:\Documents and Settings\All Users\spanish.dat
2006-07-04 12:51 54,416 ----a-w C:\Documents and Settings\All Users\extratings_insert.dat
2006-07-04 12:51 444,272 ----a-w C:\Documents and Settings\All Users\precaturls_new.dat
2006-07-04 12:51 258,048 ----a-w C:\Documents and Settings\All Users\UpdaterScript.exe
2006-05-30 01:02 24,192 ----a-w C:\Documents and Settings\Administrator\usbsermptxp.sys
2006-05-30 01:02 22,768 ----a-w C:\Documents and Settings\Administrator\usbsermpt.sys
2005-05-24 21:41 63,264 -c--a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2006-03-19 17:03 10,022 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-04_20.28.08.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-28 03:28:19 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE
+ 2008-04-18 00:10:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-07-11 13:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2000-08-31 12:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe
+ 2006-02-16 12:59:06 2,302 ----a-w C:\WINDOWS\fzko\fzko.dat
+ 2000-08-31 12:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
+ 2008-02-20 12:32:04 65,536 ----a-r C:\WINDOWS\Installer\{685A56F8-75B6-44AD-B3DA-FB0A3266B47C}\ARPPRODUCTICON.exe
+ 2004-12-27 20:27:11 2,560 -c--a-r C:\WINDOWS\Installer\{90190409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2004-12-27 20:07:58 2,560 -c--a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\07DVPZJ3.DAT
+ 2004-12-25 01:24:50 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\9RLBF53D.DAT
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\DZ1BR3Z1.DAT
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\VNB7Z3P7.DAT
+ 2004-12-25 01:24:53 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\XZB71BTN.DAT
- 2000-08-31 13:00:00 51,200 ----a-w C:\WINDOWS\NirCmd.exe
+ 2000-08-31 12:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2004-12-27 20:53:04 2,706 ----a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
+ 2000-08-31 12:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
+ 2000-08-31 12:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 12:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe
+ 2000-08-31 12:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system\KEYBOARD.DRV
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system\MCIAVI.DRV
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system\MCISEQ.DRV
+ 2001-09-26 00:01:20 28,160 ----a-w C:\WINDOWS\system\MCIWAVE.DRV
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system\MOUSE.DRV
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system\SOUND.DRV
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system\SYSTEM.DRV
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system\TIMER.DRV
+ 2001-09-26 00:02:48 2,176 ----a-w C:\WINDOWS\system\VGA.DRV
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system\WFWNET.DRV
+ 2002-08-29 14:41:32 132,096 ----a-w C:\WINDOWS\system\WINSPOOL.DRV
+ 2008-04-15 23:15:55 9,216 ----a-w C:\WINDOWS\system32\~.exe
- 2007-11-24 23:50:10 15,782 ----a-w C:\WINDOWS\system32\cmpusfav.dll
+ 2008-02-20 13:57:52 15,829 ----a-w C:\WINDOWS\system32\cmpusfav.dll
+ 2001-09-26 00:00:18 10,544 ----a-w C:\WINDOWS\system32\comm.drv
- 2008-01-05 01:24:45 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-18 00:10:16 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-11-14 21:39:58 2,173 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_10.dat
+ 2007-11-14 21:42:12 2,339 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_112.dat
+ 2007-11-14 21:42:37 2,277 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_134.dat
+ 2007-11-14 21:42:42 2,677 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_148.dat
+ 2007-11-14 21:42:43 1,505 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_153.dat
+ 2007-11-14 21:42:44 2,274 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_154.dat
+ 2007-11-14 21:42:46 1,638 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_163.dat
+ 2007-11-14 21:42:47 1,532 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_166.dat
+ 2007-11-14 21:42:50 2,834 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_176.dat
+ 2007-11-22 13:45:11 3,068 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_187.dat
+ 2007-11-22 13:45:14 1,884 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_195.dat
+ 2007-11-14 21:41:22 2,869 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_21.dat
+ 2007-11-14 21:41:23 2,104 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_22.dat
+ 2007-11-14 21:41:43 3,000 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_25.dat
+ 2007-11-14 21:41:48 1,621 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_40.dat
+ 2007-11-14 21:41:49 2,523 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_43.dat
+ 2007-11-14 21:39:55 1,666 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_5.dat
