Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Possible Virus Infection?


  • This topic is locked This topic is locked
25 replies to this topic

#1 GHM

GHM

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 16 April 2007 - 08:43 PM

Hi, I've been reading the forums here for a while now, but now need help to fix my problem.

Firstly, here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 6:25:38 PM, on 4/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system\msnmsgr32.exe
C:\WINDOWS\system\msnntlp.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\TEMP\F617.tmp
C:\WINDOWS\sttray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\GHM\My Documents\stng260.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SvcHost] svshost.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SvrHost] svrhost.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [SvcHost] svshost.exe
O4 - HKLM\..\RunServices: [SvrHost] svrhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1175216552296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175219153078
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe
O23 - Service: msnntlp - Unknown owner - C:\WINDOWS\system\msnntlp.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Things are usually ok after I load up Windows XP but once I start up Internet Explorer, or use the internet in other ways (such as MSN), I start seeing a lot of problems.

Starting IE hits me with a lot of pop ups, and most of the times, it freezes up my system, forcing me to shutdown/reset.

I also find lots of files such as stng260.exe and msvista.exe coming up. Some I can delete, but more often than not they usually come back after I restart my computer. Others say they are being used by another person or program.

The activity LED on my tower just seems to be going non-stop, even right after I boot up and I just let the computer sit.

I've tried Adaware, Spybot, McAfee Stinger and it doesn't seem to turn up anything.

Thank you.

BC AdBot (Login to Remove)

 


#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 17 April 2007 - 05:12 AM

Welcome to the BleepingComputer HijackThis forum GHM :thumbsup:

Please go to:
C:\Program Files\Hijackthis\HijackThis.exe
Right click on Hijackthis.exe and select 'Rename', rename it to abc.bat
Double click on abc.bat(which is still Hijackthis.exe),post that log into your next reply please.
Posted Image
Posted Image

#3 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 17 April 2007 - 09:18 PM

Thank you :thumbsup: RichieUK!

Ok, I renamed the file to abc.bat and here is the log:


Logfile of HijackThis v1.99.1
Scan saved at 7:08:56 PM, on 4/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system\msnmsgr32.exe
C:\WINDOWS\sttray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system\msnntlp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\TEMP\16E9.tmp
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\abc.bat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {1727E192-C7F8-470C-9359-41DC22FE2760} - C:\WINDOWS\system32\mllmn.dll
O2 - BHO: (no name) - {45996C93-2BF7-4116-BA84-E2C11A46F80F} - C:\WINDOWS\system32\ddccyww.dll (file missing)
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\nicbttoa.dll (file missing)
O2 - BHO: (no name) - {8082AAE4-0635-4026-906A-30B64EB5155D} - C:\WINDOWS\System32\pmkjk.dll (file missing)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AFC9BF99-BFD7-4CCA-9D5E-025A63757211} - C:\WINDOWS\system32\awtturr.dll
O2 - BHO: (no name) - {BD36B5EC-4815-4EB0-BFF0-31F5DD6F6409} - C:\WINDOWS\system32\ddayy.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SvcHost] svshost.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SvrHost] svrhost.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rqpdgrod.dll",setvm
O4 - HKLM\..\RunServices: [SvcHost] svshost.exe
O4 - HKLM\..\RunServices: [SvrHost] svrhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1175216552296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175219153078
O20 - Winlogon Notify: awtturr - C:\WINDOWS\SYSTEM32\awtturr.dll
O20 - Winlogon Notify: mllmn - C:\WINDOWS\system32\mllmn.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: xxyaabb - C:\WINDOWS\SYSTEM32\xxyaabb.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe
O23 - Service: msnntlp - Unknown owner - C:\WINDOWS\system\msnntlp.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


Thank you!

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 18 April 2007 - 03:54 AM

Please download VundoFix.exe to your desktop.
Double-click VundoFix.exe to run it.
When VundoFix re-opens,click the "Scan for Vundo" button.
Once it's done scanning,click the "Remove Vundo" button.
You will receive a prompt asking if you want to remove the files, click "YES".
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed,it will prompt that it will reboot your computer,click "OK".
Please post the contents of C:\vundofix.txt into your next reply,along with a new Hijackthis log.

Note:
It is possible that VundoFix encountered a file it could not remove.
In this case,VundoFix will run on reboot,simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Edited by RichieUK, 18 April 2007 - 03:54 AM.

Posted Image
Posted Image

#5 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 18 April 2007 - 07:13 AM

Downloaded VundoFix and ran it twice, the logs are below:

Logfile of HijackThis v1.99.1
Scan saved at 5:05:57 AM, on 4/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system\msnmsgr32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system\msnntlp.exe
C:\WINDOWS\sttray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\TEMP\218A.tmp
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\abc.bat.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
O2 - BHO: (no name) - {1727E192-C7F8-470C-9359-41DC22FE2760} - C:\WINDOWS\system32\mllmn.dll (file missing)
O2 - BHO: (no name) - {45996C93-2BF7-4116-BA84-E2C11A46F80F} - C:\WINDOWS\system32\ddccyww.dll (file missing)
O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\nicbttoa.dll (file missing)
O2 - BHO: (no name) - {8082AAE4-0635-4026-906A-30B64EB5155D} - C:\WINDOWS\System32\pmkjk.dll (file missing)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AFC9BF99-BFD7-4CCA-9D5E-025A63757211} - C:\WINDOWS\system32\awtturr.dll
O2 - BHO: (no name) - {BD36B5EC-4815-4EB0-BFF0-31F5DD6F6409} - C:\WINDOWS\system32\ddayy.dll (file missing)
O2 - BHO: (no name) - {D6A7A250-2E29-469A-A99D-F03421A26981} - C:\WINDOWS\system32\pmnlk.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SvcHost] svshost.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SvrHost] svrhost.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rqpdgrod.dll",setvm
O4 - HKLM\..\RunServices: [SvcHost] svshost.exe
O4 - HKLM\..\RunServices: [SvrHost] svrhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1175216552296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175219153078
O20 - Winlogon Notify: awtturr - C:\WINDOWS\SYSTEM32\awtturr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: xxyaabb - C:\WINDOWS\SYSTEM32\xxyaabb.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe
O23 - Service: msnntlp - Unknown owner - C:\WINDOWS\system\msnntlp.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe




VundoFix V6.3.19

Checking Java version...

Sun Java not detected
Scan started at 3:05:42 PM 4/14/2007

Listing files found while scanning....

