Can't get rid of .tmp files!

Computing.Net > Forums > Security and Virus > Can't get rid of .tmp files!

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Can't get rid of .tmp files!

Name: smithch2520
Date: February 27, 2008 at 18:48:57 Pacific
OS: Windows XP Home Edition S
CPU/Ram: RAM is 2.53 GHz 512 MB
Product: Dell Dimension DE051

Comment:

I am trying to get rid of all these .tmp files on my C: drive! They are very annoying and are slowing my pc up big time. I read some of the other posts and I was going to perform the steps they did, but it looks like you need to see the logs. Can you please help??? Thanks in advance!!
smithch

Sponsored Link

Ads by Google

Response Number 1

Name: jabuck
Date: February 27, 2008 at 19:36:57 Pacific

Reply:

Go to the this link:
Disable Realtime Protection
Follow their directions to disable any realtime protection that you have as it will interfere with the fix by reinstalling the corrupt files.
Please download Atribune's VundoFix.exe from the following site to your desktop:
Vundofix.exe

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files,
click "yes".
Once you click yes, your desktop will go blank as it starts removing
Vundo.
When completed, it will prompt that it will reboot your computer,
click "ok".
Please download and install the latest version of HijackThis v2.0.2:

Download the "HijackThis" Installer from this link:
Hijack This

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Please download ComboFix to the desktop from one of the following links:
Link1
Link 2
Link 3

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.

Response Number 2

Name: smithch2520
Date: February 27, 2008 at 22:10:38 Pacific

Reply:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide .exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\Common Files\Symantec Shared\ccApp .exe
C:\Program Files\Norton Ghost\Agent\GhostTray .exe
C:\WINDOWS\System32\DLA\DLACTRLW .exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\LVCOMSX .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\Logitech\Video\LogiTray .exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon .exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
C:\Program Files\DellSupport\DSAgnt .exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Netscape\Netscape Browser\netscape.exe
C:\Program Files\Netscape\Netscape Browser\defaults\safetynet\updateLists.exe
C:\Documents and Settings\Chaun Smith\Desktop\HiJackThis.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F3 - REG:win.ini: load=C:\WINDOWS\system32\mljgd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM0bb8d543] Rundll32.exe "C:\WINDOWS\system32\admijcbd.dll",s
O4 - HKLM\..\Run: [088be6df] rundll32.exe "C:\WINDOWS\system32\ynuvjyhc.dll",b
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 9369 bytes

* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Documents and Settings\Chaun Smith\Application Data\macromedia\Flash Player\#SharedObjects\PPKUGFUR\www.broadcaster.com
C:\Documents and Settings\Chaun Smith\Application Data\macromedia\Flash Player\#SharedObjects\PPKUGFUR\www.broadcaster.com\played_list.sol
C:\Documents and Settings\Chaun Smith\Application Data\macromedia\Flash Player\#SharedObjects\PPKUGFUR\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\Chaun Smith\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Chaun Smith\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\inetget2
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Video\ISStart.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\Video\ManifestEngine.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\Temporary
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\b148.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\abc2
C:\WINDOWS\system32\arghvfbr.ini
C:\WINDOWS\system32\chyjvuny.ini
C:\WINDOWS\system32\cvxemyxb.ini
C:\WINDOWS\system32\dgjlm.ini
C:\WINDOWS\system32\dgjlm.ini2
C:\WINDOWS\System32\DLA\DLACTRLW.exe
C:\WINDOWS\system32\dvupyjop.ini
C:\WINDOWS\system32\ebdvdpdn.ini
C:\WINDOWS\system32\ex1
C:\WINDOWS\system32\fnnfydlo.ini
C:\WINDOWS\system32\gkrkngim.ini
C:\WINDOWS\system32\gstkgrun.ini
C:\WINDOWS\system32\ineWc01
C:\WINDOWS\system32\ipd1
C:\WINDOWS\system32\ipd1\zpr121dll.exe
C:\WINDOWS\system32\iyhpafny.ini
C:\WINDOWS\system32\jdujrnpn.ini
C:\WINDOWS\system32\kergmhks.ini
C:\WINDOWS\system32\lratdbvh.ini
C:\WINDOWS\system32\LVCOMSX.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljgd.dll
C:\WINDOWS\system32\mljgd.exe
C:\WINDOWS\system32\mriynaxa.ini
C:\WINDOWS\system32\nujahows.ini
C:\WINDOWS\system32\oc9
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qkqxbtmg.ini
C:\WINDOWS\system32\qsjbmgku.ini
C:\WINDOWS\system32\vdwfaucn.ini
C:\WINDOWS\system32\vuhjokbp.ini
C:\WINDOWS\system32\wantpwyj.ini
C:\WINDOWS\system32\wbecnnol.ini
C:\WINDOWS\system32\wdjumivx.ini
C:\WINDOWS\system32\xjpelkfm.ini
C:\WINDOWS\system32\ybjtacix.ini
C:\WINDOWS\system32\ypopxbeh.ini
C:\WINDOWS\system32\ytdxadkb.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\core