+ 2007-11-14 21:41:53 2,335 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_57.dat
+ 2007-11-14 21:41:58 1,819 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_75.dat
+ 2007-11-14 21:42:00 2,314 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_79.dat
+ 2007-11-14 21:39:58 2,761 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_9.dat
- 2008-01-05 01:24:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-04-18 00:10:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-01-05 01:24:45 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-18 00:10:16 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2002-08-29 14:57:58 1,740 -c--a-w C:\WINDOWS\system32\Dcache.bin
+ 2002-08-29 06:32:34 2,816 -c--a-w C:\WINDOWS\system32\dllcache\drmkaud.sys
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system32\dllcache\keyboard.drv
+ 2001-09-26 00:01:20 2,560 -c--a-w C:\WINDOWS\system32\dllcache\lz32.dll
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system32\dllcache\mciavi.drv
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system32\dllcache\mciseq.drv
+ 2001-09-26 00:01:20 28,160 -c--a-w C:\WINDOWS\system32\dllcache\mciwave.drv
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system32\dllcache\mouse.drv
+ 2001-09-26 00:01:56 2,944 -c--a-w C:\WINDOWS\system32\dllcache\null.sys
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system32\dllcache\sound.drv
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system32\dllcache\system.drv
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system32\dllcache\timer.drv
+ 2001-09-26 00:02:48 2,176 -c--a-w C:\WINDOWS\system32\dllcache\vga.drv
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system32\dllcache\wfwnet.drv
+ 2001-09-26 00:03:10 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll
+ 2002-08-29 14:41:32 132,096 -c--a-w C:\WINDOWS\system32\dllcache\winspool.drv
+ 2001-09-26 00:03:10 2,112 -c--a-w C:\WINDOWS\system32\dllcache\winspool.exe
+ 2001-09-26 00:03:16 2,736 -c--a-w C:\WINDOWS\system32\dllcache\wowdeb.exe
- 2005-08-12 19:36:56 16,640 ----a-w C:\WINDOWS\system32\drivers\cpoint.sys
+ 2007-06-08 12:44:06 24,760 ----a-w C:\WINDOWS\system32\drivers\cpoint.sys
+ 2002-08-29 06:32:34 2,816 ----a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2001-09-26 00:01:56 2,944 ----a-w C:\WINDOWS\system32\drivers\null.sys
- 2006-02-22 08:43:34 71,552 ----a-r C:\WINDOWS\system32\drivers\pavdrv51.sys
+ 2007-06-06 14:43:32 83,640 ----a-w C:\WINDOWS\system32\drivers\pavdrv51.sys
- 2006-04-25 15:02:48 165,120 ----a-r C:\WINDOWS\system32\drivers\PavProc.sys
+ 2007-07-12 18:49:38 178,872 ----a-w C:\WINDOWS\system32\drivers\PavProc.sys
+ 2007-05-23 20:40:30 38,968 ----a-w C:\WINDOWS\system32\drivers\ShlDrv51.sys
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system32\keyboard.drv
+ 2001-09-26 00:01:18 221,600 -c--a-w C:\WINDOWS\system32\lanman.drv
- 2006-11-22 17:37:20 143,360 ----a-w C:\WINDOWS\system32\libexpat.dll
+ 2008-03-15 01:37:59 151,552 ----a-w C:\WINDOWS\system32\libexpat.dll
+ 2001-09-26 00:01:20 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
+ 2006-11-09 19:46:28 190,072 ----a-w C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system32\mciavi.drv
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system32\mciseq.drv
+ 2001-09-26 00:01:20 28,160 ----a-w C:\WINDOWS\system32\mciwave.drv
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system32\mouse.drv
+ 2001-09-26 00:01:34 20,480 ----a-w C:\WINDOWS\system32\msacm32.drv
+ 2002-08-29 14:41:32 184,320 ----a-w C:\WINDOWS\system32\msh261.drv
+ 2002-08-29 14:50:10 286,720 ----a-w C:\WINDOWS\system32\msh263.drv
- 2004-02-25 16:05:28 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
+ 2006-02-03 16:00:00 348,160 ----a-w C:\WINDOWS\system32\MSVCR71.DLL
+ 2001-09-26 00:01:50 2,656 -c--a-w C:\WINDOWS\system32\netware.drv
- 2007-12-11 01:38:47 52,996 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-13 20:30:16 52,996 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-12-11 01:38:47 380,966 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-13 20:30:16 380,966 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-10-17 07:33:10 2,048,000 ----a-w C:\WINDOWS\system32\python25.dll
- 2007-12-09 22:12:38 48,480 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-04-13 18:56:02 449,512 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system32\sound.drv
+ 2003-12-23 18:49:58 2,348 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\E_A4X2D1.DAT
+ 2006-04-03 09:00:00 2,981 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FAIFBIA.DAT
+ 2003-12-23 18:49:58 2,348 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_c845b4d\E_A4X2D1.DAT
+ 2006-04-03 09:00:00 2,981 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_cx60008c3e\E_FAIFBIA.DAT