C:\WINDOWS\system32\ddayy.dll
C:\WINDOWS\system32\ddccyww.dll
C:\WINDOWS\system32\gwytoxhx.dll
C:\WINDOWS\System32\hginaiid.dll
C:\WINDOWS\system32\nicbttoa.dll
C:\WINDOWS\system32\opnmlll.dll
C:\WINDOWS\system32\qomjghg.dll
C:\WINDOWS\system32\qommjgg.dll
C:\WINDOWS\system32\ssqqnlj.dll
C:\WINDOWS\system32\tuvsttt.dll
C:\WINDOWS\system32\xhxotywg.ini
C:\WINDOWS\system32\xxyyxvs.dll
C:\WINDOWS\system32\yyadd.bak1
C:\WINDOWS\system32\yyadd.ini
C:\WINDOWS\system32\yyadd.ini2
C:\WINDOWS\system32\yyadd.tmp

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ddayy.dll
C:\WINDOWS\system32\ddayy.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddccyww.dll
C:\WINDOWS\system32\ddccyww.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gwytoxhx.dll
C:\WINDOWS\system32\gwytoxhx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nicbttoa.dll
C:\WINDOWS\system32\nicbttoa.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\opnmlll.dll
C:\WINDOWS\system32\opnmlll.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qomjghg.dll
C:\WINDOWS\system32\qomjghg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qommjgg.dll
C:\WINDOWS\system32\qommjgg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqqnlj.dll
C:\WINDOWS\system32\ssqqnlj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvsttt.dll
C:\WINDOWS\system32\tuvsttt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xhxotywg.ini
C:\WINDOWS\system32\xhxotywg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyyxvs.dll
C:\WINDOWS\system32\xxyyxvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yyadd.bak1
C:\WINDOWS\system32\yyadd.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yyadd.ini
C:\WINDOWS\system32\yyadd.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\yyadd.ini2
C:\WINDOWS\system32\yyadd.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\yyadd.tmp
C:\WINDOWS\system32\yyadd.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.19

Checking Java version...

Sun Java not detected
Scan started at 3:17:55 PM 4/14/2007

Listing files found while scanning....

C:\WINDOWS\system32\ddcyv.dll
C:\WINDOWS\system32\vycdd.bak1
C:\WINDOWS\system32\vycdd.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ddcyv.dll
C:\WINDOWS\system32\ddcyv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vycdd.bak1
C:\WINDOWS\system32\vycdd.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\vycdd.ini
C:\WINDOWS\system32\vycdd.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.19

Checking Java version...

Sun Java not detected
Scan started at 4:10:46 AM 4/18/2007

Listing files found while scanning....

C:\WINDOWS\system32\lnlbnsjn.dll
C:\WINDOWS\system32\mllmn.dll
C:\WINDOWS\system32\nmllm.bak1
C:\WINDOWS\system32\nmllm.bak2
C:\WINDOWS\system32\nmllm.ini
C:\WINDOWS\system32\nmllm.ini2
C:\WINDOWS\system32\rqpdgrod.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\lnlbnsjn.dll
C:\WINDOWS\system32\lnlbnsjn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mllmn.dll
C:\WINDOWS\system32\mllmn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nmllm.bak1
C:\WINDOWS\system32\nmllm.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\nmllm.bak2
C:\WINDOWS\system32\nmllm.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\nmllm.ini
C:\WINDOWS\system32\nmllm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\nmllm.ini2
C:\WINDOWS\system32\nmllm.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\rqpdgrod.dll
C:\WINDOWS\system32\rqpdgrod.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.19

Checking Java version...

Sun Java not detected
Scan started at 4:51:10 AM 4/18/2007

Listing files found while scanning....

C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\klnmp.ini
C:\WINDOWS\system32\pmnlk.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\klnmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\klnmp.ini
C:\WINDOWS\system32\klnmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\system32\pmnlk.dll Has been deleted!

Performing Repairs to the registry.
Done!

#6 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 18 April 2007 - 07:52 AM

Download Avenger from the link below:
http://swandog46.geekstogo.com/avenger.zip
Unzip/extract it to your desktop.

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens,copy and paste ALL the following bold blue text in the Quote box below:

Files to delete:
C:\WINDOWS\system\msnntlp.exe
C:\WINDOWS\SYSTEM32\xxyaabb.dll
C:\WINDOWS\SYSTEM32\awtturr.dll
C:\WINDOWS\system32\rqpdgrod.dll

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt into your next reply.
Also post a new Hijackthis log please.
Posted Image
Posted Image

#7 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 18 April 2007 - 06:00 PM

Here is the new HJT log after I followed your instructions with Avenger:

Logfile of HijackThis v1.99.1
Scan saved at 3:53:39 PM, on 4/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system\msnmsgr32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sttray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\TEMP\10D3.tmp
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\ANTONI~1\LOCALS~1\Temp\601A.tmp
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\HijackThis\abc.bat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\movwgfrn.dll
O2 - BHO: (no name) - {1727E192-C7F8-470C-9359-41DC22FE2760} - C:\WINDOWS\system32\mllmn.dll (file missing)
O2 - BHO: (no name) - {45996C93-2BF7-4116-BA84-E2C11A46F80F} - C:\WINDOWS\system32\ddccyww.dll (file missing)
O2 - BHO: (no name) - {8082AAE4-0635-4026-906A-30B64EB5155D} - C:\WINDOWS\System32\pmkjk.dll (file missing)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AFC9BF99-BFD7-4CCA-9D5E-025A63757211} - C:\WINDOWS\system32\awtturr.dll (file missing)
O2 - BHO: (no name) - {BD36B5EC-4815-4EB0-BFF0-31F5DD6F6409} - C:\WINDOWS\system32\ddayy.dll (file missing)
O2 - BHO: (no name) - {D6A7A250-2E29-469A-A99D-F03421A26981} - C:\WINDOWS\system32\pmnlk.dll (file missing)
O2 - BHO: (no name) - {F81EE890-BC96-42CC-9A24-8AC7F9A30D00} - C:\WINDOWS\system32\awtsr.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SvcHost] svshost.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SvrHost] svrhost.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rqpdgrod.dll",setvm
O4 - HKLM\..\RunServices: [SvcHost] svshost.exe
O4 - HKLM\..\RunServices: [SvrHost] svrhost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1175216552296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175219153078
O20 - Winlogon Notify: awtsr - C:\WINDOWS\system32\awtsr.dll
O20 - Winlogon Notify: awtturr - awtturr.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: xxyaabb - xxyaabb.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe
O23 - Service: msnntlp - Unknown owner - C:\WINDOWS\system\msnntlp.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\rnxuvohb

*******************

Script file located at: \??\C:\ohfsfihb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system\msnntlp.exe deleted successfully.
File C:\WINDOWS\SYSTEM32\xxyaabb.dll deleted successfully.
File C:\WINDOWS\SYSTEM32\awtturr.dll deleted successfully.


File C:\WINDOWS\system32\rqpdgrod.dll not found!
Deletion of file C:\WINDOWS\system32\rqpdgrod.dll failed!

Could not process line:
C:\WINDOWS\system32\rqpdgrod.dll
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

#8 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 18 April 2007 - 07:15 PM

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens,copy and paste ALL the following bold blue text in the Quote box below:

Files to delete:
C:\WINDOWS\system32\movwgfrn.dll
C:\WINDOWS\system32\awtsr.dll

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

**************************

Click on Start>Run and type Services.msc then hit Ok.
Scroll down and find the service called:
msnntlp
When you find it, double-click on it.
In the next window that opens, click the 'Stop' button.
Then change the 'Startup Type:' to 'Disabled'.
Now press Apply and then Ok and close any open windows.