((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.
2008-02-27 22:02 . 2008-02-27 23:18 <DIR> d-------- C:\VundoFix Backups
2008-02-24 15:44 . 2008-02-27 18:54 22 --a------ C:\WINDOWS\pskt.ini
2008-02-24 15:32 . 2008-02-24 15:32 <DIR> d-------- C:\WINDOWS\PaltalkScene
2008-02-24 15:32 . 2008-02-27 23:16 <DIR> d-------- C:\WINDOWS\Paltalk Messenger
2008-02-21 22:51 . 2008-02-27 18:53 49 --a------ C:\WINDOWS\BM0bb8d543.xml
2008-02-04 22:33 . 2008-02-04 22:33 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-01-31 17:35 . 2008-01-31 17:36 264,704 --ahs---- C:\Thumbs.db
2008-01-31 17:35 . 2008-01-31 17:35 8,704 --ahs---- C:\WINDOWS\Thumbs.db
2008-01-31 16:06 . 2008-01-31 16:06 <DIR> d-------- C:\Program Files\Bonjour
2008-01-31 15:56 . 2008-02-27 23:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-31 15:56 . 2008-01-31 15:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-31 15:51 . 2008-01-31 15:51 <DIR> d-------- C:\Program Files\Apple Software Update
2008-01-31 15:51 . 2008-01-15 02:39 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-01-31 15:49 . 2008-01-31 15:49 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-01-31 15:49 . 2008-01-31 15:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-01-31 08:54 . 2008-01-31 08:54 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2008-01-28 12:12 . 2008-01-28 12:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 05:54 --------- d-----w C:\Program Files\QuickTime
2008-02-28 05:54 --------- d-----w C:\Program Files\iTunes
2008-02-28 05:54 --------- d-----w C:\Program Files\DellSupport
2008-02-28 05:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-25 03:09 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Skype
2008-02-24 21:47 --------- d-----w C:\Program Files\Lx_cats
2008-01-31 22:10 --------- d-----w C:\Program Files\iPod
2008-01-31 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-25 05:07 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-01-25 04:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 04:22 --------- d-----w C:\Program Files\Lavasoft
2008-01-25 04:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-21 15:44 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-01-10 06:51 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Media Player Classic
2007-12-29 14:10 --------- d-----w C:\Program Files\Linksys EasyLink Advisor
2007-12-28 04:31 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\SUPERAntiSpyware.com
2007-12-28 04:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2006-06-30 06:09 88 --sh--r C:\WINDOWS\system32\F7268E8B10.sys
2006-06-30 06:09 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
[code]
----a-w           135,168 2008-02-28 05:24:22  C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent .exe
----a-w         1,404,928 2007-12-28 05:40:57  C:\Program Files\Analog Devices\Core\smax4pnp .exe
----a-w            81,920 2008-01-25 04:57:25  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           611,840 2008-02-28 05:20:56  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                              .exe
----a-w           611,840 2008-02-28 00:47:55  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                             .exe
----a-w           611,840 2008-02-24 21:38:04  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                            .exe
----a-w           611,840 2008-02-18 15:06:18  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                           .exe
----a-w           611,840 2008-02-18 00:40:25  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                          .exe
----a-w           611,840 2008-02-17 17:39:01  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                         .exe
----a-w           611,840 2008-02-17 16:05:40  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                        .exe
----a-w           611,840 2008-02-17 00:33:27  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                       .exe
----a-w           611,840 2008-02-15 22:19:22  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                      .exe
----a-w           611,840 2008-02-15 02:06:21  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                     .exe
----a-w           611,840 2008-02-15 01:40:54  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                    .exe
----a-w           611,840 2008-02-14 00:40:33  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                   .exe
----a-w           611,840 2008-02-13 09:20:07  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                  .exe
----a-w           611,840 2008-02-12 18:12:26  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                 .exe
----a-w           611,840 2008-02-11 13:24:55  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm                .exe
----a-w           611,840 2008-02-08 22:30:29  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm               .exe
----a-w           611,840 2008-02-08 02:09:04  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm              .exe
----a-w           611,840 2008-02-06 23:30:40  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm             .exe
----a-w           611,840 2008-02-06 04:32:16  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm            .exe
----a-w           611,840 2008-02-04 17:51:50  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm           .exe
----a-w           611,840 2008-02-01 23:13:18  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm          .exe
----a-w           611,840 2008-01-31 20:51:19  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm         .exe
----a-w           611,840 2008-01-31 15:06:01  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm        .exe
----a-w           611,840 2008-01-25 13:44:31  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm       .exe
----a-w           611,840 2008-01-25 04:54:17  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm      .exe
----a-w           611,840 2008-01-25 03:42:45  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm     .exe
----a-w           611,840 2008-01-23 05:59:56  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm    .exe
----a-w           611,840 2008-01-23 04:52:16  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm   .exe
----a-w           611,840 2008-01-23 04:24:19  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm  .exe
----a-w           611,840 2008-01-22 13:05:34  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w            58,992 2008-02-28 05:22:54  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
----a-w            94,208 2007-12-27 13:37:02  C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w           460,784 2008-02-28 05:24:18  C:\Program Files\DellSupport\DSAgnt .exe
----a-w           267,048 2008-02-28 05:23:45  C:\Program Files\iTunes\iTunesHelper .exe
----a-w            36,975 2008-01-23 06:02:26  C:\Program Files\Java\jre1.5.0_03\bin\jusched .exe
----a-w           454,784 2007-12-29 07:54:38  C:\Program Files\Linksys EasyLink Advisor\LinksysAgent .exe
----a-w           217,088 2008-02-28 00:53:07  C:\Program Files\Logitech\Video\LogiTray .exe
----a-w           196,608 2008-02-28 05:24:14  C:\Program Files\Logitech\Video\ManifestEngine .exe
----a-w         1,537,696 2008-02-28 05:23:04  C:\Program Files\Norton Ghost\Agent\GhostTray .exe
----a-w           155,648 2008-01-31 20:56:03  C:\Program Files\QuickTime\qttask                             .exe
----a-w           518,144 2008-01-25 13:44:41  C:\Program Files\QuickTime\qttask                          .exe
----a-w           518,144 2008-01-25 04:54:26  C:\Program Files\QuickTime\qttask                         .exe
----a-w           518,144 2008-01-25 03:42:47  C:\Program Files\QuickTime\qttask                        .exe
----a-w           518,144 2008-01-23 06:00:10  C:\Program Files\QuickTime\qttask                       .exe
----a-w           518,144 2008-01-23 04:52:28  C:\Program Files\QuickTime\qttask                      .exe
----a-w           747,520 2008-02-28 00:48:05  C:\Program Files\QuickTime\QTTask                    .exe
----a-w           747,520 2008-02-24 21:38:07  C:\Program Files\QuickTime\QTTask                   .exe
----a-w           747,520 2008-02-18 15:06:24  C:\Program Files\QuickTime\QTTask                  .exe
----a-w           747,520 2008-02-18 00:40:31  C:\Program Files\QuickTime\QTTask                 .exe
----a-w           747,520 2008-02-17 17:39:12  C:\Program Files\QuickTime\QTTask                .exe
----a-w           747,520 2008-02-17 16:05:49  C:\Program Files\QuickTime\QTTask               .exe
----a-w           747,520 2008-02-17 00:33:32  C:\Program Files\QuickTime\QTTask              .exe
----a-w           747,520 2008-02-15 22:19:25  C:\Program Files\QuickTime\QTTask             .exe
----a-w           747,520 2008-02-15 02:06:29  C:\Program Files\QuickTime\QTTask            .exe
----a-w           747,520 2008-02-15 01:41:03  C:\Program Files\QuickTime\QTTask           .exe
----a-w           747,520 2008-02-14 00:40:37  C:\Program Files\QuickTime\QTTask          .exe
----a-w           747,520 2008-02-13 09:20:16  C:\Program Files\QuickTime\QTTask         .exe
----a-w           747,520 2008-02-12 18:12:34  C:\Program Files\QuickTime\QTTask        .exe
----a-w           747,520 2008-02-11 13:25:04  C:\Program Files\QuickTime\QTTask       .exe
----a-w           747,520 2008-02-08 22:30:39  C:\Program Files\QuickTime\QTTask      .exe
----a-w           747,520 2008-02-08 02:09:07  C:\Program Files\QuickTime\QTTask     .exe
----a-w           747,520 2008-02-06 23:30:43  C:\Program Files\QuickTime\QTTask    .exe
----a-w           747,520 2008-02-06 04:32:26  C:\Program Files\QuickTime\QTTask   .exe
----a-w           747,520 2008-02-05 09:09:20  C:\Program Files\QuickTime\QTTask  .exe
----a-w           747,520 2008-02-04 17:52:01  C:\Program Files\QuickTime\QTTask .exe
----a-w           823,362 2008-02-28 05:21:59  C:\Program Files\Trend Micro\Internet Security 12\PccGuide .exe
----a-w           176,201 2008-02-28 05:24:07  C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon .exe
----a-w            15,360 2008-01-31 14:54:05  C:\WINDOWS\system32\ctfmon .exe
----a-w            77,824 2008-01-23 06:02:24  C:\WINDOWS\system32\hkcmd .exe
----a-w           114,688 2008-01-23 06:02:26  C:\WINDOWS\system32\igfxpers .exe
----a-w            94,208 2008-01-23 06:02:26  C:\WINDOWS\system32\igfxtray .exe
----a-w           221,184 2008-02-28 05:23:22  C:\WINDOWS\system32\LVCOMSX .exe
----a-w           122,940 2008-02-28 05:23:14  C:\WINDOWS\system32\DLA\DLACTRLW .exe
[/code]