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system32\system.drv
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system32\timer.drv
- 2006-07-05 10:46:36 205,696 ----a-w C:\WINDOWS\system32\vbamac32.dll
+ 2006-07-05 10:46:36 177,218 ----a-w C:\WINDOWS\system32\vbamac32.dll
+ 2001-09-26 00:02:48 2,176 -c--a-w C:\WINDOWS\system32\vga.drv
+ 2001-08-18 03:37:04 22,016 ----a-w C:\WINDOWS\system32\wdmaud.drv
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system32\wfwnet.drv
+ 2001-09-26 00:03:10 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
+ 2002-08-29 14:41:32 132,096 ----a-w C:\WINDOWS\system32\winspool.drv
+ 2001-09-26 00:03:10 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
+ 2001-09-26 00:03:16 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
- 2006-11-22 17:41:14 282,112 ----a-w C:\WINDOWS\system32\wxIE.dll
+ 2008-03-15 01:37:59 300,816 ----a-w C:\WINDOWS\system32\wxIE.dll
+ 2000-08-31 12:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2006-12-02 03:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-02 03:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 03:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 03:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 05:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 05:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 05:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 05:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 05:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
+ 2000-08-31 12:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{584C5668-9E23-4BC2-989D-2FCA1A07B3E3}]
C:\WINDOWS\System32\vtutu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B}]
C:\Program Files\QdrDrive\QdrDrive10.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E0E765A4-74A2-45BD-B1AF-AE07F2A174E7}]
C:\WINDOWS\System32\vturr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF7D8850-CA99-405C-987C-3380ADE566A7}]
C:\WINDOWS\System32\awvtr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 10:41 13312]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe" [2003-04-29 11:40 524288]
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" [ ]
"AdwareProMFC"="C:\Program Files\Ad-Ware Pro\Ad-Ware Pro.exe" [ ]
"Rndo"="C:\DOCUME~1\ADMINI~1\APPLIC~1\RACLE~1\javaw.exe" [ ]
"QdrModule15"="C:\Program Files\QdrModule\QdrModule15.exe" [ ]
"QdrPack15"="C:\Program Files\QdrPack\QdrPack15.exe" [ ]
"Smcse"="C:\WINDOWS\?racle\u?erinit.exe" [ ]
"Twain"="C:\Program Files\Twain\Twain.exe" [2008-04-15 19:15 57344]
"SpeedRunner"="C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe" [2008-04-15 19:20 181248]
"SfKg6wIP"="C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe" [2008-04-15 19:20 35328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-02-10 12:55 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-02-10 12:51 118784]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 106544 C:\WINDOWS\system32\TWEAKUI.CPL]
"EPSON Stylus C84 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 04:00 99840]
"EPSON Stylus C84 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 04:00 99840]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2003-12-01 12:38 892928]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 05:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07 49263]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-02-25 14:41:01 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Cmpaplib"= {CF7DC1AC-4560-46DC-A054-17CDF20F3692} - C:\WINDOWS\System32\bitamdel.dll [2006-07-05 06:46 843776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayyy]
efcayyy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ohjqxnbv]
ohjqxnbv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^xhxp.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\xhxp.exe
backup=C:\WINDOWS\pss\xhxp.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2002-08-29 10:41 13312 C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-06-01 16:51 257088 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-04-27 09:41 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsync]
C:\WINDOWS\System32\wiwyar.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R1 ewido security suite driver;ewido security suite driver;C:\Program Files\ewido anti-malware\guard.sys [2005-12-30 07:12]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\System32\Drivers\ShlDrv51.sys [2007-05-23 16:40]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\System32\DRIVERS\PavProc.sys [2007-07-12 14:49]
R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys [2008-04-17 20:12]
S3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\System32\PavSRK.sys []
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\System32\PavTPK.sys []
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\System32\Drivers\usbbc.sys [2001-01-07 21:53]