**************************

Please make sure all hidden files are showing:

* Click 'Start'.
* Open 'My Computer'.
* Select the 'Tools' menu and click 'Folder Options'.
* Select the 'View' tab.
* Under the 'Hidden files and folders' heading select 'Show hidden files and folders'.
* Uncheck the 'Hide file extensions for known types' option.
* Uncheck the 'Hide protected operating system files (recommended)' option.
* Click Yes to confirm.
* Click OK.

*******************************

Download/install AVG Anti-Spyware 7.5.

Please follow these instructions very carefully.

Launch/start up AVG Anti-Spyware.
On the main page click the 'Update' tab,and then 'Start Update'.
Note:
If you have any problems running the update process prior to running the scan,download/install the 'Full Database' from here:
http://download.ewido.net/avgas-signatures-full-current.exe

Once the updates have been installed,do the following:
Select the 'Scanner' icon at the top of the screen, then select the 'Settings' tab.
Once in the 'Settings' screen,under 'How to act?',then under 'Set default action for detected malware to:', click on 'Recommended actions',then click on 'Quarantine'.
Under 'Reports' select 'Automatically generate report after every scan' and unselect 'Only if threats were found'.
Exit AVG Anti-Spyware,don't run the scan just yet.

You might want to print/copy the following as you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Have Hijack This fix the following [If still present], by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:

O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\movwgfrn.dll
O2 - BHO: (no name) - {1727E192-C7F8-470C-9359-41DC22FE2760} - C:\WINDOWS\system32\mllmn.dll (file missing)
O2 - BHO: (no name) - {45996C93-2BF7-4116-BA84-E2C11A46F80F} - C:\WINDOWS\system32\ddccyww.dll (file missing)
O2 - BHO: (no name) - {8082AAE4-0635-4026-906A-30B64EB5155D} - C:\WINDOWS\System32\pmkjk.dll (file missing)
O2 - BHO: (no name) - {AFC9BF99-BFD7-4CCA-9D5E-025A63757211} - C:\WINDOWS\system32\awtturr.dll (file missing)
O2 - BHO: (no name) - {BD36B5EC-4815-4EB0-BFF0-31F5DD6F6409} - C:\WINDOWS\system32\ddayy.dll (file missing)
O2 - BHO: (no name) - {D6A7A250-2E29-469A-A99D-F03421A26981} - C:\WINDOWS\system32\pmnlk.dll (file missing)
O2 - BHO: (no name) - {F81EE890-BC96-42CC-9A24-8AC7F9A30D00} - C:\WINDOWS\system32\awtsr.dll
O4 - HKLM\..\Run: [SvcHost] svshost.exe
O4 - HKLM\..\Run: [SvrHost] svrhost.exe
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\rqpdgrod.dll",setvm
O4 - HKLM\..\RunServices: [SvcHost] svshost.exe
O4 - HKLM\..\RunServices: [SvrHost] svrhost.exe
O20 - Winlogon Notify: awtsr - C:\WINDOWS\system32\awtsr.dll
O20 - Winlogon Notify: awtturr - awtturr.dll (file missing)
O20 - Winlogon Notify: xxyaabb - xxyaabb.dll (file missing)
O23 - Service: msnntlp - Unknown owner - C:\WINDOWS\system\msnntlp.exe (file missing)


Find and delete:
C:\DOCUMENTS AND sETTINGS\ANTONI~1\LOCALSETTINGS\Temp<-Delete everything inside this Temp folder.

Still in Safe Mode launch AVG Anti-Spyware.
Click the 'Scanner' icon at the top.
To start the scan click on 'Complete System Scan'.
Please be patient,it takes a while for the scan to finish.

Once the scan is complete,do the following.
If AVG Anti-Spyware detected any infected objects:,click on 'Apply All Actions'.

Next click on 'Save Report'.
Copy and paste that report into your next reply.
The report can be found under the 'Reports' tab at the top.
Close AVG Anti-Spyware when you've done.
Reboot normally.

Post the AVG Anti Spyware report and a new Hijackthis log into your next reply.
Let me know how your pc is running now please.
Posted Image
Posted Image

#9 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 19 April 2007 - 07:59 PM

It definitely feels like my PC is running a lot smoother now! However, I still notice a lot of files such as 21F6.TMP files I cant seem to get rid off, I've noticed them in my HJT log.

You had instructed the following in your last post:
C:\DOCUMENTS AND sETTINGS\ANTONI~1\LOCALSETTINGS\Temp<-Delete everything inside this Temp folder.
However, I was unable to delete everything, there was a "index.dat" file in some of the folders that I couldn't delete.


Here are the new logs:

Logfile of HijackThis v1.99.1
Scan saved at 5:47:30 PM, on 4/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sttray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system\msnmsgr32.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\TEMP\21F6.tmp
C:\DOCUME~1\ANTONI~1\LOCALS~1\Temp\28C7.tmp
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\HijackThis\abc.bat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1175216552296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175219153078
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 5:43:55 PM 4/19/2007

+ Scan result:



C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.147:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.148:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.149:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@buzznet.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@microsoftwlmessengermkt.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@multiply.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@pch.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio lau@www.abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ads.adbrite[3].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@adengage[1].txt -> TrackingCookie.Adengage : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.83:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.84:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.76:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.77:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.78:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.79:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.80:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.44:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@bfast[1].txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.175:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.176:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@banner.casinoking[2].txt -> TrackingCookie.Casinoking : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@casinoking[2].txt -> TrackingCookie.Casinoking : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio lau@banner.casinolasvegas[2].txt -> TrackingCookie.Casinolasvegas : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio lau@casinolasvegas[1].txt -> TrackingCookie.Casinolasvegas : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@clickbank[1].txt -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio lau@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.47:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@enhance[1].txt -> TrackingCookie.Enhance : Cleaned.
:mozilla.169:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.170:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.171:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.172:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.173:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.136:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.137:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.138:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.139:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.142:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.69:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.70:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.71:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.72:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.
:mozilla.188:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.189:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.204:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.205:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.206:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.207:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.208:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.209:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.38:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.39:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.40:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.41:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.42:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.43:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.45:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.46:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-ctv.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-eline.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-foxmovies.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-futurepub.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-hollywood.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-hollywoodmedia.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-wizardsofthecoast.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ehg-youtube.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.73:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.74:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@searchportal.information[1].txt -> TrackingCookie.Information : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@kmpads[1].txt -> TrackingCookie.Kmpads : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@search.live[2].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@sales.liveperson[3].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@server.iad.liveperson[3].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.95:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@stat.onestat[2].txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.82:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@paycounter[2].txt -> TrackingCookie.Paycounter : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@www.paypal[1].txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.112:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.116:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.117:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.118:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@pro-market[2].txt -> TrackingCookie.Pro-market : Cleaned.
:mozilla.49:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.50:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.100:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.101:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.102:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.103:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.105:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.97:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.98:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.99:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio lau@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.121:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.122:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.123:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.124:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.125:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.126:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@sextracker[2].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.157:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.143:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.144:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.145:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.146:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.85:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.110:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.64:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.65:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.66:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.67:C:\Documents and Settings\Antonio Lau\Application Data\Mozilla\Firefox\Profiles\9kt02rma.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio_lau@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Antonio Lau\Cookies\antonio lau@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP2\A0002486.exe -> Trojan.LdPinch.bia : Cleaned with backup (quarantined).
C:\avenger\backup-Thu 04.19.2007-16.37.41.29.zip/avenger/msnntlp.exe -> Trojan.LdPinch.bia : Cleaned with backup (quarantined).