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c1ef534a-7d33-4bb5-8ad6-5110804c3447}]
C:\WINDOWS\system32\gfpdbphy.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [ ]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [ ]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [ ]
"Aim6"="" []
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-27 23:41 15360]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [ ]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2008-02-27 23:41 36975]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [ ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" [ ]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [ ]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.exe" [ ]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.exe" [ ]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [ ]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [ ]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 11:47 73728]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"BM0bb8d543"="C:\WINDOWS\system32\admijcbd.dll" [ ]
"088be6df"="C:\WINDOWS\system32\ynuvjyhc.dll" [ ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-04-20 14:14:10 156784]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-04-20 14:11:32 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 02:01:04 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Citrix\\icaweb32\\wfica32.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 00:01:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
r Running Proce
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-02-28 0:04:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-28 06:04:38
.
2008-02-13 09:11:32 --- E O F ---

smithch

Response Number 3

Name: jabuck
Date: February 28, 2008 at 03:28:40 Pacific

Reply:

Open Notepad and copy/paste everything between the X"s into it and make sure "RenV::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
RenV::
----a-w 135,168 2008-02-28 05:24:22 C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent .exe
----a-w 1,404,928 2007-12-28 05:40:57 C:\Program Files\Analog Devices\Core\smax4pnp .exe
----a-w 81,920 2008-01-25 04:57:25 C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w 611,840 2008-02-28 05:20:56 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-28 00:47:55 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-24 21:38:04 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-18 15:06:18 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-18 00:40:25 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-17 17:39:01 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-17 16:05:40 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-17 00:33:27 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-15 22:19:22 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-15 02:06:21 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-15 01:40:54 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-14 00:40:33 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-13 09:20:07 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-12 18:12:26 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-11 13:24:55 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-08 22:30:29 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-08 02:09:04 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-06 23:30:40 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-06 04:32:16 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-04 17:51:50 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-01 23:13:18 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-31 20:51:19 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-31 15:06:01 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-25 13:44:31 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-25 04:54:17 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-25 03:42:45 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-23 05:59:56 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-23 04:52:16 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-23 04:24:19 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-22 13:05:34 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 58,992 2008-02-28 05:22:54 C:\Program Files\Common Files\Symantec Shared\ccApp .exe
----a-w 94,208 2007-12-27 13:37:02 C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w 460,784 2008-02-28 05:24:18 C:\Program Files\DellSupport\DSAgnt .exe
----a-w 267,048 2008-02-28 05:23:45 C:\Program Files\iTunes\iTunesHelper .exe
----a-w 36,975 2008-01-23 06:02:26 C:\Program Files\Java\jre1.5.0_03\bin\jusched .exe
----a-w 454,784 2007-12-29 07:54:38 C:\Program Files\Linksys EasyLink Advisor\LinksysAgent .exe
----a-w 217,088 2008-02-28 00:53:07 C:\Program Files\Logitech\Video\LogiTray .exe
----a-w 196,608 2008-02-28 05:24:14 C:\Program Files\Logitech\Video\ManifestEngine .exe
----a-w 1,537,696 2008-02-28 05:23:04 C:\Program Files\Norton Ghost\Agent\GhostTray .exe
----a-w 155,648 2008-01-31 20:56:03 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-25 13:44:41 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-25 04:54:26 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-25 03:42:47 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-23 06:00:10 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-23 04:52:28 C:\Program Files\QuickTime\qttask .exe
----a-w 747,520 2008-02-28 00:48:05 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-24 21:38:07 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-18 15:06:24 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-18 00:40:31 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-17 17:39:12 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-17 16:05:49 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-17 00:33:32 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-15 22:19:25 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-15 02:06:29 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-15 01:41:03 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-14 00:40:37 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-13 09:20:16 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-12 18:12:34 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-11 13:25:04 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-08 22:30:39 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-08 02:09:07 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-06 23:30:43 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-06 04:32:26 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-05 09:09:20 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-04 17:52:01 C:\Program Files\QuickTime\QTTask .exe
----a-w 823,362 2008-02-28 05:21:59 C:\Program Files\Trend Micro\Internet Security 12\PccGuide .exe
----a-w 176,201 2008-02-28 05:24:07 C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon .exe
----a-w 15,360 2008-01-31 14:54:05 C:\WINDOWS\system32\ctfmon .exe
----a-w 77,824 2008-01-23 06:02:24 C:\WINDOWS\system32\hkcmd .exe
----a-w 114,688 2008-01-23 06:02:26 C:\WINDOWS\system32\igfxpers .exe
----a-w 94,208 2008-01-23 06:02:26 C:\WINDOWS\system32\igfxtray .exe
----a-w 221,184 2008-02-28 05:23:22 C:\WINDOWS\system32\LVCOMSX .exe
----a-w 122,940 2008-02-28 05:23:14 C:\WINDOWS\system32\DLA\DLACTRLW .exe
File::
C:\WINDOWS\pskt.ini
C:\WINDOWS\BM0bb8d543.xml
C:\WINDOWS\system32\F7268E8B10.sys
C:\WINDOWS\system32\gfpdbphy.dll
C:\WINDOWS\system32\admijcbd.dll
C:\WINDOWS\system32\ynuvjyhc.dll