*Newly Created Service* - COMFILTR
.
Contents of the 'Scheduled Tasks' folder
"2008-03-06 03:23:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 20:11:10
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\System32\bitamdel.dll
-> C:\WINDOWS\System32\camohaut.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PAVSRV51.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrlS.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WEBPROXY.EXE
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-17 20:15:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-18 00:15:21
ComboFix2.txt 2008-01-05 01:28:56
Pre-Run: 19,702,435,840 bytes free
Post-Run: 20,227,022,848 bytes free

BC AdBot (Login to Remove)

 


#2 Simon V.

Simon V.

  • Members
  • 439 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 26 April 2008 - 10:31 AM

Hello, and welcome to the forum.

My name is Simon V., and I'll be glad to help you with your computer problems.

Please download and install CCleaner.

Open CCleaner. On the Windows tab, leave the default options alone.
  • On the Applications tab, check (tick) all the boxes except Saved Form Information. This will remove all your saved passwords if you leave this box checked.
  • Click on the Run Cleaner button at the bottom right hand corner.
  • When the cleaner has completed, click Tools in the Left Pane.
  • Verify that Uninstall is highlighted in color, or click on it.
  • In the lower right, click Save to Text File.
  • Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
  • You can leave the filename as install.txt.
  • Click Save, then exit Ccleaner.
_____________________________

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

Posted Image

Download the file & save it as it's originally named, next to ComboFix.exe.

Now close all open windows and programs, including all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

Posted Image

Reffering to the image above, drag the setup package onto ComboFix.exe and drop it.

Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

At the next prompt, click 'Yes' to run the full ComboFix scan.

Posted Image

When the tool is finished, it will produce a report for you.
Please post the Combofix log (C:\ComboFix.txt) along with a new HijackThis log and the CCleaner Uninstall List (install.txt) for further review.
Simon V.

Posted Image
Posted Image

So How Did I Get Infected In The First Place?
Stand Up and Be Counted!

My help at this forum is free, but if you wish to make a donation to help me continue the fight against malware - click here.

#3 Simon V.

Simon V.

  • Members
  • 439 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 30 April 2008 - 12:30 PM

Do you still need help?
Simon V.

Posted Image
Posted Image

So How Did I Get Infected In The First Place?
Stand Up and Be Counted!

My help at this forum is free, but if you wish to make a donation to help me continue the fight against malware - click here.

#4 Simon V.

Simon V.

  • Members
  • 439 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:09 AM

Posted 02 May 2008 - 07:51 AM

Due to inactivity this topic will be closed.

If you need help please start a new thread and post a new HijackThis log.
Simon V.

Posted Image
Posted Image

So How Did I Get Infected In The First Place?
Stand Up and Be Counted!

My help at this forum is free, but if you wish to make a donation to help me continue the fight against malware - click here.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users