::Report end


Thank you!

#10 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 20 April 2007 - 02:30 AM

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

You should copy/print the following because you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE" using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
* Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
* Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
* Once the short scan has finished, Click Options > Change settings
* Choose the "Scan tab" and UNcheck "Heuristic analysis"
* Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
* Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
* When done, a message will be displayed at the bottom advising if any viruses were found.
* Click "Yes to all" if it asks if you want to cure/move the file.
* When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
* Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
* Save the DrWeb.csv report to your desktop.
* Exit Dr.Web Cureit when done.
* Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
* After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
* Also post a new Hijackthis log please.
Posted Image
Posted Image

#11 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 22 April 2007 - 05:44 AM

Here are the new logs:

Logfile of HijackThis v1.99.1
Scan saved at 3:38:40 AM, on 4/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sttray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system\msnmsgr32.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\TEMP\1992.tmp
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\abc.bat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1175216552296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175219153078
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: msn msgr 32-bit client process (msnmsgr32) - Unknown owner - C:\WINDOWS\system\msnmsgr32.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


A0002250.dll;C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP2;Trojan.Virtumod;Deleted.;
A0002251.dll;C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP2;Trojan.Virtumod;Deleted.;
A0002484.dll;C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP2;Trojan.Virtumod;Deleted.;
A0002487.dll;C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP2;Trojan.Virtumod;Deleted.;
A0002596.dll;C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP3;Trojan.Virtumod;Deleted.;
A0002598.dll;C:\System Volume Information\_restore{534C962F-01F6-4BA1-AFA6-27C7D16EC0BC}\RP3;Trojan.Virtumod;Deleted.;
awtstsq.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
byxutro.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
ddayy.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
ddcbayw.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
ddcbcde.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
ddccyww.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
ddcyv.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
fccdcyw.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
gwytoxhx.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
hggecaa.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
hgghgff.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
iifcccd.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
lnlbnsjn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
mllmn.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
nicbttoa.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
nnnkjhh.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
opnmlll.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
pmnlk.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
qomjghg.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
qomjhih.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
qomjiif.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
qommjgg.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
qommjhf.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
rqpdgrod.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
ssqqnlj.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
tuvsttt.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
tuvwwwu.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
xxywutr.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
xxyyxvs.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Deleted.;
awtqnll.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
awtrrss.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
awtrsro.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
awtsqrp.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
ddcdeba.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
iifghfe.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
khfffdb.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
ljjjhhi.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
mljggdc.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
nnnkklj.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
nnnllkj.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
nnnmnli.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
nnnnomk.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
opnklki.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
tuvstrp.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
tuvusst.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
wvuuuts.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;
xxyvutt.dll;C:\WINDOWS\system32;Trojan.Virtumod;Deleted.;


Performance-wise, my PC is running very well again. Thank for your excellent help!
But there still seems to be a problem with a lot of *.TMP files that keep coming up.
Also, a file call msvista that keeps coming up on my C:\ even after I've deleted it many times.

Thank you

#12 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 22 April 2007 - 06:19 AM

Please download Combofix and save to the desktop:
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
Note:
It is important that it is saved directly to your desktop

Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the C:\ComboFix.txt into your next reply.
Note:
Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.

Posted Image
Posted Image

#13 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 22 April 2007 - 06:33 PM

Here is the log from Combofix:

"Antonio Lau" - 07-04-22 16:27:35 Service Pack 2
ComboFix 07-04-21.3V - Running from: "C:\Documents and Settings\Antonio Lau\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\crypts.dll


((((((((((((((((((((((((((((((( Files Created from 2007-03-22 to 2007-04-22 ))))))))))))))))))))))))))))))))))