Driver::
Folder::
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c1ef534a-7d33-4bb5-8ad6-5110804c3447}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BM0bb8d543"=-
"088be6df"=-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Download ATF Cleaner from this link:
ATF Cleaner
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner
Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
Scan using the following Anti-Virus database:
Extended
Scan Options:
Scan Archives
Scan Mail Base
Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.
Your java is out of date and can be exploited.
Download the latest version of java from this link Java
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version.
Post a new Combofix log.

Response Number 4

Name: smithch2520
Date: February 28, 2008 at 07:23:10 Pacific

Reply:

The ATF cleaner link does not work. Says it's "Not Found". Any ideas??
smithch

Response Number 5

Name: jabuck
Date: February 28, 2008 at 17:16:52 Pacific

Reply:

You can get it at this line, the other site is down right now:
http://www.softpedia.com/get/Security/Secure-cleaning/ATF-Cleaner.shtml

excel get rid of empty rows popup dell Linksys EasyLink Advisor symantec ativirus out of date and can't update it	Perflib_Perfdata_768.dat get rid desktop ini vista get rid of aol files
See More

Response Number 6

Name: smithch2520
Date: February 29, 2008 at 09:09:21 Pacific

Reply:

Ok, this is frustrating. It says you have to use Internet Explorer to run the Kaspersky Scanner, but it keeps shutting down on me! No matter what I do, it shuts down. I could use Netscape but I could only scan file by file and that could take an eternity. Any ideas? Thanks.
smithch

Response Number 7

Name: jabuck
Date: February 29, 2008 at 14:52:33 Pacific

Reply:

If you have done everything else just post a new Combofix log and a new Hijack This log please.

Response Number 8

Name: smithch2520
Date: February 29, 2008 at 22:28:22 Pacific

Reply:

Here are the logs:
ComboFix:
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\dgjlm.ini
C:\WINDOWS\system32\dgjlm.ini2
C:\WINDOWS\system32\DLA\DLACTRLW.exe
C:\WINDOWS\system32\lbicunsv.ini
C:\WINDOWS\system32\lqyeryob.dll
C:\WINDOWS\system32\LVCOMSX.exe
C:\WINDOWS\system32\mljgd.dll
C:\WINDOWS\system32\mljgd.exe
C:\WINDOWS\system32\oxxrljmc.ini
C:\WINDOWS\system32\vsnucibl.dll
C:\WINDOWS\system32\wllirflu.dll
.
((((((((((((((((((((((((( Files Created from 2008-02-01 to 2008-03-01 )))))))))))))))))))))))))))))))
.
2008-03-01 00:03 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-01 00:02 . 2008-03-01 00:02 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-28 21:15 . 2008-02-28 21:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-28 21:14 . 2008-02-28 21:14 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-28 20:56 . 2008-02-29 23:56 221,184 --a------ C:\WINDOWS\system32\LVCOMSX .exe
2008-02-28 09:03 . 2008-02-28 09:03 22 --a------ C:\WINDOWS\pskt.ini
2008-02-24 15:32 . 2008-02-24 15:32 <DIR> d-------- C:\WINDOWS\PaltalkScene
2008-02-24 15:32 . 2008-02-27 23:16 <DIR> d-------- C:\WINDOWS\Paltalk Messenger
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-01 06:14 --------- d-----w C:\Program Files\QuickTime
2008-03-01 06:14 --------- d-----w C:\Program Files\Linksys EasyLink Advisor
2008-03-01 06:14 --------- d-----w C:\Program Files\iTunes
2008-03-01 06:14 --------- d-----w C:\Program Files\DellSupport
2008-03-01 06:14 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-01 06:03 --------- d-----w C:\Program Files\Java
2008-03-01 05:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-01 01:57 --------- d-----w C:\Program Files\Netscape
2008-03-01 01:57 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Netscape
2008-02-25 03:09 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Skype
2008-02-24 21:47 --------- d-----w C:\Program Files\Lx_cats
2008-01-31 22:10 --------- d-----w C:\Program Files\iPod
2008-01-31 22:06 --------- d-----w C:\Program Files\Bonjour
2008-01-31 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-31 21:51 --------- d-----w C:\Program Files\Apple Software Update
2008-01-31 21:49 --------- d-----w C:\Program Files\Common Files\Apple
2008-01-31 21:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-28 18:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2008-01-25 05:07 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-01-25 04:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 04:22 --------- d-----w C:\Program Files\Lavasoft
2008-01-25 04:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-21 15:44 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-01-15 08:39 30,464 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-01-10 06:51 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Media Player Classic
2006-06-30 06:09 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
[code]
----a-w           135,168 2008-03-01 05:57:37  C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent .exe
----a-w         1,404,928 2008-03-01 05:56:04  C:\Program Files\Analog Devices\Core\smax4pnp .exe
----a-w            81,920 2008-03-01 05:56:38  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           611,840 2008-01-31 20:51:19  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm         .exe
----a-w           611,840 2008-01-31 15:06:01  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm        .exe
----a-w           611,840 2008-01-25 13:44:31  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm       .exe
----a-w           611,840 2008-01-25 04:54:17  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm      .exe
----a-w           611,840 2008-01-25 03:42:45  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm     .exe
----a-w           611,840 2008-03-01 05:54:23  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm   .exe
----a-w           611,840 2008-03-01 02:04:10  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm  .exe
----a-w           611,840 2008-02-29 02:53:38  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w            58,992 2008-03-01 05:56:22  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
----a-w           460,784 2008-03-01 05:57:13  C:\Program Files\DellSupport\DSAgnt .exe
----a-w           267,048 2008-03-01 05:57:07  C:\Program Files\iTunes\iTunesHelper .exe
----a-w           454,784 2008-03-01 05:57:26  C:\Program Files\Linksys EasyLink Advisor\LinksysAgent .exe
----a-w           217,088 2008-03-01 05:56:57  C:\Program Files\Logitech\Video\LogiTray .exe
----a-w         1,537,696 2008-03-01 05:56:39  C:\Program Files\Norton Ghost\Agent\GhostTray .exe
----a-w           155,648 2008-01-31 20:56:03  C:\Program Files\QuickTime\qttask                             .exe
----a-w           518,144 2008-01-25 13:44:41  C:\Program Files\QuickTime\qttask                          .exe
----a-w           518,144 2008-01-25 04:54:26  C:\Program Files\QuickTime\qttask                         .exe
----a-w           518,144 2008-01-25 03:42:47  C:\Program Files\QuickTime\qttask                        .exe
----a-w           518,144 2008-01-23 06:00:10  C:\Program Files\QuickTime\qttask                       .exe
----a-w           518,144 2008-01-23 04:52:28  C:\Program Files\QuickTime\qttask                      .exe
----a-w           747,520 2008-02-28 00:48:05  C:\Program Files\QuickTime\QTTask                    .exe
----a-w           747,520 2008-02-24 21:38:07  C:\Program Files\QuickTime\QTTask                   .exe
----a-w           747,520 2008-02-18 15:06:24  C:\Program Files\QuickTime\QTTask                  .exe
----a-w           747,520 2008-02-18 00:40:31  C:\Program Files\QuickTime\QTTask                 .exe
----a-w           747,520 2008-02-17 17:39:12  C:\Program Files\QuickTime\QTTask                .exe
----a-w           747,520 2008-02-17 16:05:49  C:\Program Files\QuickTime\QTTask               .exe
----a-w           747,520 2008-02-17 00:33:32  C:\Program Files\QuickTime\QTTask              .exe
----a-w           747,520 2008-02-15 22:19:25  C:\Program Files\QuickTime\QTTask             .exe
----a-w           747,520 2008-02-15 02:06:29  C:\Program Files\QuickTime\QTTask            .exe
----a-w           747,520 2008-02-15 01:41:03  C:\Program Files\QuickTime\QTTask           .exe
----a-w           747,520 2008-02-14 00:40:37  C:\Program Files\QuickTime\QTTask          .exe
----a-w           747,520 2008-02-13 09:20:16  C:\Program Files\QuickTime\QTTask         .exe
----a-w           747,520 2008-02-12 18:12:34  C:\Program Files\QuickTime\QTTask        .exe
----a-w           747,520 2008-02-11 13:25:04  C:\Program Files\QuickTime\QTTask       .exe
----a-w           747,520 2008-02-08 22:30:39  C:\Program Files\QuickTime\QTTask      .exe
----a-w           747,520 2008-02-08 02:09:07  C:\Program Files\QuickTime\QTTask     .exe
----a-w           747,520 2008-02-06 23:30:43  C:\Program Files\QuickTime\QTTask    .exe
----a-w           747,520 2008-02-06 04:32:26  C:\Program Files\QuickTime\QTTask   .exe
----a-w           747,520 2008-02-05 09:09:20  C:\Program Files\QuickTime\QTTask  .exe
----a-w           823,362 2008-03-01 05:55:15  C:\Program Files\Trend Micro\Internet Security 12\PccGuide .exe
----a-w           176,201 2008-03-01 05:57:07  C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon .exe
----a-w           221,184 2008-03-01 05:56:49  C:\WINDOWS\system32\LVCOMSX .exe
----a-w           122,940 2008-03-01 05:56:46  C:\WINDOWS\system32\DLA\DLACTRLW .exe
[/code]

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [ ]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [ ]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [ ]
"Aim6"="" []
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-03-01 00:08 15360]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [ ]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-03-01 00:08 77824]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-03-01 00:08 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [ ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" [ ]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [ ]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [ ]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.exe" [ ]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.exe" [ ]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [ ]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [ ]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 11:47 73728]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-04-20 14:14:10 156784]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-04-20 14:11:32 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 02:01:04 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Citrix\\icaweb32\\wfica32.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-01 00:18:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
r Running Proce
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-03-01 0:20:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-01 06:20:56
ComboFix2.txt 2008-02-28 15:04:19
ComboFix3.txt 2008-02-28 06:04:42
.
2008-02-13 09:11:32 --- E O F ---

Here is the HiJack log:
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Chaun Smith\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/pa...
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 9686 bytes

Will this fix also get rid of the red "X" that shows up on my C: drive? It was there before and I got rid of it, but now it's there again. Thanks for your help!
smithch

Response Number 9

Name: jabuck
Date: March 1, 2008 at 15:09:14 Pacific

Reply:

Looks better.
Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
RenV::
----a-w 135,168 2008-03-01 05:57:37 C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent .exe
----a-w 1,404,928 2008-03-01 05:56:04 C:\Program Files\Analog Devices\Core\smax4pnp .exe
----a-w 81,920 2008-03-01 05:56:38 C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w 611,840 2008-01-31 20:51:19 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-31 15:06:01 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-25 13:44:31 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-25 04:54:17 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-01-25 03:42:45 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-03-01 05:54:23 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-03-01 02:04:10 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 611,840 2008-02-29 02:53:38 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w 58,992 2008-03-01 05:56:22 C:\Program Files\Common Files\Symantec Shared\ccApp .exe
----a-w 460,784 2008-03-01 05:57:13 C:\Program Files\DellSupport\DSAgnt .exe
----a-w 267,048 2008-03-01 05:57:07 C:\Program Files\iTunes\iTunesHelper .exe
----a-w 454,784 2008-03-01 05:57:26 C:\Program Files\Linksys EasyLink Advisor\LinksysAgent .exe
----a-w 217,088 2008-03-01 05:56:57 C:\Program Files\Logitech\Video\LogiTray .exe
----a-w 1,537,696 2008-03-01 05:56:39 C:\Program Files\Norton Ghost\Agent\GhostTray .exe
----a-w 155,648 2008-01-31 20:56:03 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-25 13:44:41 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-25 04:54:26 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-25 03:42:47 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-23 06:00:10 C:\Program Files\QuickTime\qttask .exe
----a-w 518,144 2008-01-23 04:52:28 C:\Program Files\QuickTime\qttask .exe
----a-w 747,520 2008-02-28 00:48:05 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-24 21:38:07 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-18 15:06:24 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-18 00:40:31 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-17 17:39:12 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-17 16:05:49 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-17 00:33:32 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-15 22:19:25 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-15 02:06:29 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-15 01:41:03 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-14 00:40:37 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-13 09:20:16 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-12 18:12:34 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-11 13:25:04 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-08 22:30:39 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-08 02:09:07 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-06 23:30:43 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-06 04:32:26 C:\Program Files\QuickTime\QTTask .exe
----a-w 747,520 2008-02-05 09:09:20 C:\Program Files\QuickTime\QTTask .exe
----a-w 823,362 2008-03-01 05:55:15 C:\Program Files\Trend Micro\Internet Security 12\PccGuide .exe
----a-w 176,201 2008-03-01 05:57:07 C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon .exe
----a-w 221,184 2008-03-01 05:56:49 C:\WINDOWS\system32\LVCOMSX .exe
----a-w 122,940 2008-03-01 05:56:46 C:\WINDOWS\system32\DLA\DLACTRLW .exe
File::
C:\WINDOWS\pskt.ini

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Post a new Combofix log.
Run The kaspersky scan again and post the requested report please.
We will need to wait until we get the computer clean to fix the red X or it will just return.

Response Number 10

Name: smithch2520
Date: March 3, 2008 at 20:17:58 Pacific

Reply:

Below are the logs. I was finally able to run the Kaspersky scan!
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE ::
C:\WINDOWS\pskt.ini
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\pskt.ini
.
((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
.
2008-03-03 18:53 . 2008-03-03 18:53 331,776 --a------ C:\WINDOWS\system32\mljgd.dll
2008-03-03 18:53 . 2008-03-03 18:53 146 --ahs---- C:\WINDOWS\system32\dgjlm.ini
2008-03-01 00:03 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-01 00:02 . 2008-03-01 00:02 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-28 21:15 . 2008-02-28 21:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-28 21:14 . 2008-02-28 21:14 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-28 20:56 . 2008-02-29 23:56 221,184 --a------ C:\WINDOWS\system32\LVCOMSX.exe
2008-02-24 15:32 . 2008-02-24 15:32 <DIR> d-------- C:\WINDOWS\PaltalkScene
2008-02-24 15:32 . 2008-02-27 23:16 <DIR> d-------- C:\WINDOWS\Paltalk Messenger
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-04 00:54 --------- d-----w C:\Program Files\Linksys EasyLink Advisor
2008-03-04 00:54 --------- d-----w C:\Program Files\DellSupport
2008-03-04 00:51 --------- d-----w C:\Program Files\iTunes
2008-03-04 00:48 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-02 06:47 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Apple Computer
2008-03-01 15:17 --------- d-----w C:\Program Files\Yahoo!
2008-03-01 06:14 --------- d-----w C:\Program Files\QuickTime
2008-03-01 06:08 77,824 ----a-w C:\WINDOWS\system32\hkcmd.exe
2008-03-01 06:08 15,360 ----a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-03-01 06:08 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-03-01 06:08 114,688 ----a-w C:\WINDOWS\system32\igfxpers.exe
2008-03-01 06:03 --------- d-----w C:\Program Files\Java
2008-03-01 05:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-01 01:57 --------- d-----w C:\Program Files\Netscape
2008-03-01 01:57 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Netscape
2008-02-25 03:09 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Skype
2008-02-24 21:47 --------- d-----w C:\Program Files\Lx_cats
2008-01-31 22:10 --------- d-----w C:\Program Files\iPod
2008-01-31 22:06 --------- d-----w C:\Program Files\Bonjour
2008-01-31 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-31 21:51 --------- d-----w C:\Program Files\Apple Software Update
2008-01-31 21:49 --------- d-----w C:\Program Files\Common Files\Apple
2008-01-31 21:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-28 18:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2008-01-25 05:07 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-01-25 04:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 04:22 --------- d-----w C:\Program Files\Lavasoft
2008-01-25 04:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-21 15:44 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-01-15 08:39 30,464 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-10 06:51 --------- d-----w C:\Documents and Settings\Chaun Smith\Application Data\Media Player Classic
2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-08 16:51 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 00:44 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-12-07 00:44 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-12-07 00:44 1,499,136 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-12-07 00:44 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-12-07 00:44 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2006-06-30 06:09 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
[code]
----a-w           611,840 2008-01-31 20:51:19  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm         .exe
----a-w           611,840 2008-01-31 15:06:01  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm        .exe
----a-w           611,840 2008-01-25 13:44:31  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm       .exe
----a-w           611,840 2008-01-25 04:54:17  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm      .exe
----a-w           611,840 2008-01-25 03:42:45  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm     .exe
----a-w           611,840 2008-03-01 05:54:23  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm   .exe
----a-w           611,840 2008-03-01 02:04:10  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm  .exe
----a-w           249,856 2008-03-04 00:53:19  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w           155,648 2008-01-31 20:56:03  C:\Program Files\QuickTime\qttask                             .exe
----a-w           518,144 2008-01-25 13:44:41  C:\Program Files\QuickTime\qttask                          .exe
----a-w           518,144 2008-01-25 04:54:26  C:\Program Files\QuickTime\qttask                         .exe
----a-w           518,144 2008-01-25 03:42:47  C:\Program Files\QuickTime\qttask                        .exe
----a-w           518,144 2008-01-23 06:00:10  C:\Program Files\QuickTime\qttask                       .exe
----a-w           518,144 2008-01-23 04:52:28  C:\Program Files\QuickTime\qttask                      .exe
----a-w           747,520 2008-02-28 00:48:05  C:\Program Files\QuickTime\QTTask                    .exe
----a-w           747,520 2008-02-24 21:38:07  C:\Program Files\QuickTime\QTTask                   .exe
----a-w           747,520 2008-02-18 15:06:24  C:\Program Files\QuickTime\QTTask                  .exe
----a-w           747,520 2008-02-18 00:40:31  C:\Program Files\QuickTime\QTTask                 .exe
----a-w           747,520 2008-02-17 17:39:12  C:\Program Files\QuickTime\QTTask                .exe
----a-w           747,520 2008-02-17 16:05:49  C:\Program Files\QuickTime\QTTask               .exe
----a-w           747,520 2008-02-17 00:33:32  C:\Program Files\QuickTime\QTTask              .exe
----a-w           747,520 2008-02-15 22:19:25  C:\Program Files\QuickTime\QTTask             .exe
----a-w           747,520 2008-02-15 02:06:29  C:\Program Files\QuickTime\QTTask            .exe
----a-w           747,520 2008-02-15 01:41:03  C:\Program Files\QuickTime\QTTask           .exe
----a-w           747,520 2008-02-14 00:40:37  C:\Program Files\QuickTime\QTTask          .exe
----a-w           747,520 2008-02-13 09:20:16  C:\Program Files\QuickTime\QTTask         .exe
----a-w           747,520 2008-02-12 18:12:34  C:\Program Files\QuickTime\QTTask        .exe
----a-w           747,520 2008-02-11 13:25:04  C:\Program Files\QuickTime\QTTask       .exe
----a-w           747,520 2008-02-08 22:30:39  C:\Program Files\QuickTime\QTTask      .exe
----a-w           747,520 2008-02-08 02:09:07  C:\Program Files\QuickTime\QTTask     .exe
----a-w           747,520 2008-02-06 23:30:43  C:\Program Files\QuickTime\QTTask    .exe
----a-w           747,520 2008-02-06 04:32:26  C:\Program Files\QuickTime\QTTask   .exe
----a-w           747,520 2008-02-05 09:09:20  C:\Program Files\QuickTime\QTTask  .exe
[/code]