2007-04-22 14:05 395 --a------ C:\msvista.exe
2007-04-22 03:04 <DIR> d-------- C:\DOCUME~1\ANTONI~1\DoctorWeb
2007-04-19 16:48 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-19 16:37 <DIR> d-------- C:\avenger
2007-04-19 15:25 811,349 ---hs---- C:\WINDOWS\system32\rstwa.bak2
2007-04-18 15:06 806,517 ---hs---- C:\WINDOWS\system32\rstwa.bak1
2007-04-18 04:19 1,156 --a------ C:\WINDOWS\mozver.dat
2007-04-16 23:06 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-16 17:47 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\WinRAR
2007-04-15 22:30 75,512 --a------ C:\WINDOWS\zllsputility.exe
2007-04-15 22:30 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-04-15 22:30 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-04-15 22:30 1,087,216 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-04-15 22:30 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-04-15 22:29 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-04-15 22:18 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2007-04-14 17:35 2,623 --a------ C:\WINDOWS\system32\pmnnn.dll
2007-04-14 16:35 2,623 --a------ C:\WINDOWS\system32\ddayx.dll
2007-04-13 03:09 28,712 --a------ C:\WINDOWS\system32\gebya.exe
2007-04-13 01:55 30,184 --a------ C:\WINDOWS\system32\geede.exe
2007-04-12 23:55 30,304 --a------ C:\WINDOWS\system32\vtuts.exe
2007-04-12 15:08 41,472 -r-hs---- C:\WINDOWS\system\msnmsgr32.exe
2007-04-12 04:40 30,208 --a------ C:\WINDOWS\system32\jkkjg.exe
2007-04-12 04:40 2,600 --a------ C:\WINDOWS\system32\vtsqo.exe
2007-04-11 14:49 11,288 --a------ C:\WINDOWS\system32\jkhhe.exe
2007-04-02 00:54 <DIR> d-------- C:\VundoFix Backups
2007-04-01 21:19 <DIR> d-------- C:\Program Files\Common Files\Nero
2007-04-01 21:15 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2007-04-01 21:15 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2007-04-01 21:15 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2007-04-01 21:15 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2007-04-01 21:15 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-04-01 21:15 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-04-01 21:15 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2007-04-01 21:14 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-04-01 21:14 <DIR> d-------- C:\Program Files\Ahead
2007-04-01 21:00 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-04-01 20:59 <DIR> d-------- C:\Program Files\Real
2007-04-01 20:59 <DIR> d-------- C:\Program Files\Common Files\Real
2007-04-01 20:49 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\Real
2007-04-01 20:47 <DIR> d-------- C:\My Downloads
2007-04-01 20:36 <DIR> d-------- C:\Program Files\WinAVIVideoConverter
2007-03-31 15:51 <DIR> d-------- C:\rh
2007-03-30 20:34 <DIR> d-------- C:\Program Files\Ventrilo
2007-03-30 20:34 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\Ventrilo
2007-03-30 19:55 <DIR> dr-h----- C:\DOCUME~1\ANTONI~1\APPLIC~1\SecuROM
2007-03-30 19:55 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\Command & Conquer 3 Tiberium Wars
2007-03-30 19:54 98,304 --a------ C:\WINDOWS\system32CmdLineExt.dll
2007-03-30 19:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-03-30 19:35 <DIR> d-------- C:\Program Files\Electronic Arts
2007-03-30 04:44 <DIR> d-------- C:\Program Files\Music Rescue
2007-03-30 04:17 <DIR> d-------- C:\Program Files\iTunes
2007-03-30 04:17 <DIR> d-------- C:\Program Files\iPod
2007-03-30 04:17 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\Apple Computer
2007-03-30 04:15 <DIR> d-------- C:\Program Files\QuickTime
2007-03-30 04:15 <DIR> d-------- C:\Program Files\Apple Software Update
2007-03-30 04:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-03-30 03:49 <DIR> d-------- C:\Program Files\Lavasoft
2007-03-30 03:49 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-03-30 03:49 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\Lavasoft
2007-03-30 03:17 98,304 --a------ C:\WINDOWS\system32\msir3jp.dll
2007-03-30 03:17 838,144 --a------ C:\WINDOWS\system32\chtbrkr.dll
2007-03-30 03:17 70,656 --a------ C:\WINDOWS\system32\korwbrkr.dll
2007-03-30 03:17 1,677,824 --a------ C:\WINDOWS\system32\chsbrkr.dll
2007-03-30 03:16 9,216 --a------ C:\WINDOWS\system32\kbdnecAT.dll
2007-03-30 03:16 7,680 --a------ C:\WINDOWS\system32\kbdnecNT.dll
2007-03-30 03:16 7,168 --a------ C:\WINDOWS\system32\kbdnec95.dll
2007-03-30 03:16 7,168 --a------ C:\WINDOWS\system32\kbdibm02.dll
2007-03-30 03:16 7,168 --a------ C:\WINDOWS\system32\f3ahvoas.dll
2007-03-30 03:16 6,656 --a------ C:\WINDOWS\system32\kbdlk41a.dll
2007-03-30 03:16 6,656 --a------ C:\WINDOWS\system32\c_is2022.dll
2007-03-30 03:16 6,144 --a------ C:\WINDOWS\system32\kbdlk41j.dll
2007-03-30 03:16 6,144 --a------ C:\WINDOWS\system32\kbdax2.dll
2007-03-30 03:16 6,144 --a------ C:\WINDOWS\system32\kbd106n.dll
2007-03-30 03:16 6,144 --a------ C:\WINDOWS\system32\kbd101a.dll
2007-03-30 03:16 6,144 --a------ C:\WINDOWS\system32\kbd101.dll
2007-03-30 03:16 218,112 --a------ C:\WINDOWS\system32\c_g18030.dll
2007-03-30 03:15 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll
2007-03-30 03:15 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll
2007-03-30 03:15 6,144 --a------ C:\WINDOWS\system32\kbd106.dll
2007-03-30 03:15 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2007-03-30 03:15 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2007-03-30 03:15 5,632 --a------ C:\WINDOWS\system32\kbd103.dll
2007-03-29 22:26 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\DivX
2007-03-29 22:25 36,624 --a------ C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-03-29 22:25 2,560 --a------ C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-03-29 22:25 2,432 --a------ C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-03-29 22:25 129,784 --a------ C:\WINDOWS\system32\pxafs.dll
2007-03-29 22:25 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2007-03-29 22:25 116,472 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2007-03-29 22:24 <DIR> d-------- C:\Program Files\DivX
2007-03-29 22:13 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-03-29 22:11 <DIR> d--hs---- C:\RECYCLER
2007-03-29 21:02 <DIR> d-------- C:\Program Files\Webteh
2007-03-29 21:02 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\BSplayer Pro
2007-03-29 21:02 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\BSplayer
2007-03-29 20:17 <DIR> d-------- C:\Program Files\World of Warcraft
2007-03-29 20:17 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-03-29 20:09 <DIR> d-------- C:\Program Files\uTorrent
2007-03-29 20:09 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\uTorrent
2007-03-29 19:42 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-03-29 19:22 <DIR> d-------- C:\WINDOWS\Prefetch
2007-03-29 19:07 <DIR> d-------- C:\WINDOWS\provisioning
2007-03-29 19:07 <DIR> d-------- C:\WINDOWS\peernet
2007-03-29 19:06 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-03-29 19:03 <DIR> d-------- C:\WINDOWS\EHome
2007-03-29 19:01 4,569 --a------ C:\WINDOWS\system32\secupd.dat
2007-03-29 19:01 11,776 --a------ C:\WINDOWS\system32\spnpinst.exe
2007-03-29 18:41 262,144 --a------ C:\DOCUME~1\ALLUSE~1\ntuser.dat
2007-03-29 18:33 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2007-03-29 18:33 331,264 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-03-29 18:33 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-03-29 18:30 1,082,368 --a------ C:\WINDOWS\system32\esent.dll
2007-03-29 18:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-03-29 18:14 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-03-29 18:14 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-03-29 18:14 <DIR> d-------- C:\WINDOWS\system32\bits
2007-03-29 18:13 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-03-29 18:13 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-03-29 18:13 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-03-29 18:13 351,232 --a------ C:\WINDOWS\system32\winhttp.dll
2007-03-29 18:13 18,944 --------- C:\WINDOWS\system32\qmgrprxy.dll
2007-03-29 18:09 <DIR> d--h----- C:\WINDOWS\PIF
2007-03-29 18:03 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2007-03-29 18:03 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-03-29 18:03 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-03-29 18:03 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2007-03-29 18:03 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-03-29 18:03 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2007-03-29 18:02 <DIR> d--hs---- C:\DOCUME~1\ANTONI~1\UserData
2007-03-29 18:02 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2007-03-29 17:53 <DIR> d-------- C:\DOCUME~1\ANTONI~1\APPLIC~1\Symantec
2007-03-29 17:51 48,776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-03-29 17:51 115,000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-03-29 17:51 10,344 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-03-29 17:51 <DIR> d-------- C:\Program Files\Symantec
2007-03-29 17:51 <DIR> d-------- C:\Program Files\Norton AntiVirus
2007-03-29 17:51 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-03-29 17:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-03-29 17:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
2007-03-29 17:48 86,016 --a------ C:\WINDOWS\system32\stacsv.exe
2007-03-29 17:48 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-03-29 17:48 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-03-29 17:48 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-03-29 17:48 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-03-29 17:48 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-03-29 17:48 52,864 --a------ C:\WINDOWS\system32\drivers\dmusic.sys
2007-03-29 17:48 41,728 --a------ C:\WINDOWS\system32\drivers\sfng32.sys
2007-03-29 17:48 282,624 --a------ C:\WINDOWS\sttray.exe
2007-03-29 17:48 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-03-29 17:48 217,088 --a------ C:\WINDOWS\system32\stacapi.dll
2007-03-29 17:48 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-03-29 17:48 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-03-29 17:48 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-03-29 17:48 117,248 --a------ C:\WINDOWS\system32\staco.dll
2007-03-29 17:48 1,177,032 --a------ C:\WINDOWS\system32\drivers\sthda.sys
2007-03-29 17:48 1,069,056 --a------ C:\WINDOWS\system32\stlang.dll
2007-03-29 17:47 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-03-29 17:47 <DIR> d-------- C:\Program Files\SigmaTel
2007-03-29 17:46 36,864 -ra------ C:\WINDOWS\system32\e100bmsg.dll
2007-03-29 17:46 21,504 -ra------ C:\WINDOWS\system32\NicCo.dll
2007-03-29 17:46 20,992 -ra------ C:\WINDOWS\system32\NicInst.dll
2007-03-29 17:46 163,328 -ra------ C:\WINDOWS\system32\drivers\e100b325.sys
2007-03-29 17:46 126,976 -ra------ C:\WINDOWS\system32\Prounstl.exe
2007-03-29 17:45 85,376 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2007-03-29 17:45 83,456 --a------ C:\WINDOWS\system32\dpvsetup.exe
2007-03-29 17:45 825,344 --a------ C:\WINDOWS\system32\d3dim700.dll
2007-03-29 17:45 82,432 --a------ C:\WINDOWS\system32\dmscript.dll
2007-03-29 17:45 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll
2007-03-29 17:45 733,696 --a------ C:\WINDOWS\system32\qedwipes.dll
2007-03-29 17:45 71,680 --a------ C:\WINDOWS\system32\dsdmoprp.dll
2007-03-29 17:45 70,656 --a------ C:\WINDOWS\system32\amstream.dll
2007-03-29 17:45 7,552 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2007-03-29 17:45 619,008 --a------ C:\WINDOWS\system32\dx7vb.dll
2007-03-29 17:45 61,440 --a------ C:\WINDOWS\system32\dmcompos.dll
2007-03-29 17:45 60,928 --a------ C:\WINDOWS\system32\dpnhupnp.dll
2007-03-29 17:45 59,904 --a------ C:\WINDOWS\system32\devenum.dll
2007-03-29 17:45 57,344 --a------ C:\WINDOWS\system32\dpwsockx.dll
2007-03-29 17:45 562,176 --a------ C:\WINDOWS\system32\qedit.dll
2007-03-29 17:45 51,328 --a------ C:\WINDOWS\system32\drivers\msdv.sys
2007-03-29 17:45 50,688 --a------ C:\WINDOWS\system32\wstdecod.dll
2007-03-29 17:45 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2007-03-29 17:45 5,376 --a------ C:\WINDOWS\system32\drivers\mspclock.sys
2007-03-29 17:45 48,640 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-03-29 17:45 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe
2007-03-29 17:45 4,992 --a------ C:\WINDOWS\system32\drivers\mspqm.sys
2007-03-29 17:45 4,352 --a------ C:\WINDOWS\system32\drivers\swenum.sys
2007-03-29 17:45 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-03-29 17:45 385,024 --a------ C:\WINDOWS\system32\qdvd.dll
2007-03-29 17:45 375,296 --a------ C:\WINDOWS\system32\dpnet.dll
2007-03-29 17:45 367,616 --a------ C:\WINDOWS\system32\dsound.dll
2007-03-29 17:45 363,520 --a------ C:\WINDOWS\system32\psisdecd.dll
2007-03-29 17:45 35,840 --a------ C:\WINDOWS\system32\dmloader.dll
2007-03-29 17:45 35,328 --a------ C:\WINDOWS\system32\mciqtz32.dll
2007-03-29 17:45 35,328 --a------ C:\WINDOWS\system32\dpnhpast.dll
2007-03-29 17:45 30,208 --a------ C:\WINDOWS\system32\dplaysvr.exe
2007-03-29 17:45 3,584 --a------ C:\WINDOWS\system32\dpnlobby.dll
2007-03-29 17:45 3,584 --a------ C:\WINDOWS\system32\dpnaddr.dll
2007-03-29 17:45 28,672 --a------ C:\WINDOWS\system32\dmband.dll
2007-03-29 17:45 279,040 --a------ C:\WINDOWS\system32\qdv.dll
2007-03-29 17:45 27,136 --a------ C:\WINDOWS\system32\ddrawex.dll
2007-03-29 17:45 266,240 --a------ C:\WINDOWS\system32\ddraw.dll
2007-03-29 17:45 237,568 --a------ C:\WINDOWS\system32\qasf.dll
2007-03-29 17:45 23,552 --a------ C:\WINDOWS\system32\dpmodemx.dll
2007-03-29 17:45 229,888 --a------ C:\WINDOWS\system32\dplayx.dll
2007-03-29 17:45 212,480 --a------ C:\WINDOWS\system32\dpvoice.dll
2007-03-29 17:45 21,504 --a------ C:\WINDOWS\system32\dpvacm.dll
2007-03-29 17:45 204,288 --a------ C:\WINDOWS\system32\mswebdvd.dll
2007-03-29 17:45 20,480 --a------ C:\WINDOWS\system32\encapi.dll
2007-03-29 17:45 2,113,536 --a------ C:\WINDOWS\system32\dxdiagn.dll
2007-03-29 17:45 192,512 --a------ C:\WINDOWS\system32\qcap.dll
2007-03-29 17:45 19,456 --a------ C:\WINDOWS\system32\dswave.dll
2007-03-29 17:45 19,328 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys
2007-03-29 17:45 181,760 --a------ C:\WINDOWS\system32\dsdmo.dll
2007-03-29 17:45 181,248 --a------ C:\WINDOWS\system32\dmime.dll
2007-03-29 17:45 18,432 --a------ C:\WINDOWS\system32\dpnsvr.exe
2007-03-29 17:45 17,408 --a------ C:\WINDOWS\system32\msyuv.dll
2007-03-29 17:45 17,024 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys
2007-03-29 17:45 15,360 --a------ C:\WINDOWS\system32\drivers\streamip.sys
2007-03-29 17:45 15,360 --a------ C:\WINDOWS\system32\drivers\mpe.sys
2007-03-29 17:45 140,928 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-03-29 17:45 14,336 --a------ C:\WINDOWS\system32\msdmo.dll
2007-03-29 17:45 116,736 --a------ C:\WINDOWS\system32\dpvvox.dll
2007-03-29 17:45 11,776 --a------ C:\WINDOWS\system32\drivers\bdasup.sys
2007-03-29 17:45 11,136 --a------ C:\WINDOWS\system32\drivers\slip.sys
2007-03-29 17:45 105,984 --a------ C:\WINDOWS\system32\dmstyle.dll
2007-03-29 17:45 104,448 --a------ C:\WINDOWS\system32\dmusic.dll
2007-03-29 17:45 103,424 --a------ C:\WINDOWS\system32\dmsynth.dll
2007-03-29 17:45 10,880 --a------ C:\WINDOWS\system32\drivers\ndisip.sys
2007-03-29 17:45 1,689,088 --a------ C:\WINDOWS\system32\d3d9.dll
2007-03-29 17:45 1,428,480 --a------ C:\WINDOWS\system32\msvidctl.dll
2007-03-29 17:45 1,298,432 --a------ C:\WINDOWS\system32\dxdiag.exe
2007-03-29 17:45 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll
2007-03-29 17:45 1,227,264 --a------ C:\WINDOWS\system32\dx8vb.dll
2007-03-29 17:45 1,179,648 --a------ C:\WINDOWS\system32\d3d8.dll
2007-03-29 17:45 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2007-03-29 17:44 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2007-03-29 17:44 57,600 --a------ C:\WINDOWS\system32\drivers\usbhub.sys
2007-03-29 17:44 26,624 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2007-03-29 17:44 20,480 --a------ C:\WINDOWS\system32\drivers\usbuhci.sys
2007-03-29 17:44 142,976 --a------ C:\WINDOWS\system32\drivers\usbport.sys
2007-03-29 17:43 95,360 --a------ C:\WINDOWS\system32\drivers\atapi.sys
2007-03-29 17:43 68,224 --a------ C:\WINDOWS\system32\drivers\pci.sys
2007-03-29 17:43 35,840 --a------ C:\WINDOWS\system32\drivers\isapnp.sys
2007-03-29 17:43 3,328 --a------ C:\WINDOWS\system32\drivers\pciide.sys
2007-03-29 17:43 25,088 --a------ C:\WINDOWS\system32\drivers\pciidex.sys
2007-03-29 17:43 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups
2007-03-29 17:43 <DIR> d-------- C:\Program Files\Intel
2007-03-29 17:40 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-03-29 17:40 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-03-29 17:40 <DIR> d-------- C:\WINDOWS\nview
2007-03-29 17:40 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-03-29 17:37 2,359,296 --ah----- C:\DOCUME~1\ANTONI~1\NTUSER.DAT
2007-03-29 17:37 <DIR> d--hs---- C:\WINDOWS\Installer
2007-03-29 17:36 229,376 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-03-29 17:36 229,376 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-03-29 17:36 <DIR> d--hs---- C:\System Volume Information
2007-03-29 17:34 229,376 ---h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-03-29 17:34 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-03-29 17:34 0 -rahs---- C:\MSDOS.SYS
2007-03-29 17:34 0 -rahs---- C:\IO.SYS
2007-03-29 17:34 0 --a------ C:\CONFIG.SYS
2007-03-29 17:34 0 --a------ C:\AUTOEXEC.BAT
2007-03-29 17:34 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2007-03-29 17:34 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM
2007-03-29 17:34 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2007-03-29 17:34 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-03-29 17:34 <DIR> d-------- C:\WINDOWS\system32\DirectX
2007-03-29 17:34 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-03-29 17:33 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2007-03-29 17:33 81,920 --a------ C:\WINDOWS\system32\ils.dll
2007-03-29 17:33 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-03-29 17:33 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-03-29 17:33 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2007-03-29 17:33 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-03-29 17:33 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2007-03-29 17:33 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-03-29 17:33 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2007-03-29 17:33 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2007-03-29 17:33 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-03-29 17:33 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-03-29 17:33 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-03-29 17:33 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-03-29 17:33 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-03-29 17:33 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-03-29 17:33 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-03-29 17:33 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-03-29 17:33 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2007-03-29 17:33 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-03-29 17:33 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-03-29 17:33 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2007-03-29 17:33 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-03-29 17:33 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2007-03-29 17:33 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-03-29 17:33 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-03-29 17:33 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-03-29 17:33 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-03-29 17:33 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2007-03-29 17:33 <DIR> d---s---- C:\WINDOWS\Tasks
2007-03-29 17:33 <DIR> d-------- C:\WINDOWS\system32\Restore
2007-03-29 17:33 <DIR> d-------- C:\WINDOWS\system32\Macromed
2007-03-29 17:33 <DIR> d-------- C:\WINDOWS\srchasst
2007-03-29 17:33 <DIR> d-------- C:\WINDOWS\PCHealth
2007-03-29 17:33 <DIR> d-------- C:\Program Files\Movie Maker
2007-03-29 17:33 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2007-03-29 17:32 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-03-29 17:32 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-03-29 17:32 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-03-29 17:32 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-03-29 17:32 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-03-29 17:32 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-03-29 17:32 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2007-03-29 17:32 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-03-29 17:32 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-03-29 17:32 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-03-29 17:32 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-03-29 17:32 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-03-29 17:32 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2007-03-29 17:32 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-03-29 17:32 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-03-29 17:32 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-03-29 17:32 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-03-29 17:32 56,832 --a------ C:\WINDOWS\system32\sol.exe
2007-03-29 17:32 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-03-29 17:32 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2007-03-29 17:32 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2007-03-29 17:32 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-03-29 17:32 538,624 --a------ C:\WINDOWS\system32\spider.exe
2007-03-29 17:32 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-03-29 17:32 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-03-29 17:32 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-03-29 17:32 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-03-29 17:32 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-03-29 17:32 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2007-03-29 17:32 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-03-29 17:32 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-03-29 17:32 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-03-29 17:32 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-03-29 17:32 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2007-03-29 17:32 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-03-29 17:32 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2007-03-29 17:32 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-03-29 17:32 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-03-29 17:32 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2007-03-29 17:32 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-03-29 17:32 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-03-29 17:32 21,640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-03-29 17:32 20,992 --a------ C:\WINDOWS\system32\msg.exe