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F22FE176-BD57-4CA5-9EBD-E562E4B22DB6}]
2008-03-03 18:53 331776 --a------ C:\WINDOWS\system32\mljgd.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2008-03-03 18:53 514048]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [ ]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2008-03-03 18:54 864256]
"Aim6"="" []
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2008-03-03 18:54 867840]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-03-03 18:54 15360]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2008-03-03 18:54 472576]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2008-02-29 23:56 1404928]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-03-01 00:08 77824]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-03-01 00:08 114688]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-29 23:56 58992]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2008-02-29 23:56 1537696]
"ISUSPM Startup"="c:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" [2008-03-03 18:53 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2008-02-29 23:56 81920]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2008-02-29 23:55 823362]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.exe" [2008-02-29 23:56 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.exe" [2008-02-29 23:56 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [ ]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2008-02-29 23:56 217088]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 11:47 73728]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-29 23:57 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-04-20 14:14:10 156784]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-04-20 14:11:32 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 02:01:04 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\system32\mljgd.exe
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\mljgd
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Citrix\\icaweb32\\wfica32.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 18:53:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\system32\mljgd.dll
.
r Running Proce
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\regsvr32.exe
.
**************************************************************************
.
Completion time: 2008-03-03 19:01:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-04 01:01:07
ComboFix2.txt 2008-03-01 06:21:00
ComboFix3.txt 2008-02-28 15:04:19
ComboFix4.txt 2008-02-28 06:04:42
.
2008-03-01 08:56:47 --- E O F ---