2007-03-29 17:32 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2007-03-29 17:32 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-03-29 17:32 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-03-29 17:32 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2007-03-29 17:32 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2007-03-29 17:32 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-03-29 17:32 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-03-29 17:32 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-03-29 17:32 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-03-29 17:32 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-03-29 17:32 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-03-29 17:32 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-03-29 17:32 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-03-29 17:32 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2007-03-29 17:32 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-03-29 17:32 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-03-29 17:32 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-03-29 17:32 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-03-29 17:32 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2007-03-29 17:32 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2007-03-29 17:32 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-03-29 17:32 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-03-29 17:32 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-03-29 17:32 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-03-29 17:32 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2007-03-29 17:32 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-03-29 17:32 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2007-03-29 17:32 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-03-29 17:32 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-03-29 17:32 114,688 --a------ C:\WINDOWS\system32\calc.exe
2007-03-29 17:32 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-03-29 17:32 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-03-29 17:32 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-03-29 17:32 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-03-29 17:32 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-03-29 17:32 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-03-29 17:32 <DIR> d--h----- C:\Program Files\WindowsUpdate
2007-03-29 17:32 <DIR> d-------- C:\WINDOWS\system32\MsDtc
2007-03-29 17:32 <DIR> d-------- C:\WINDOWS\system32\Com
2007-03-29 17:32 <DIR> d-------- C:\WINDOWS\Registration
2007-03-29 17:32 <DIR> d-------- C:\Program Files\Windows NT
2007-03-29 17:32 <DIR> d-------- C:\Program Files\Online Services
2007-03-29 17:32 <DIR> d-------- C:\Program Files\MSN Gaming Zone
2007-03-29 17:32 <DIR> d-------- C:\Program Files\Messenger
2007-03-29 17:31 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-03-29 17:31 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-03-29 09:29 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-03-29 09:28 9,008 --a------ C:\WINDOWS\system\VER.DLL
2007-03-29 09:28 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-03-29 09:28 82,944 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-03-29 09:28 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-03-29 09:28 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2007-03-29 09:28 68,768 --a------ C:\WINDOWS\system\mmsystem.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2007-03-29 09:28 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-03-29 09:28 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-03-29 09:28 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-03-29 09:28 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-03-29 09:28 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-03-29 09:28 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-03-29 09:28 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-03-29 09:28 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-03-29 09:28 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-03-29 09:28 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-03-29 09:28 126,912 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-03-29 09:28 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-03-29 09:28 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-03-29 09:28 <DIR> d-a------ C:\Program Files
2007-03-29 09:28 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines
2007-03-29 09:28 <DIR> d-------- C:\Program Files\Common Files\ODBC
2007-03-29 09:27 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-03-29 09:27 8,704 --a------ C:\WINDOWS\system32\batt.dll
2007-03-29 09:27 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2007-03-29 09:27 69,584 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-03-29 09:27 69,120 --a------ C:\WINDOWS\notepad.exe
2007-03-29 09:27 32,816 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-03-29 09:27 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-03-29 09:27 109,456 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-03-29 09:27 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Documents
2007-03-29 09:27 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-03-29 09:27 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2007-03-29 09:27 <DIR> d-------- C:\Documents and Settings
2007-03-29 09:23 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache
2007-03-29 09:23 <DIR> dr--s---- C:\WINDOWS\Fonts
2007-03-29 09:23 <DIR> dr------- C:\WINDOWS\Web
2007-03-29 09:23 <DIR> d--h----- C:\WINDOWS\inf
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\WinSxS
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\twain_32
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\wins
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\wbem
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\usmt
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\spool
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\ShellExt
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\Setup
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\ras
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\oobe
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\npp
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\mui
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\inetsrv
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\IME
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\icsxml
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\ias
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\export
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\drivers\etc
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\drivers
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\dhcp
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\config
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\3com_dmi
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\3076
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\2052
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1054
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1042
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1041
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1037
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1033
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1031
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1028
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32\1025
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system32
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\system
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\security
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Resources
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\repair
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\mui
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\msapps
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\msagent
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Media
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\ime
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Help
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Driver Cache
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Debug
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Cursors
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Connection Wizard
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\Config
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\AppPatch
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS\addins
2007-03-29 09:23 <DIR> d-------- C:\WINDOWS
2007-03-28 18:51 97,936 --a------ C:\WINDOWS\system32\drivers\symfw.sys
2007-03-28 18:51 538,256 --a------ C:\WINDOWS\system32\SymNeti.dll
2007-03-28 18:51 31,888 --a------ C:\WINDOWS\system32\drivers\symids.sys
2007-03-28 18:51 28,304 --a------ C:\WINDOWS\system32\drivers\symndis.sys
2007-03-28 18:51 24,208 --a------ C:\WINDOWS\system32\drivers\symredrv.sys
2007-03-28 18:51 189,584 --a------ C:\WINDOWS\system32\drivers\symtdi.sys
2007-03-28 18:51 161,424 --a------ C:\WINDOWS\system32\SymRedir.dll
2007-03-28 18:51 12,944 --a------ C:\WINDOWS\system32\drivers\symdns.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-03-30 04:54 3248 --a------ C:\DOCUME~1\ANTONI~1\APPLIC~1\com.kennettnet.musicrescue.plist
2007-03-30 04:54 23089 --a------ C:\DOCUME~1\ANTONI~1\APPLIC~1\com.kennettnet.musicrescueprofiles.plist
2007-03-29 09:27 62 --ahs---- C:\DOCUME~1\ANTONI~1\APPLIC~1\desktop.ini
2007-03-17 06:43 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 08:36 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 08:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 08:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 06:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-02-22 21:29 524288 --a------ C:\WINDOWS\system32\divxsm.exe
2007-02-22 21:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-02-22 21:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-02-22 21:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-02-22 21:25 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-02-22 21:25 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-02-22 21:25 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-02-22 21:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-02-22 21:25 639066 --a------ C:\WINDOWS\system32\divx.dll
2007-02-22 21:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll
2007-02-22 21:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-02-22 21:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll
2007-02-22 21:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-02-22 21:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-02-22 21:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-02-22 21:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-02-15 18:40 124472 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe
2007-02-05 13:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{A8F38D8D-E480-4D52-B7A2-731BB6995FDD} C:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"SigmatelSysTrayApp"="sttray.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec PIF AlertEng"="\"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\PIFSvc.exe\" /a /m \"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\AlertEng.dll\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{45996C93-2BF7-4116-BA84-E2C11A46F80F}"=""
"{AFC9BF99-BFD7-4CCA-9D5E-025A63757211}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\autorun.exe


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Antonio Lau.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-22 16:29:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 07-04-22 16:29:32
C:\ComboFix-quarantined-files.txt ... 07-04-22 16:29

#14 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 22 April 2007 - 07:03 PM

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens,copy and paste ALL the following bold blue text in the Quote box below:

Files to delete:
C:\WINDOWS\system32\rstwa.bak2
C:\WINDOWS\system32\rstwa.bak1
C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\system32\ddayx.dll
C:\WINDOWS\system32\gebya.exe
C:\WINDOWS\system32\geede.exe
C:\WINDOWS\system32\vtuts.exe
C:\WINDOWS\system32\jkkjg.exe
C:\WINDOWS\system32\vtsqo.exe
C:\WINDOWS\system32\jkhhe.exe

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt into your next reply.
Also post a new Hijackthis log please.
Let me know how your pc is running now please.
Posted Image
Posted Image

#15 GHM

GHM
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:03 PM

Posted 24 April 2007 - 10:52 PM

Here is the Avenger log:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\rqlpmynk

*******************

Script file located at: \??\C:\Documents and Settings\mbtvrjbt.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\rstwa.bak2 deleted successfully.
File C:\WINDOWS\system32\rstwa.bak1 deleted successfully.
File C:\WINDOWS\system32\pmnnn.dll deleted successfully.
File C:\WINDOWS\system32\ddayx.dll deleted successfully.
File C:\WINDOWS\system32\gebya.exe deleted successfully.
File C:\WINDOWS\system32\geede.exe deleted successfully.
File C:\WINDOWS\system32\vtuts.exe deleted successfully.
File C:\WINDOWS\system32\jkkjg.exe deleted successfully.
File C:\WINDOWS\system32\vtsqo.exe deleted successfully.
File C:\WINDOWS\system32\jkhhe.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Everything seems to be running fine now!

Thank you a lot for your excellent help.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users