Kaspersky scan:
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
Scan Statistics:
Total number of scanned objects: 50746
Number of viruses found: 7
Number of infected objects: 271
Number of suspicious objects: 0
Duration of the scan process: 02:56:47
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\cert8.db Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\history.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\key3.db Object is locked skipped
C:\Documents and Settings\Chaun Smith\Application Data\Netscape\NSB\Profiles\m8b2tstf.default\parent.lock Object is locked skipped
C:\Documents and Settings\Chaun Smith\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Application Data\ApplicationHistory\TransferAgent.exe.91f03f4d.ini.inuse Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\History\History.IE5\MSHist012008030320080304\index.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Temp\Perflib_Perfdata_768.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Temp\~DF6C92.tmp Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Temp\~DFAA2E.tmp Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\ntuser.dat Object is locked skipped
C:\Documents and Settings\Chaun Smith\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\DellSupport\DSAgnt.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\QuickTime\QTTask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\115.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\168.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\35ED.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\3E.tmp/data0000.bin Infected: Virus.Win32.Trats.c skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\3E.tmp EmbeddedEXE: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\3E.tmp CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4778.tmp/data0000.bin Infected: Virus.Win32.Trats.c skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4778.tmp EmbeddedEXE: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4778.tmp CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\477C.tmp/data0000.bin Infected: Virus.Win32.Trats.c skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\477C.tmp EmbeddedEXE: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\477C.tmp CryptFF.b: infected - 1 skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\48D3.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4A7C.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4AE6.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4C42.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4C9C.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4DFA.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4EF0.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\4FBE.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\50BC.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\51B8.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5289.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5388.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\548B.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5533.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\566D.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\56F1.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\586E.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\58A1.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5A25.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5A63.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5BBA.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5C2C.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5C2D.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5C38.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5C5B.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5C61.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5D30.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5DFF.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5EB2.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5F6A.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\5FAD.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\615A.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6256.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6281.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\62F6.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\647B.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6609.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\67DC.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6978.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6B47.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6CC7.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6E49.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\6FC9.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7147.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\72C3.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7443.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\75C4.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7746.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\78C9.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7A45.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7BC3.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7D45.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\7EC7.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\8049.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\81.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\81CD.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\82.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\83.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\834B.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\84.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\84CF.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\85.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\86.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\864D.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\87.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\87CE.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\88.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\894D.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\8ACE.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\8C4F.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\8DCE.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\8F4E.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\90CD.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\924D.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\93C9.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\9548.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\96C6.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\9846.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\99C8.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\9B46.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\9CC8.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\9E4A.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\9FEE.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\A18B.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\A30F.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\A49F.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\A62B.tmp Infected: Trojan.Win32.Zapchast.dt skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0087677.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0087678.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0087679.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0087681.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0090953.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0090955.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0090956.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0090957.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092953.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092955.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092956.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092957.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092981.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092982.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092983.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0092985.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0097206.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0097207.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0097209.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0099234.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\A0099235.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\ctfmon.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\ctfmon.RB1 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\ctfmon.RB2 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\ctfmon.RB3 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\ctfmon.RB4 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\ctfmon.RB5 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\HKCMD.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\hkcmd.RB1 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\hkcmd.RB2 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\hkcmd.RB3 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\igfxpers.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\igfxpers.RB1 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\igfxpers.RB2 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\IGFXTRAY.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\igfxtray.RB1 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\jusched.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\jusched.RB1 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\jusched.RB2 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\jusched.RB3 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\jusched.RB4 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX12.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX16.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX1D4.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX1E1.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX21.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX2E.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX31.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX36.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX3B.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX556E.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX557A.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX557E.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX5582.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX5585.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX74DD.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX74F3.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX74F7.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX74FE.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCX7501.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCXC.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCXE1.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCXEA.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\Quarantine\Backup\RCXED.RB0 Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Analog Devices\Core\smax4pnp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\issch.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Symantec Shared\ccApp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinAdmin.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.fg skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinUninstaller.exe.vir Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\DellSupport\DSAgnt.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\iTunes\iTunesHelper.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Logitech\Video\ISStart.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Logitech\Video\LogiTray.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Logitech\Video\ManifestEngine.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Norton Ghost\Agent\GhostTray.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\QuickTime\qttask.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Trend Micro\Internet Security 12\pccguide.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\VundoFix Backups\cbwraopl.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\ctnmvefe.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\dajgyrvi.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\duksefnq.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\fbgdcdca.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\gfpdbphy.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\hdxmjotj.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\huqglwei.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\ievnvake.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\mljgd.dll.bad.vir Infected: Virus.Win32.Trats.c skipped
C:\QooBox\Quarantine\C\VundoFix Backups\mljgd.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\VundoFix Backups\ndpdvdbe.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\pmnwynaa.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\rhxrvwut.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\tdwefcge.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\ulfngrdq.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\urbjmkfg.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\VundoFix Backups\vmwncabm.dll.bad.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.auj skipped
C:\QooBox\Quarantine\C\VundoFix Backups\ynuvjyhc.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\DLA\DLACTRLW.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ipd1\zpr121dll.exe.vir Infected: Trojan-Downloader.Win32.Small.gzs skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\lqyeryob.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\LVCOMSX.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mljgd.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vsnucibl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wllirflu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-28_ 00127.17.zip/mljgd.dll Infected: Virus.Win32.Trats.c skipped
C:\QooBox\Quarantine\catchme2008-02-28_ 00127.17.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-03-01_ 01748.85.zip/mljgd.dll Infected: Virus.Win32.Trats.c skipped
C:\QooBox\Quarantine\catchme2008-03-01_ 01748.85.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP568\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{34017A9B-5E96-4F1A-9970-8764B2CE0E84}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\mljgd.dll Infected: Virus.Win32.Trats.c skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_54c.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.

smithch

Response Number 11

Name: smithch2520
Date: March 8, 2008 at 15:41:16 Pacific

Reply:

Hello. I am just wondering if I have provided all the information you needed. Please let me know. Thanks.
smithch

Response Number 12

Name: smithch2520
Date: April 9, 2008 at 18:13:21 Pacific

Reply:

Hello. I posted some logs here over a month ago and I have not heard anything else since. I still have the red "x" by the C: drive and I don't know if there is anything else you need from me or not? I posted the logs you asked for. Please help!!! Thanks!
smithch

Sponsored Link

Ads by Google

Pop Up

pos.tmp help!

Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.

Go to Security and Virus Forum Home

Sponsored links

Ads by Google

Results for: Can't get rid of .tmp files!

Can't get rid of RUN entry/Service

Summary

www.computing.net/answers/security/cant-get-rid-of-run-entryservice/17409.html

downloader esepor can't get rid of

Summary

www.computing.net/answers/security/downloader-esepor-cant-get-rid-of-/13255.html

Can't get rid of winupgro.exe

Summary

www.computing.net/answers/security/cant-get-rid-of-winupgroexe/24143.html

From the Geek Dictionary
door games - basic games, usually text based, that were an integral part of many bulleti...

Ask a Question!

Weekly Poll
What do you think of the new preview of Chrome OS?

Poll Finishes In 6 Days.
Discuss in The Lounge
Poll History

Recent Posts
IP address

Where to download Calmira II LFN?

data error (cyclic redundancy check) DVD copy

Western Digital

IF Formula

All Awaiting Reply

Tom's News
Woman Tracks Down Club Attacker on Facebook

Geolocation Functions Come to Twitter

New Craigslist Trend: Trade Sex for Rent?

Law Firm Investigates MS Over Xbox Live Bans

Amazon Charges $25 for Palm Pixi and $80 for Pre

More Tom's Guide News

Data Recovery

Manufacturer List | About Us | Advertising Info | Contact Us
The information on Computing.Net is the opinions of its users. Such opinions may not be accurate and they are to be used at your own risk. Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE