Ok, you have a rootkit, we will see if sdfix will remove it but first do the following: Go to start> control panel > add/remove programs and uninstall these programs if found: Ultimate Defender adwarespy Zenosearch Zeno Search Assistant removal Webhancer Next restart the computer. Please download SDFix by AndyManchesta and save it to your desktop. Please then reboot your computer in Safe Mode by doing the following: Restart your computer. After hearing your computer beep once during startup, but just before the Windows icon appears, tap the F8 key continually. Instead of Windows loading as normal, a menu with options should appear. Select the first option, to run Windows in "Safe Mode", then press "Enter". Choose your usual account. Once in Safe Mode, please do the following: In Safe Mode, right-click the SDFix.zip folder and choose Extract All. Open the extracted folder and double-click RunThis.bat to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt

0

Sorry for the delay... Still get the error message "can't find secure32.html" when launching Internet Explorer. Here's the SDFix log file: SDFix: Version 1.52 **************** 27/12/2006 - 22:19:11.33 Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOCUME~1\Assya\Desktop\SDFix\SDFix Stage One - Safe Mode Checking Services... Service Name: MsaSvc File Path: C:\WINDOWS\system32\msasvc.exe MsaSvc Deleted... Starting Registry Repairs... Restoring Default Hosts File... Stage One Complete Rebooting... Stage Two - Normal Mode Checking For Malware: -------------------- C:\RECYCLER\NPROTECT\00044164.T C:\RECYCLER\NPROTECT\00048072.T C:\WINDOWS\system32\msnav32.ax C:\WINDOWS\system32\plugin1.dat C:\WINDOWS\system32\SysPr.prx Backing Up and Removing any Files Found... Alternate Stream Check: C:\WINDOWS\system32 No streams found. Final Check: Remaining Services: ------------------ [COLOR=RED][B]Rootkit PE386 Found![/COLOR]. Rootkit scan Needed...[/B] Authorized Application Key Export: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] Remaining Files: --------------- Backups Folder: - C:\DOCUME~1\Assya\Desktop\SDFix\SDFix\backups\backups.zip Checking for files with Hidden Attributes: C:\WINDOWS\QXNzeWE\asappsrv.dll C:\RECYCLER\NPROTECT\00048110.exe C:\WINDOWS\QXNzeWE\command.exe C:\WINDOWS\system32\cdplayer.exe.manifest C:\WINDOWS\system32\logonui.exe.manifest C:\hiberfil.sys C:\IO.SYS C:\MSDOS.SYS C:\pagefile.sys C:\WINDOWS\system32\38F032101D.sys C:\WINDOWS\system32\KGyGaAvL.sys FINISHED!

0

Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe We will run this later also Reboot into safe mode again. Run hijack This from safe mode, close all windows except Hijack This, place check in the box to the left of then following items then press "fix checked": R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe O4 - HKLM\..\Run: [czpeexk.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll",rzqlgze O4 - HKLM\..\Run: [{52-27-7D-D9-ZN}] c:\windows\system32\nsdsregm.exe OLI001 O4 - HKCU\..\Run: [startkey] C:\WINDOWS\system32\vmedia.exe O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\Assya\LOCALS~1\Temp\svchost.exe O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\qwintoed.exe O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing) Exit Hijack This but remain in safe mode. Run Killbox from safe mode.Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): c:\secure32.html C:\WINDOWS\system32\zgCrypt.dll C:\WINDOWS\system32\autosys.exe C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll,rzqlgze C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll c:\windows\system32\nsdsregm.exe C:\WINDOWS\system32\vmedia.exe C:\WINDOWS\system32\dwdsregt.exe C:\WINDOWS\system32\qwintoed.exe C:\WINDOWS\iun6002.exe Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Reboot into safe mode. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Doubleclick the drweb-cureit.exe file and Allow to run the express scan. This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, look if you can click next icon next to the files found: If so, click it and then click the next icon right below and select Move incurable. This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log on your desktop. There will be more work to do. Post the AVG Anti-Spyware and DR Web Cureit log the post a Combofix log and a Hijack This log in the order they were requested please.

0

Hi there, hope i understood in what order you want me to post. I did what you wrote in the last post: Safe mode: Hijack this - fixed all besides these 2 things, I didn't find: O4 - HKCU\..\Run: [startkey] C:\WINDOWS\system32\vmedia.exe O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing) then Killbox - didn't get any PendingFileRenameOperations prompt there (and didn't receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox). After rebooting (again) in Safe mode ran ATF-Cleaner, AVG Anti-spyware and finally drweb-cureit. Here're the logs. AVG Anti-Spyware log: AVG Anti-Spyware - Scan Report + Created at: 00:43:08 28/12/2006 + Scan result: C:\WINDOWS\QXNzeWE\asappsrv.dll -> Adware.CommAd : Cleaned with backup (quarantined). C:\WINDOWS\QXNzeWE\command.exe -> Adware.CommAd : Cleaned with backup (quarantined). HKU\S-1-5-21-1644491937-813497703-1060284298-1003\CLSID\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} -> Adware.MyTool : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043605.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\NDNuninstall7_48.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043655.exe -> Adware.SurfAcc : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043818.exe -> Adware.SurfAccuracy : Cleaned with backup (quarantined). C:\!KillBox\dwdsregt.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\!KillBox\nsdsregm.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043678.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043681.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043917.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00044081.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00044480.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00047800.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00048261.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00048264.exe -> Adware.ZenoSearch : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043628.exe -> Dialer.GBDialer.i : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043752.dll -> Downloader.IstBar.pb : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043634.exe -> Downloader.Small.dgk : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043637.exe -> Not-A-Virus.Hoax.Win32.Renos.fl : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043572.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). C:\WINDOWS\system32\protector.exe -> Proxy.Wopla.ac : Cleaned with backup (quarantined). C:\WINDOWS\system32\ntio256.sys -> Rootkit.Agent.cf : Cleaned with backup (quarantined). :mozilla.10:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.14:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.14:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.28:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.31:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.31:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.7:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Doubleclick : Cleaned. :mozilla.10:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.13:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.13:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.29:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.32:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.32:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.6:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.8:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.8:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.8:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.9:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Mediaplex : Cleaned. :mozilla.12:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.12:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.30:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.30:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.30:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.8:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.8:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.14:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.15:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.15:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.16:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.16:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.16:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.17:C:\RECYCLER\NPROTECT\00044738.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.17:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.17:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.18:C:\RECYCLER\NPROTECT\00044742.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.18:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.19:C:\RECYCLER\NPROTECT\00044745.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.35:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.36:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.37:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044748.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044754.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044780.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044783.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044790.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044792.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044820.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044826.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00047097.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00047589.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.38:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00044829.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00044830.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.39:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00044833.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00044835.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00046756.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047590.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.40:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.41:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047592.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047595.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047597.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047599.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047602.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047603.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047604.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047610.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047612.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047616.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047620.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.42:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.43:C:\RECYCLER\NPROTECT\00047623.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.44:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.44:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.44:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.44:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.44:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.44:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.45:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.45:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.45:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.45:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.45:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.45:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.46:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.46:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.46:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.46:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.46:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.46:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.47:C:\RECYCLER\NPROTECT\00047630.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.47:C:\RECYCLER\NPROTECT\00047633.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.47:C:\RECYCLER\NPROTECT\00047635.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.47:C:\RECYCLER\NPROTECT\00047648.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.47:C:\RECYCLER\NPROTECT\00047658.MOZ -> TrackingCookie.Zedo : Cleaned. :mozilla.47:C:\RECYCLER\NPROTECT\00047659.MOZ -> TrackingCookie.Zedo : Cleaned. C:\!KillBox\vmedia.exe -> Trojan.Pakes : Cleaned with backup (quarantined). C:\RECYCLER\NPROTECT\00043665.exe -> Trojan.ProcKill.DJ : Cleaned with backup (quarantined). C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> Trojan.Sinowal.br : Cleaned with backup (quarantined). C:\WINDOWS\QXNzeWE\krhWyqH.vbs -> Trojan.Small : Cleaned with backup (quarantined). ::Report end DR Web Cureit log: autosys.exe;C:\!KillBox;Trojan.StartPage.1769;Deleted.; zgCrypt.dll;C:\!KillBox;Trojan.DownLoader.15676;Deleted.; Process.exe;C:\Documents and Settings\Assya\Desktop\SDFix\SDFix\apps;Tool.Prockill;Incurable.Moved.; Process.exe;C:\Documents and Settings\Assya\Desktop\SmitfraudFix\SmitfraudFix;Tool.Prockill;Incurable.Moved.; restart.exe;C:\Documents and Settings\Assya\Desktop\SmitfraudFix\SmitfraudFix;Tool.ShutDown.11;Incurable.Moved.; backup-20061227-140941-228.dll;C:\hijackthis\backups;Trojan.DownLoader.15676;Deleted.; backup-20061227-234228-187.dll;C:\hijackthis\backups;Trojan.DownLoader.15676;Deleted.; ibm00002.dll;C:\Program Files\Common Files\Microsoft Shared\Web Folders;Trojan.PWS.Snap;Deleted.; 00043631.DLL;C:\RECYCLER\NPROTECT;Trojan.PWS.Tanspy;Deleted.; A0030065.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.PWS.Snap;Deleted.; A0030066.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Dialer.Maxd;Deleted.; A0030067.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.14191;Deleted.; A0030069.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.10801;Deleted.; A0030071.sys;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Sklog;Deleted.; A0030072.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Sklog;Deleted.; A0030073.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030074.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030075.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030076.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030077.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030078.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030079.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030080.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030081.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030082.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.ZenoSearch;Incurable.Moved.; A0030083.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.NewDotNet;Incurable.Moved.; A0030084.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.NewDotNet;Incurable.Moved.; A0030085.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.SurfAcc;Incurable.Moved.; A0030086.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Adware.SurfAcc;Incurable.Moved.; A0030087.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Proxy.493;Deleted.; A0030088.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Proxy.493;Deleted.; A0030089.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DnsChange;Deleted.; A0030090.EXE;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.Fakealert;Deleted.; A0030091.exe;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.StartPage.1769;Deleted.; A0030092.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.15676;Deleted.; A0030093.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.15676;Deleted.; A0030094.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.DownLoader.15676;Deleted.; A0030095.dll;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.PWS.Snap;Deleted.; A0030096.DLL;C:\System Volume Information\_restore{BEF9ECEB-0971-4521-9854-A390B171C725}\RP26;Trojan.PWS.Tanspy;Deleted.; Combofix log: Assya - 06-12-27 17:49:42.10 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Assya\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\dwdsregt.exe ((((((((((((((((((((((((((((((( Files Created from 2006-11-27 to 2006-12-27 )))))))))))))))))))))))))))))))))) 2006-12-27 17:22 2,900 --a------ C:\WINDOWS\system32\tmp.reg 2006-12-27 17:01 <DIR> d-------- C:\Program Files\Ultimate Defender 2006-12-27 16:56 45,116 --a------ C:\WINDOWS\system32\nsdsregm.exe 2006-12-27 16:46 184,412 --a------ C:\WINDOWS\system32\qwintoed.exe 2006-12-27 16:38 <DIR> d-------- C:\Program Files\Network Associates 2006-12-27 16:38 <DIR> d-------- C:\Program Files\Common Files\Network Associates 2006-12-27 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Network Associates 2006-12-27 15:22 2,560 --a------ C:\WINDOWS\_MSRSTRT.exe 2006-12-27 14:15 <DIR> d-------- C:\Program Files\Lavasoft 2006-12-27 14:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Lavasoft 2006-12-27 13:20 <DIR> d-------- C:\!KillBox 2006-12-27 12:10 <DIR> d-------- C:\Program Files\CleanUp! 2006-12-27 12:05 184,397 --a------ C:\WINDOWS\system32\lwintoed.exe 2006-12-26 23:55 <DIR> d-------- C:\hijackthis 2006-12-26 23:41 73,728 --a------ C:\WINDOWS\system32\out.dll 2006-12-26 23:41 <DIR> d-------- C:\Program Files\micore 2006-12-26 23:41 <DIR> d-------- C:\Program Files\atomwire 2006-12-26 23:41 <DIR> d-------- C:\Program Files\adwarespy 2006-12-26 23:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\al 2006-12-26 22:20 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2006-12-26 22:17 <DIR> d-------- C:\Documents and Settings\Assya\.housecall6.6 2006-12-26 21:24 184,450 --a------ C:\WINDOWS\system32\swintoed.exe 2006-12-26 21:15 <DIR> d-------- C:\Program Files\Mozilla Firefox 2006-12-26 21:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Mozilla 2006-12-26 20:12 184,445 --a------ C:\WINDOWS\system32\rwintoed.exe 2006-12-26 19:13 184,436 --a------ C:\WINDOWS\system32\mwintoed.exe 2006-12-26 16:39 183,808 --a-s---- C:\WINDOWS\NDNuninstall7_48.exe 2006-12-26 16:38 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ultimate Cleaner 2006-12-26 16:37 <DIR> d-------- C:\Program Files\Ultimate Cleaner 2006-12-26 16:36 931 --a------ C:\WINDOWS\system32\winpfz32.sys 2006-12-26 16:36 2,981 --a------ C:\WINDOWS\system32\autosys.exe 2006-12-26 16:36 184,409 --a------ C:\WINDOWS\system32\mwinkoed.exe 2006-12-26 16:36 10,000 --a------ C:\WINDOWS\system32\zgCrypt.dll 2006-12-26 16:35 8,464 --a------ C:\WINDOWS\system32\sporder.dll 2006-12-26 16:35 <DIR> d--hs---- C:\WINDOWS\QXNzeWE 2006-12-26 16:35 <DIR> d-------- C:\Program Files\Symantec Technical Support 2006-12-24 20:25 1,240,778 --a------ C:\WINDOWS\system32\vmedia.exe 2006-12-24 20:20 <DIR> d-------- C:\Program Files\FlashGet 2006-12-23 20:12 <DIR> d-------- C:\WINDOWS\Sun 2006-12-23 20:12 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Sun 2006-12-23 20:09 <DIR> d-------- C:\Program Files\Java 2006-12-23 20:05 <DIR> d-------- C:\Program Files\Common Files\Java 2006-12-17 14:14 <DIR> d--h----- C:\WINDOWS\PIF 2006-12-17 13:37 <DIR> d-------- C:\Program Files\RevConnect 2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\xing shared 2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\Real 2006-12-14 23:06 <DIR> d-------- C:\Program Files\Real 2006-12-14 23:06 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Real 2006-12-14 22:56 <DIR> d-------- C:\My Downloads 2006-12-11 12:21 <DIR> d-------- C:\Program Files\BatteryInfo 2006-12-11 11:09 <DIR> d-------- C:\Program Files\Lavalys 2006-12-10 17:03 <DIR> d-------- C:\Program Files\SPDemo 2006-12-09 14:43 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\uTorrent 2006-12-09 14:02 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2006-12-09 11:00 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 2006-12-09 10:22 724,992 --a------ C:\WINDOWS\iun6002.exe 2006-12-09 10:22 <DIR> d-------- C:\Program Files\Lion Heart's Codec Pack 2006-12-08 19:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Help 2006-12-08 19:18 <DIR> d-------- C:\Program Files\CronosPlus 2006-12-08 17:37 <DIR> d-------- C:\Program Files\eMule 2006-12-08 15:29 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2006-12-08 15:29 <DIR> d-------- C:\Program Files\cladDVD 2006-12-08 15:28 <DIR> d-------- C:\Program Files\ImTOO 2006-12-08 15:03 34,308 --a------ C:\WINDOWS\system32\BASSMOD.dll 2006-12-08 15:03 <DIR> d-------- C:\Program Files\Babylon 2006-12-08 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Babylon 2006-12-08 15:02 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Babylon 2006-12-08 14:45 <DIR> d-------- C:\Downloads 2006-12-08 14:44 <DIR> d-------- C:\Program Files\BitComet 2006-12-08 12:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2006-12-08 12:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2006-12-08 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2006-12-08 10:48 <DIR> d-------- C:\WINDOWS\pss 2006-12-08 10:32 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-12-08 10:32 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2006-12-08 10:32 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2006-12-08 10:09 303,104 --a------ C:\WINDOWS\system32\rmparser.dll 2006-12-08 10:09 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll 2006-12-08 10:09 <DIR> d-------- C:\AVOneExport 2006-12-08 10:08 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2006-12-08 10:08 <DIR> d-------- C:\Program Files\Mpgdvd.com 2006-12-08 10:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2006-12-08 09:51 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2006-12-08 09:51 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Leadertech 2006-12-08 09:45 <DIR> d-------- C:\Program Files\Adobe 2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Adobe 2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2006-12-08 09:44 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2006-12-08 09:39 <DIR> d-------- C:\Program Files\Common Files\Adobe 2006-12-08 09:33 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Macromedia 2006-12-08 09:31 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS 2006-12-08 00:46 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2006-12-07 23:26 56 -r-hs---- C:\WINDOWS\system32\38F032101D.sys 2006-12-07 23:26 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2006-12-07 23:26 <DIR> d-------- C:\Program Files\DivX 2006-12-07 23:10 <DIR> d-------- C:\Program Files\XVid;-) 2006-12-07 23:10 <DIR> d-------- C:\Program Files\XviD 2006-12-07 22:59 <DIR> d-------- C:\Program Files\ICQLite 2006-12-07 22:59 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\ICQLite 2006-12-07 22:47 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ahead 2006-12-07 22:46 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2006-12-07 22:46 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2006-12-07 22:46 5,632 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2006-12-07 22:46 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2006-12-07 22:46 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2006-12-07 22:46 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2006-12-07 22:46 113,664 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys 2006-12-07 22:46 <DIR> d-------- C:\Program Files\Common Files\Ahead 2006-12-07 22:46 <DIR> d-------- C:\Program Files\Ahead 2006-12-07 22:41 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft.NET 2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2006-12-07 22:38 <DIR> d-------- C:\Program Files\Common Files\DESIGNER 2006-12-07 22:37 <DIR> d-------- C:\WINDOWS\SHELLNEW 2006-12-07 22:37 <DIR> d-------- C:\Program Files\Microsoft Office 2006-12-07 22:35 <DIR> dr-h----- C:\MSOCache 2006-12-07 21:21 <DIR> d-------- C:\Program Files\WinZip 2006-12-07 21:17 <DIR> d-------- C:\Program Files\Webteh 2006-12-07 20:34 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups 2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 6.02 2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 2006-12-07 20:31 <DIR> d-------- C:\Program Files\Microsoft IntelliType Pro 6.02 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth3.dll 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth2.dll 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdinpun.dll 2006-12-07 20:24 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdvntc.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdurdu.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth0.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintel.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintam.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinmar.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinkan.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinhin.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinguj.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdindev.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdheb.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdfa.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda3.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda1.dll 2006-12-07 20:24 5,632 --a------ C:\WINDOWS\system32\kbdusa.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdgeo.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarmw.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarme.dll 2006-12-07 20:24 185,344 --a------ C:\WINDOWS\system32\Thawbrkr.dll 2006-12-07 20:24 10,752 --a------ C:\WINDOWS\system32\c_iscii.dll 2006-12-07 20:12 18,200 --a------ C:\WINDOWS\system32\wups2.dll 2006-12-07 20:12 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2006-12-07 20:10 <DIR> d---s---- C:\Documents and Settings\Assya\UserData 2006-12-07 20:06 306,688 --a------ C:\WINDOWS\IsUninst.exe 2006-12-07 20:05 <DIR> d-------- C:\Program Files\Symantec 2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Symantec 2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2006-12-07 20:04 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2006-12-07 20:00 <DIR> d-------- C:\Program Files\WinRAR 2006-12-07 19:56 <DIR> d--hs---- C:\RECYCLER 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\SendTo 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Recent 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data\. 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Start Menu 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\My Documents 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Favorites 2006-12-07 19:45 <DIR> d--h----- C:\Program Files\Uninstall Information 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Templates 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\PrintHood 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\NetHood 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Local Settings 2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Cookies 2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Application Data\Microsoft 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Desktop 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Identities 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\.. 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\.. 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\. 2006-12-07 19:44 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\SoftwareDistribution 2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\Prefetch 2006-12-07 19:38 0 -rahs---- C:\MSDOS.SYS 2006-12-07 19:38 0 -rahs---- C:\IO.SYS 2006-12-07 19:38 0 --a------ C:\CONFIG.SYS 2006-12-07 19:38 0 --a------ C:\AUTOEXEC.BAT 2006-12-07 19:38 <DIR> d-------- C:\WINDOWS\system32\xircom 2006-12-07 19:38 <DIR> d-------- C:\Program Files\xerox 2006-12-07 19:38 <DIR> d-------- C:\Program Files\microsoft frontpage 2006-12-07 19:37 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2006-12-07 19:36 <DIR> dr------- C:\WINDOWS\Offline Web Pages 2006-12-07 19:36 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM 2006-12-07 19:36 <DIR> d--h----- C:\Program Files\WindowsUpdate 2006-12-07 19:36 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files 2006-12-07 19:35 64,512 --a------ C:\WINDOWS\system32\acctres.dll 2006-12-07 19:35 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2006-12-07 19:35 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2006-12-07 19:35 <DIR> d-------- C:\WINDOWS\system32\DirectX 2006-12-07 19:35 <DIR> d-------- C:\Program Files\Common Files\Services 2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\isign32.dll 2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\ils.dll 2006-12-07 19:34 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2006-12-07 19:34 73,728 --a------ C:\WINDOWS\system32\icwdial.dll 2006-12-07 19:34 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2006-12-07 19:34 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2006-12-07 19:34 69,632 --a------ C:\WINDOWS\system32\msconf.dll 2006-12-07 19:34 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-12-07 19:34 67,584 --a------ C:\WINDOWS\system32\srclient.dll 2006-12-07 19:34 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll 2006-12-07 19:34 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll 2006-12-07 19:34 48,128 --a------ C:\WINDOWS\system32\inetres.dll 2006-12-07 19:34 465,176 --a------ C:\WINDOWS\system32\wuapi.dll 2006-12-07 19:34 45,568 --a------ C:\WINDOWS\system32\safrslv.dll 2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll 2006-12-07 19:34 41,240 --a------ C:\WINDOWS\system32\wups.dll 2006-12-07 19:34 382,464 --a------ C:\WINDOWS\system32\qmgr.dll 2006-12-07 19:34 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll 2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2006-12-07 19:34 29,696 --a------ C:\WINDOWS\system32\safrdm.dll 2006-12-07 19:34 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2006-12-07 19:34 274,944 --a------ C:\WINDOWS\system32\mstask.dll 2006-12-07 19:34 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll 2006-12-07 19:34 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll 2006-12-07 19:34 239,104 --a------ C:\WINDOWS\system32\srrstr.dll 2006-12-07 19:34 23,040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-12-07 19:34 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll 2006-12-07 19:34 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll 2006-12-07 19:34 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2006-12-07 19:34 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2006-12-07 19:34 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe 2006-12-07 19:34 170,496 --a------ C:\WINDOWS\system32\srsvc.dll 2006-12-07 19:34 16,896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-12-07 19:34 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2006-12-07 19:34 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-12-07 19:34 127,256 --a------ C:\WINDOWS\system32\wucltui.dll 2006-12-07 19:34 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe 2006-12-07 19:34 12,288 --a------ C:\WINDOWS\system32\mstinit.exe 2006-12-07 19:34 105,984 --a------ C:\WINDOWS\system32\msoert2.dll 2006-12-07 19:34 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll 2006-12-07 19:34 <DIR> d---s---- C:\WINDOWS\Tasks 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Restore 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Macromed 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\srchasst 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Outlook Express 2006-12-07 19:34 <DIR> d-------- C:\Program Files\NetMeeting 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Movie Maker 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Internet Explorer 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\System 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\MSSoap 2006-12-07 19:33 <DIR> d-------- C:\WINDOWS\Registration 2006-12-07 19:33 <DIR> d-------- C:\Program Files\ComPlus Applications 2006-12-07 19:32 97,792 --a------ C:\WINDOWS\system32\comrepl.dll 2006-12-07 19:32 9,728 --a------ C:\WINDOWS\system32\reset.exe 2006-12-07 19:32 80,384 --a------ C:\WINDOWS\system32\charmap.exe 2006-12-07 19:32 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2006-12-07 19:32 605,696 --a------ C:\WINDOWS\system32\getuname.dll 2006-12-07 19:32 56,832 --a------ C:\WINDOWS\system32\sol.exe 2006-12-07 19:32 55,296 --a------ C:\WINDOWS\system32\freecell.exe 2006-12-07 19:32 54,272 --a------ C:\WINDOWS\system32\stclient.dll 2006-12-07 19:32 5,632 --a------ C:\WINDOWS\system32\write.exe 2006-12-07 19:32 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2006-12-07 19:32 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2006-12-07 19:32 35,328 --a------ C:\WINDOWS\system32\winchat.exe 2006-12-07 19:32 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll 2006-12-07 19:32 33,792 --a------ C:\WINDOWS\system32\regini.exe 2006-12-07 19:32 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2006-12-07 19:32 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2006-12-07 19:32 227,840 --a------ C:\WINDOWS\system32\avtapi.dll 2006-12-07 19:32 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe 2006-12-07 19:32 20,992 --a------ C:\WINDOWS\system32\msg.exe 2006-12-07 19:32 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2006-12-07 19:32 183,808 --a------ C:\WINDOWS\system32\accwiz.exe 2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe 2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe 2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe 2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2006-12-07 19:32 15,360 --a------ C:\WINDOWS\system32\logoff.exe 2006-12-07 19:32 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tscon.exe 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\shadow.exe 2006-12-07 19:32 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe 2006-12-07 19:32 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe 2006-12-07 19:32 126,976 --a------ C:\WINDOWS\system32\mshearts.exe 2006-12-07 19:32 123,392 --a------ C:\WINDOWS\system32\mplay32.exe 2006-12-07 19:32 119,808 --a------ C:\WINDOWS\system32\winmine.exe 2006-12-07 19:32 114,688 --a------ C:\WINDOWS\system32\calc.exe 2006-12-07 19:32 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Windows Media Player 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Online Services 2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN Gaming Zone 2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Messenger 2006-12-07 19:31 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll 2006-12-07 19:31 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2006-12-07 19:31 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll 2006-12-07 19:31 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2006-12-07 19:31 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2006-12-07 19:31 67,072 --a------ C:\WINDOWS\system32\rdshost.exe 2006-12-07 19:31 655,360 --a------ C:\WINDOWS\system32\mstscax.dll 2006-12-07 19:31 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll 2006-12-07 19:31 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe 2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\remotepg.dll 2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\colbact.dll 2006-12-07 19:31 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll 2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\licwmi.dll 2006-12-07 19:31 56,320 --a------ C:\WINDOWS\system32\servdeps.dll 2006-12-07 19:31 540,160 --a------ C:\WINDOWS\system32\comuid.dll 2006-12-07 19:31 538,624 --a------ C:\WINDOWS\system32\spider.exe 2006-12-07 19:31 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll 2006-12-07 19:31 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2006-12-07 19:31 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll 2006-12-07 19:31 407,552 --a------ C:\WINDOWS\system32\mstsc.exe 2006-12-07 19:31 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2006-12-07 19:31 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll 2006-12-07 19:31 343,040 --a------ C:\WINDOWS\system32\mspaint.exe 2006-12-07 19:31 295,424 --a------ C:\WINDOWS\system32\termsrv.dll 2006-12-07 19:31 225,792 --a------ C:\WINDOWS\system32\catsrv.dll 2006-12-07 19:31 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2006-12-07 19:31 20,480 --a------ C:\WINDOWS\system32\qprocess.exe 2006-12-07 19:31 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2006-12-07 19:31 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2006-12-07 19:31 185,344 --a------ C:\WINDOWS\system32\cmprops.dll 2006-12-07 19:31 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll 2006-12-07 19:31 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2006-12-07 19:31 147,968 --a------ C:\WINDOWS\system32\rdchost.dll 2006-12-07 19:31 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe 2006-12-07 19:31 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2006-12-07 19:31 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2006-12-07 19:31 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2006-12-07 19:31 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2006-12-07 19:31 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll 2006-12-07 19:31 11,264 --a------ C:\WINDOWS\system32\icaapi.dll 2006-12-07 19:31 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe 2006-12-07 19:31 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll 2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\MsDtc 2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\Com 2006-12-07 19:31 <DIR> d-------- C:\Program Files\Windows NT (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) [color=red][b]Rootkit driver pe386 is present. A rootkit scan is required[/b][/color] 2006-12-27 16:38 -------- d-------- C:\Program Files\Common Files 2006-12-27 15:22 2560 --a------ C:\WINDOWS\_MSRSTRT.exe 2006-12-09 11:04 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-12-08 14:45 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2006-12-07 17:02 2174976 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-10-19 15:56 713216 --a------ C:\WINDOWS\system32\sxs.dll 2006-10-13 14:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 14:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 14:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "startkey"="C:\\WINDOWS\\system32\\vmedia.exe" "Recoveru systems"="C:\\DOCUME~1\\Assya\\LOCALS~1\\Temp\\svchost.exe" "Aapp"="" "network administration"="" "profile"="" "execution"="" "WinDisk32"="" "bawindo"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\Ultimate Defender.install] @="\"C:\\Documents and Settings\\Assya\\Local Settings\\Temporary Internet Files\\Content.IE5\\12F12OG8\\udefender_eE28o2QRe8[1].exe\" continue" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "Babylon Client"="C:\\Program Files\\Babylon\\Babylon-Pro\\Babylon.exe -AutoStart" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "AutoSys"="C:\\WINDOWS\\system32\\autosys.exe" "czpeexk.dll"="C:\\WINDOWS\\system32\\rundll32.exe \"C:\\Documents and Settings\\Assya\\Local Settings\\Application Data\\czpeexk.dll\",rzqlgze" "{52-27-7D-D9-ZN}"="C:\\windows\\system32\\nsdsregm.exe OLI001" "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoRun"=dword:00000000 "NoClose"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20061227-142927-303 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20061227-142927-135 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20061227-142927-321 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20061227-142927-598 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20061227-142927-432 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20061227-142927-818 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20061227-140941-100 O17 - HKLM\System\CCS\Services\Tcpip\..\{C43E3DCD-0DDC-4E14-B460-D82FDA36C464}: NameServer = 212.117.129.12 212.117.129.5 backup-20061227-140941-228 O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll backup-20061227-140941-125 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20061227-140941-939 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20061227-140941-261 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20061227-140941-762 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20061227-140940-346 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20061227-140941-481 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20061227-122834-881 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20061227-122834-942 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20061227-122834-119 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20061227-122834-259 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20061227-122834-864 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20061227-122834-495 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-12-27 17:50:47.98 C:\ComboFix.txt ... 06-12-27 17:50 and last Ijack This log: Logfile of HijackThis v1.99.1 Scan saved at 23:31:06, on 27/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe O4 - HKLM\..\Run: [czpeexk.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll",rzqlgze O4 - HKLM\..\Run: [{52-27-7D-D9-ZN}] c:\windows\system32\dwdsregt.exe OLI001 O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pwintoeb.exe OLI001 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\Assya\LOCALS~1\Temp\svchost.exe O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\nsdsregm.exe O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwintoeb.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

0

If i didn't post in the order you meant, please repeat in what order you want it and i'll post again. Also, it seems there's progress, the Internet Explorer launched without any errors (to blank page) and the computer seems to work better. But, as you said, it seems there's more work to do. Oh, and the Internet Explorer stil doesn't show the images on web pages (just a rectangular with shapes in it, instead of the icons or images). Also, I unistalled the Norton Anti virus 2003 I had (cause it didn't seem to work, didn't find any virus) - what you recomend I install instead and when? Hope to get more instructions soon. Thank you very much for your help.

0

Not much progress. Lets search for the rootkit first. Download Gmer from this link Gmer Then doubleclick to open it. Do this in safe mode if it will not run in normal mode. You will probably get a message that a rootkit has been found. Gmer then asks if you want to perform a full scan. Click No. GMER should have identified in red a service named PE386. Right click on that service and choose "Delete Service" to remove it. Then close GMER and reboot. Next download AVG_AntiRootkit from this link AVG_AntiRootkit Click the "Search for Rootkits" button. It should find a rootkit file named system32:lzx32.sys. Select it and click the "Remove Selected Items" button. Do not click any others if they are identified but let me know if another is found. You will have to reboot.

0

Thank you for the great help! I ran GMER from normal mode (after extracting it from the zipped archiv), it ran witvout errors. It did identified in red a service named PE386. After clicking "Delete service", it asked for confirmation twice, I confirmed delete and it seemed to delete it, but then gave me an error of some type (Ex"0000.."). Then, I entered the safe mode and tried to do it from there, but when I ran it from safe mode it seemed it didn't find any thing (or didn't run at all, not sure). Then, I rebooted the second time, to normal mode and installed AVG_AntiRootkit - it asked to reboot and so it did. After rebooting I clicked on "Search for Rootkits" button, it ran a short scan and didn't find a thing.

0

Please post a combofix log.

0

Do you want me to run combofix.exe from normal mode or post the last log?

0

Run it from normal mode and post the new log.

0

Ran it. Assya - 06-12-28 18:17:19.12 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Assya\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-11-28 to 2006-12-28 )))))))))))))))))))))))))))))))))) 2006-12-28 15:01 61,584 --a------ C:\WINDOWS\system32\drivers\klick.sys 2006-12-28 15:01 59,536 --a------ C:\WINDOWS\system32\drivers\klin.sys 2006-12-28 15:01 <DIR> d-------- C:\Program Files\Kaspersky Lab 2006-12-28 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2006-12-28 14:51 <DIR> d-------- C:\kav 2006-12-28 14:16 <DIR> d--hs---- C:\Config.Msi 2006-12-28 00:48 <DIR> d-------- C:\Documents and Settings\Assya\DoctorWeb 2006-12-27 23:16 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-27 23:15 <DIR> d-------- C:\Program Files\Grisoft 2006-12-27 22:50 <DIR> d-------- C:\Program Files\XoftSpy 2006-12-27 22:34 184,405 --a------ C:\WINDOWS\system32\pwintoeb.exe 2006-12-27 17:22 2,900 --a------ C:\WINDOWS\system32\tmp.reg 2006-12-27 16:38 <DIR> d-------- C:\Program Files\Network Associates 2006-12-27 15:22 2,560 --a------ C:\WINDOWS\_MSRSTRT.exe 2006-12-27 14:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Lavasoft 2006-12-27 13:20 <DIR> d-------- C:\!KillBox 2006-12-27 12:10 <DIR> d-------- C:\Program Files\CleanUp! 2006-12-27 12:05 184,397 --a------ C:\WINDOWS\system32\lwintoed.exe 2006-12-26 23:55 <DIR> d-------- C:\hijackthis 2006-12-26 23:41 73,728 --a------ C:\WINDOWS\system32\out.dll 2006-12-26 23:41 <DIR> d-------- C:\Program Files\micore 2006-12-26 23:41 <DIR> d-------- C:\Program Files\adwarespy 2006-12-26 23:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\al 2006-12-26 22:20 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2006-12-26 22:17 <DIR> d-------- C:\Documents and Settings\Assya\.housecall6.6 2006-12-26 21:24 184,450 --a------ C:\WINDOWS\system32\swintoed.exe 2006-12-26 21:15 <DIR> d-------- C:\Program Files\Mozilla Firefox 2006-12-26 21:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Mozilla 2006-12-26 20:12 184,445 --a------ C:\WINDOWS\system32\rwintoed.exe 2006-12-26 19:13 184,436 --a------ C:\WINDOWS\system32\mwintoed.exe 2006-12-26 16:38 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ultimate Cleaner 2006-12-26 16:37 <DIR> d-------- C:\Program Files\Ultimate Cleaner 2006-12-26 16:36 930 --a------ C:\WINDOWS\system32\winpfz32.sys 2006-12-26 16:36 184,409 --a------ C:\WINDOWS\system32\mwinkoed.exe 2006-12-26 16:35 8,464 --a------ C:\WINDOWS\system32\sporder.dll 2006-12-26 16:35 <DIR> d--hs---- C:\WINDOWS\QXNzeWE 2006-12-26 16:35 <DIR> d-------- C:\Program Files\Symantec Technical Support 2006-12-24 20:20 <DIR> d-------- C:\Program Files\FlashGet 2006-12-23 20:12 <DIR> d-------- C:\WINDOWS\Sun 2006-12-23 20:12 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Sun 2006-12-23 20:09 <DIR> d-------- C:\Program Files\Java 2006-12-23 20:05 <DIR> d-------- C:\Program Files\Common Files\Java 2006-12-17 14:14 <DIR> d--h----- C:\WINDOWS\PIF 2006-12-17 13:37 <DIR> d-------- C:\Program Files\RevConnect 2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\xing shared 2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\Real 2006-12-14 23:06 <DIR> d-------- C:\Program Files\Real 2006-12-14 23:06 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Real 2006-12-14 22:56 <DIR> d-------- C:\My Downloads 2006-12-11 12:21 <DIR> d-------- C:\Program Files\BatteryInfo 2006-12-11 11:09 <DIR> d-------- C:\Program Files\Lavalys 2006-12-10 17:03 <DIR> d-------- C:\Program Files\SPDemo 2006-12-09 14:43 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\uTorrent 2006-12-09 14:02 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2006-12-09 11:00 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 2006-12-09 10:22 <DIR> d-------- C:\Program Files\Lion Heart's Codec Pack 2006-12-08 19:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Help 2006-12-08 19:18 <DIR> d-------- C:\Program Files\CronosPlus 2006-12-08 17:37 <DIR> d-------- C:\Program Files\eMule 2006-12-08 15:29 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2006-12-08 15:29 <DIR> d-------- C:\Program Files\cladDVD 2006-12-08 15:28 <DIR> d-------- C:\Program Files\ImTOO 2006-12-08 15:03 34,308 --a------ C:\WINDOWS\system32\BASSMOD.dll 2006-12-08 15:03 <DIR> d-------- C:\Program Files\Babylon 2006-12-08 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Babylon 2006-12-08 15:02 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Babylon 2006-12-08 14:45 <DIR> d-------- C:\Downloads 2006-12-08 14:44 <DIR> d-------- C:\Program Files\BitComet 2006-12-08 12:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2006-12-08 12:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2006-12-08 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2006-12-08 10:48 <DIR> d-------- C:\WINDOWS\pss 2006-12-08 10:32 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-12-08 10:32 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2006-12-08 10:32 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2006-12-08 10:09 303,104 --a------ C:\WINDOWS\system32\rmparser.dll 2006-12-08 10:09 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll 2006-12-08 10:09 <DIR> d-------- C:\AVOneExport 2006-12-08 10:08 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2006-12-08 10:08 <DIR> d-------- C:\Program Files\Mpgdvd.com 2006-12-08 10:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2006-12-08 09:51 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2006-12-08 09:51 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Leadertech 2006-12-08 09:45 <DIR> d-------- C:\Program Files\Adobe 2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Adobe 2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2006-12-08 09:44 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2006-12-08 09:39 <DIR> d-------- C:\Program Files\Common Files\Adobe 2006-12-08 09:33 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Macromedia 2006-12-08 09:31 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS 2006-12-08 00:46 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2006-12-07 23:26 56 -r-hs---- C:\WINDOWS\system32\38F032101D.sys 2006-12-07 23:26 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2006-12-07 23:26 <DIR> d-------- C:\Program Files\DivX 2006-12-07 23:10 <DIR> d-------- C:\Program Files\XVid;-) 2006-12-07 23:10 <DIR> d-------- C:\Program Files\XviD 2006-12-07 22:59 <DIR> d-------- C:\Program Files\ICQLite 2006-12-07 22:59 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\ICQLite 2006-12-07 22:47 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ahead 2006-12-07 22:46 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2006-12-07 22:46 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2006-12-07 22:46 5,632 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2006-12-07 22:46 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2006-12-07 22:46 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2006-12-07 22:46 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2006-12-07 22:46 113,664 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys 2006-12-07 22:46 <DIR> d-------- C:\Program Files\Common Files\Ahead 2006-12-07 22:46 <DIR> d-------- C:\Program Files\Ahead 2006-12-07 22:41 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft.NET 2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2006-12-07 22:38 <DIR> d-------- C:\Program Files\Common Files\DESIGNER 2006-12-07 22:37 <DIR> d-------- C:\WINDOWS\SHELLNEW 2006-12-07 22:37 <DIR> d-------- C:\Program Files\Microsoft Office 2006-12-07 22:35 <DIR> dr-h----- C:\MSOCache 2006-12-07 21:21 <DIR> d-------- C:\Program Files\WinZip 2006-12-07 21:17 <DIR> d-------- C:\Program Files\Webteh 2006-12-07 20:34 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups 2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 6.02 2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 2006-12-07 20:31 <DIR> d-------- C:\Program Files\Microsoft IntelliType Pro 6.02 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth3.dll 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth2.dll 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdinpun.dll 2006-12-07 20:24 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdvntc.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdurdu.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth0.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintel.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintam.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinmar.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinkan.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinhin.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinguj.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdindev.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdheb.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdfa.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda3.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda1.dll 2006-12-07 20:24 5,632 --a------ C:\WINDOWS\system32\kbdusa.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdgeo.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarmw.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarme.dll 2006-12-07 20:24 185,344 --a------ C:\WINDOWS\system32\Thawbrkr.dll 2006-12-07 20:24 10,752 --a------ C:\WINDOWS\system32\c_iscii.dll 2006-12-07 20:12 18,200 --a------ C:\WINDOWS\system32\wups2.dll 2006-12-07 20:12 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2006-12-07 20:10 <DIR> d---s---- C:\Documents and Settings\Assya\UserData 2006-12-07 20:06 306,688 --a------ C:\WINDOWS\IsUninst.exe 2006-12-07 20:05 <DIR> d-------- C:\Program Files\Symantec 2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Symantec 2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2006-12-07 20:04 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2006-12-07 20:00 <DIR> d-------- C:\Program Files\WinRAR 2006-12-07 19:56 <DIR> d--hs---- C:\RECYCLER 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\SendTo 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Recent 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data\. 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Start Menu 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\My Documents 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Favorites 2006-12-07 19:45 <DIR> d--h----- C:\Program Files\Uninstall Information 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Templates 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\PrintHood 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\NetHood 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Local Settings 2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Cookies 2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Application Data\Microsoft 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Desktop 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Identities 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\.. 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\.. 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\. 2006-12-07 19:44 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\SoftwareDistribution 2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\Prefetch 2006-12-07 19:38 0 -rahs---- C:\MSDOS.SYS 2006-12-07 19:38 0 -rahs---- C:\IO.SYS 2006-12-07 19:38 0 --a------ C:\CONFIG.SYS 2006-12-07 19:38 0 --a------ C:\AUTOEXEC.BAT 2006-12-07 19:38 <DIR> d-------- C:\WINDOWS\system32\xircom 2006-12-07 19:38 <DIR> d-------- C:\Program Files\xerox 2006-12-07 19:38 <DIR> d-------- C:\Program Files\microsoft frontpage 2006-12-07 19:37 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2006-12-07 19:36 <DIR> dr------- C:\WINDOWS\Offline Web Pages 2006-12-07 19:36 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM 2006-12-07 19:36 <DIR> d--h----- C:\Program Files\WindowsUpdate 2006-12-07 19:36 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files 2006-12-07 19:35 64,512 --a------ C:\WINDOWS\system32\acctres.dll 2006-12-07 19:35 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2006-12-07 19:35 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2006-12-07 19:35 <DIR> d-------- C:\WINDOWS\system32\DirectX 2006-12-07 19:35 <DIR> d-------- C:\Program Files\Common Files\Services 2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\isign32.dll 2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\ils.dll 2006-12-07 19:34 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2006-12-07 19:34 73,728 --a------ C:\WINDOWS\system32\icwdial.dll 2006-12-07 19:34 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2006-12-07 19:34 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2006-12-07 19:34 69,632 --a------ C:\WINDOWS\system32\msconf.dll 2006-12-07 19:34 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-12-07 19:34 67,584 --a------ C:\WINDOWS\system32\srclient.dll 2006-12-07 19:34 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll 2006-12-07 19:34 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll 2006-12-07 19:34 48,128 --a------ C:\WINDOWS\system32\inetres.dll 2006-12-07 19:34 465,176 --a------ C:\WINDOWS\system32\wuapi.dll 2006-12-07 19:34 45,568 --a------ C:\WINDOWS\system32\safrslv.dll 2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll 2006-12-07 19:34 41,240 --a------ C:\WINDOWS\system32\wups.dll 2006-12-07 19:34 382,464 --a------ C:\WINDOWS\system32\qmgr.dll 2006-12-07 19:34 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll 2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2006-12-07 19:34 29,696 --a------ C:\WINDOWS\system32\safrdm.dll 2006-12-07 19:34 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2006-12-07 19:34 274,944 --a------ C:\WINDOWS\system32\mstask.dll 2006-12-07 19:34 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll 2006-12-07 19:34 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll 2006-12-07 19:34 239,104 --a------ C:\WINDOWS\system32\srrstr.dll 2006-12-07 19:34 23,040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-12-07 19:34 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll 2006-12-07 19:34 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll 2006-12-07 19:34 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2006-12-07 19:34 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2006-12-07 19:34 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe 2006-12-07 19:34 170,496 --a------ C:\WINDOWS\system32\srsvc.dll 2006-12-07 19:34 16,896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-12-07 19:34 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2006-12-07 19:34 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-12-07 19:34 127,256 --a------ C:\WINDOWS\system32\wucltui.dll 2006-12-07 19:34 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe 2006-12-07 19:34 12,288 --a------ C:\WINDOWS\system32\mstinit.exe 2006-12-07 19:34 105,984 --a------ C:\WINDOWS\system32\msoert2.dll 2006-12-07 19:34 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll 2006-12-07 19:34 <DIR> d---s---- C:\WINDOWS\Tasks 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Restore 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Macromed 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\srchasst 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Outlook Express 2006-12-07 19:34 <DIR> d-------- C:\Program Files\NetMeeting 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Movie Maker 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Internet Explorer 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\System 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\MSSoap 2006-12-07 19:33 <DIR> d-------- C:\WINDOWS\Registration 2006-12-07 19:33 <DIR> d-------- C:\Program Files\ComPlus Applications 2006-12-07 19:32 97,792 --a------ C:\WINDOWS\system32\comrepl.dll 2006-12-07 19:32 9,728 --a------ C:\WINDOWS\system32\reset.exe 2006-12-07 19:32 80,384 --a------ C:\WINDOWS\system32\charmap.exe 2006-12-07 19:32 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2006-12-07 19:32 605,696 --a------ C:\WINDOWS\system32\getuname.dll 2006-12-07 19:32 56,832 --a------ C:\WINDOWS\system32\sol.exe 2006-12-07 19:32 55,296 --a------ C:\WINDOWS\system32\freecell.exe 2006-12-07 19:32 54,272 --a------ C:\WINDOWS\system32\stclient.dll 2006-12-07 19:32 5,632 --a------ C:\WINDOWS\system32\write.exe 2006-12-07 19:32 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2006-12-07 19:32 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2006-12-07 19:32 35,328 --a------ C:\WINDOWS\system32\winchat.exe 2006-12-07 19:32 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll 2006-12-07 19:32 33,792 --a------ C:\WINDOWS\system32\regini.exe 2006-12-07 19:32 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2006-12-07 19:32 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2006-12-07 19:32 227,840 --a------ C:\WINDOWS\system32\avtapi.dll 2006-12-07 19:32 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe 2006-12-07 19:32 20,992 --a------ C:\WINDOWS\system32\msg.exe 2006-12-07 19:32 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2006-12-07 19:32 183,808 --a------ C:\WINDOWS\system32\accwiz.exe 2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe 2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe 2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe 2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2006-12-07 19:32 15,360 --a------ C:\WINDOWS\system32\logoff.exe 2006-12-07 19:32 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tscon.exe 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\shadow.exe 2006-12-07 19:32 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe 2006-12-07 19:32 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe 2006-12-07 19:32 126,976 --a------ C:\WINDOWS\system32\mshearts.exe 2006-12-07 19:32 123,392 --a------ C:\WINDOWS\system32\mplay32.exe 2006-12-07 19:32 119,808 --a------ C:\WINDOWS\system32\winmine.exe 2006-12-07 19:32 114,688 --a------ C:\WINDOWS\system32\calc.exe 2006-12-07 19:32 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Windows Media Player 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Online Services 2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN Gaming Zone 2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Messenger 2006-12-07 19:31 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll 2006-12-07 19:31 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2006-12-07 19:31 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll 2006-12-07 19:31 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2006-12-07 19:31 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2006-12-07 19:31 67,072 --a------ C:\WINDOWS\system32\rdshost.exe 2006-12-07 19:31 655,360 --a------ C:\WINDOWS\system32\mstscax.dll 2006-12-07 19:31 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll 2006-12-07 19:31 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe 2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\remotepg.dll 2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\colbact.dll 2006-12-07 19:31 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll 2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\licwmi.dll 2006-12-07 19:31 56,320 --a------ C:\WINDOWS\system32\servdeps.dll 2006-12-07 19:31 540,160 --a------ C:\WINDOWS\system32\comuid.dll 2006-12-07 19:31 538,624 --a------ C:\WINDOWS\system32\spider.exe 2006-12-07 19:31 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll 2006-12-07 19:31 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2006-12-07 19:31 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll 2006-12-07 19:31 407,552 --a------ C:\WINDOWS\system32\mstsc.exe 2006-12-07 19:31 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2006-12-07 19:31 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll 2006-12-07 19:31 343,040 --a------ C:\WINDOWS\system32\mspaint.exe 2006-12-07 19:31 295,424 --a------ C:\WINDOWS\system32\termsrv.dll 2006-12-07 19:31 225,792 --a------ C:\WINDOWS\system32\catsrv.dll 2006-12-07 19:31 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2006-12-07 19:31 20,480 --a------ C:\WINDOWS\system32\qprocess.exe 2006-12-07 19:31 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2006-12-07 19:31 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2006-12-07 19:31 185,344 --a------ C:\WINDOWS\system32\cmprops.dll 2006-12-07 19:31 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll 2006-12-07 19:31 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2006-12-07 19:31 147,968 --a------ C:\WINDOWS\system32\rdchost.dll 2006-12-07 19:31 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe 2006-12-07 19:31 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2006-12-07 19:31 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2006-12-07 19:31 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2006-12-07 19:31 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2006-12-07 19:31 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll 2006-12-07 19:31 11,264 --a------ C:\WINDOWS\system32\icaapi.dll 2006-12-07 19:31 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe 2006-12-07 19:31 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll 2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\MsDtc 2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\Com 2006-12-07 19:31 <DIR> d-------- C:\Program Files\Windows NT (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-28 14:16 -------- d-------- C:\Program Files\Common Files 2006-12-27 15:22 2560 --a------ C:\WINDOWS\_MSRSTRT.exe 2006-12-09 11:04 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-12-08 14:45 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2006-12-07 17:02 2174976 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-11-15 15:44 18273 --a------ C:\WINDOWS\system32\drivers\klop.sys 2006-11-01 17:42 94314 --a------ C:\WINDOWS\system32\klogon.dll 2006-10-19 15:56 713216 --a------ C:\WINDOWS\system32\sxs.dll 2006-10-13 14:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 14:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 14:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\Ultimate Defender.install] @="\"C:\\Documents and Settings\\Assya\\Local Settings\\Temporary Internet Files\\Content.IE5\\12F12OG8\\udefender_eE28o2QRe8[1].exe\" continue" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "Babylon Client"="C:\\Program Files\\Babylon\\Babylon-Pro\\Babylon.exe -AutoStart" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\"" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000004 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoClose"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-12-28 18:19:08.12 C:\ComboFix.txt ... 06-12-28 18:19 C:\ComboFix2.txt ... 06-12-27 17:50

0

Ok, that killed the rootkit. Something is preventing the deletion of the files we tried to delete earier. You have installed Kaspersky and XoftSpy since the last scan, if it is not a nessesity do not install any new programs please. If you have not uninstalled McAfee go to add/remove programs and uninstall Kaspersky(only need one antivirus program) and XoftSpy (another rogue program although they claim they have cleaned up their act) and while you are in there uninstall these if found: adwarespy Ultimate Cleaner Zeno Zeno Search Next, set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Reboot into safe mode.Run hijack This from safe mode and remove these items: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe O4 - HKLM\..\Run: [czpeexk.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll",rzqlgze O4 - HKLM\..\Run: [{52-27-7D-D9-ZN}] c:\windows\system32\dwdsregt.exe OLI001 O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\Assya\LOCALS~1\Temp\svchost.exe O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\nsdsregm.exe O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwintoeb.exe Exit Hijack This but remain in safe mode. We are going to delete some files and folders manually. You must be able to view hidden files so make sure you set that up as requested above. To delete them just right click on the file or folder the click delete. They will be place in the recycle bin. Navigate to and delete the following files if found: c:\secure32.html C:\WINDOWS\system32\zgCrypt.dll C:\WINDOWS\system32\autosys.exe C:\Documents and Settings\Assya\Local Settings\Application Data\czpeexk.dll c:\windows\system32\dwdsregt.exe C:\Documents and Settings\Assya\Local Settings\Temp\svchost.exe C:\WINDOWS\system32\nsdsregm.exe C:\WINDOWS\system32\pwintoeb.exe C:\WINDOWS\system32\lwintoed.exe C:\WINDOWS\system32\swintoed.exe C:\WINDOWS\system32\rwintoed.exe C:\WINDOWS\system32\mwintoed.exe C:\WINDOWS\system32\winpfz32.sys C:\WINDOWS\system32\mwinkoed.exe Navigate to and delete these folders if found: C:\Program Files\XoftSpy C:\WINDOWS\_MSRSTRT.exe C:\Program Files\adwarespy C:\Documents and Settings\Assya\Application Data\Ultimate Cleaner C:\Program Files\Ultimate Cleaner C:\WINDOWS\QXNzeWE Empty the recycle bin Post a new Hijack this log and a new Combofix log. Have to leave for about 3 hrs. to make a house call.

0

Hope to catch you before you leave. Uninstalled Macfee Anti Virus and Xsoft. Left Kaspersky anti virus. Before I began all the scans you suggestes wanted you to see the last hijackthis log I ran from normal mode. Do I still need to do all the scans you asked? Thank you

0

Logfile of HijackThis v1.99.1 Scan saved at 19:28:51, on 28/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.il/ O2 - BHO: C:\WINDOWS\system32\zgCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zgCrypt.dll (file missing) O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwintoeb.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O17 - HKLM\System\CCS\Services\Tcpip\..\{C43E3DCD-0DDC-4E14-B460-D82FDA36C464}: NameServer = 212.117.129.5 212.116.161.38 O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)

0

Ok, decided not to wait and do what you wrote. I didn't find these programs (adwarespy, Ultimate Cleaner, Zeno, Zeno Search) to remove from Add/Remove programs. Set the computer to see hidden files and their extensions and rebooted to Safe Mode. There ran hijackthis and fixed what I found: O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwintoeb.exe Then deleted manually what I could find: C:\WINDOWS\system32\pwintoeb.exe-deleted C:\WINDOWS\system32\lwintoed.exe-deleted C:\WINDOWS\system32\swintoed.exe-deleted C:\WINDOWS\system32\rwintoed.exe-deleted C:\WINDOWS\system32\mwintoed.exe-deleted C:\WINDOWS\system32\winpfz32.sys-deleted C:\WINDOWS\system32\mwinkoed.exe-deleted And these folders: C:\WINDOWS\_MSRSTRT.EXE-deleted C:\Program Files\adwarespy-deleted, there was a dll file in there C:\Documents and Settings\Assya\Application Data\Ultimate Cleaner-deleted C:\Program Files\Ultimate Cleaner-deleted, was empty C:\WINDOWS\QXNzeWE-deleted, was empty Finally emptied the recycle bin. Then rebooted to normal mode and ran the scans. Log files next.

0

Logfile of HijackThis v1.99.1 Scan saved at 20:16:41, on 28/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.il/ O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) Assya - 06-12-28 20:17:55.68 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Assya\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-11-28 to 2006-12-28 )))))))))))))))))))))))))))))))))) 2006-12-28 15:01 61,584 --a------ C:\WINDOWS\system32\drivers\klick.sys 2006-12-28 15:01 59,536 --a------ C:\WINDOWS\system32\drivers\klin.sys 2006-12-28 15:01 <DIR> d-------- C:\Program Files\Kaspersky Lab 2006-12-28 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2006-12-28 14:51 <DIR> d-------- C:\kav 2006-12-28 14:16 <DIR> d--hs---- C:\Config.Msi 2006-12-28 00:48 <DIR> d-------- C:\Documents and Settings\Assya\DoctorWeb 2006-12-27 23:16 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-27 23:15 <DIR> d-------- C:\Program Files\Grisoft 2006-12-27 17:22 2,900 --a------ C:\WINDOWS\system32\tmp.reg 2006-12-27 16:38 <DIR> d-------- C:\Program Files\Network Associates 2006-12-27 14:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Lavasoft 2006-12-27 13:20 <DIR> d-------- C:\!KillBox 2006-12-27 12:10 <DIR> d-------- C:\Program Files\CleanUp! 2006-12-26 23:55 <DIR> d-------- C:\hijackthis 2006-12-26 23:41 73,728 --a------ C:\WINDOWS\system32\out.dll 2006-12-26 23:41 <DIR> d-------- C:\Program Files\micore 2006-12-26 23:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\al 2006-12-26 22:20 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2006-12-26 22:17 <DIR> d-------- C:\Documents and Settings\Assya\.housecall6.6 2006-12-26 21:15 <DIR> d-------- C:\Program Files\Mozilla Firefox 2006-12-26 21:15 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Mozilla 2006-12-26 16:35 8,464 --a------ C:\WINDOWS\system32\sporder.dll 2006-12-26 16:35 <DIR> d-------- C:\Program Files\Symantec Technical Support 2006-12-24 20:20 <DIR> d-------- C:\Program Files\FlashGet 2006-12-23 20:12 <DIR> d-------- C:\WINDOWS\Sun 2006-12-23 20:12 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Sun 2006-12-23 20:09 <DIR> d-------- C:\Program Files\Java 2006-12-23 20:05 <DIR> d-------- C:\Program Files\Common Files\Java 2006-12-17 14:14 <DIR> d--h----- C:\WINDOWS\PIF 2006-12-17 13:37 <DIR> d-------- C:\Program Files\RevConnect 2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\xing shared 2006-12-14 23:07 <DIR> d-------- C:\Program Files\Common Files\Real 2006-12-14 23:06 <DIR> d-------- C:\Program Files\Real 2006-12-14 23:06 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Real 2006-12-14 22:56 <DIR> d-------- C:\My Downloads 2006-12-11 12:21 <DIR> d-------- C:\Program Files\BatteryInfo 2006-12-11 11:09 <DIR> d-------- C:\Program Files\Lavalys 2006-12-10 17:03 <DIR> d-------- C:\Program Files\SPDemo 2006-12-09 14:43 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\uTorrent 2006-12-09 14:02 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2006-12-09 11:00 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 2006-12-09 10:22 <DIR> d-------- C:\Program Files\Lion Heart's Codec Pack 2006-12-08 19:41 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Help 2006-12-08 19:18 <DIR> d-------- C:\Program Files\CronosPlus 2006-12-08 17:37 <DIR> d-------- C:\Program Files\eMule 2006-12-08 15:29 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2006-12-08 15:29 <DIR> d-------- C:\Program Files\cladDVD 2006-12-08 15:28 <DIR> d-------- C:\Program Files\ImTOO 2006-12-08 15:03 34,308 --a------ C:\WINDOWS\system32\BASSMOD.dll 2006-12-08 15:03 <DIR> d-------- C:\Program Files\Babylon 2006-12-08 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Babylon 2006-12-08 15:02 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Babylon 2006-12-08 14:45 <DIR> d-------- C:\Downloads 2006-12-08 14:44 <DIR> d-------- C:\Program Files\BitComet 2006-12-08 12:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2006-12-08 12:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2006-12-08 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2006-12-08 10:48 <DIR> d-------- C:\WINDOWS\pss 2006-12-08 10:32 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-12-08 10:32 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2006-12-08 10:32 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2006-12-08 10:09 303,104 --a------ C:\WINDOWS\system32\rmparser.dll 2006-12-08 10:09 1,003,520 --a------ C:\WINDOWS\system32\ltmm_n.dll 2006-12-08 10:09 <DIR> d-------- C:\AVOneExport 2006-12-08 10:08 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2006-12-08 10:08 <DIR> d-------- C:\Program Files\Mpgdvd.com 2006-12-08 10:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2006-12-08 09:51 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2006-12-08 09:51 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Leadertech 2006-12-08 09:45 <DIR> d-------- C:\Program Files\Adobe 2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Adobe 2006-12-08 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2006-12-08 09:44 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2006-12-08 09:39 <DIR> d-------- C:\Program Files\Common Files\Adobe 2006-12-08 09:33 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Macromedia 2006-12-08 09:31 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS 2006-12-08 00:46 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2006-12-07 23:26 56 -r-hs---- C:\WINDOWS\system32\38F032101D.sys 2006-12-07 23:26 1,682 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2006-12-07 23:26 <DIR> d-------- C:\Program Files\DivX 2006-12-07 23:10 <DIR> d-------- C:\Program Files\XVid;-) 2006-12-07 23:10 <DIR> d-------- C:\Program Files\XviD 2006-12-07 22:59 <DIR> d-------- C:\Program Files\ICQLite 2006-12-07 22:59 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\ICQLite 2006-12-07 22:47 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Ahead 2006-12-07 22:46 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2006-12-07 22:46 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2006-12-07 22:46 5,632 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2006-12-07 22:46 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2006-12-07 22:46 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2006-12-07 22:46 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2006-12-07 22:46 113,664 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys 2006-12-07 22:46 <DIR> d-------- C:\Program Files\Common Files\Ahead 2006-12-07 22:46 <DIR> d-------- C:\Program Files\Ahead 2006-12-07 22:41 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft.NET 2006-12-07 22:39 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2006-12-07 22:38 <DIR> d-------- C:\Program Files\Common Files\DESIGNER 2006-12-07 22:37 <DIR> d-------- C:\WINDOWS\SHELLNEW 2006-12-07 22:37 <DIR> d-------- C:\Program Files\Microsoft Office 2006-12-07 22:35 <DIR> dr-h----- C:\MSOCache 2006-12-07 21:21 <DIR> d-------- C:\Program Files\WinZip 2006-12-07 21:17 <DIR> d-------- C:\Program Files\Webteh 2006-12-07 20:34 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups 2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 6.02 2006-12-07 20:34 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 2006-12-07 20:31 <DIR> d-------- C:\Program Files\Microsoft IntelliType Pro 6.02 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth3.dll 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdth2.dll 2006-12-07 20:24 6,144 -ra------ C:\WINDOWS\system32\kbdinpun.dll 2006-12-07 20:24 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdvntc.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdurdu.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdth0.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdsyr1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintel.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdintam.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinmar.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinkan.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinhin.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdinguj.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdindev.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdheb.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbdfa.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbddiv1.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda3.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda2.dll 2006-12-07 20:24 5,632 -ra------ C:\WINDOWS\system32\kbda1.dll 2006-12-07 20:24 5,632 --a------ C:\WINDOWS\system32\kbdusa.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdgeo.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarmw.dll 2006-12-07 20:24 5,120 -ra------ C:\WINDOWS\system32\kbdarme.dll 2006-12-07 20:24 185,344 --a------ C:\WINDOWS\system32\Thawbrkr.dll 2006-12-07 20:24 10,752 --a------ C:\WINDOWS\system32\c_iscii.dll 2006-12-07 20:12 18,200 --a------ C:\WINDOWS\system32\wups2.dll 2006-12-07 20:12 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2006-12-07 20:10 <DIR> d---s---- C:\Documents and Settings\Assya\UserData 2006-12-07 20:06 306,688 --a------ C:\WINDOWS\IsUninst.exe 2006-12-07 20:05 <DIR> d-------- C:\Program Files\Symantec 2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Symantec 2006-12-07 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2006-12-07 20:04 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2006-12-07 20:00 <DIR> d-------- C:\Program Files\WinRAR 2006-12-07 19:56 <DIR> d--hs---- C:\RECYCLER 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\SendTo 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Recent 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data\. 2006-12-07 19:45 <DIR> dr-h----- C:\Documents and Settings\Assya\Application Data 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Start Menu 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\My Documents 2006-12-07 19:45 <DIR> dr------- C:\Documents and Settings\Assya\Favorites 2006-12-07 19:45 <DIR> d--h----- C:\Program Files\Uninstall Information 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Templates 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\PrintHood 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\NetHood 2006-12-07 19:45 <DIR> d--h----- C:\Documents and Settings\Assya\Local Settings 2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Cookies 2006-12-07 19:45 <DIR> d---s---- C:\Documents and Settings\Assya\Application Data\Microsoft 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Desktop 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\Identities 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\Application Data\.. 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\.. 2006-12-07 19:45 <DIR> d-------- C:\Documents and Settings\Assya\. 2006-12-07 19:44 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\SoftwareDistribution 2006-12-07 19:44 <DIR> d-------- C:\WINDOWS\Prefetch 2006-12-07 19:38 0 -rahs---- C:\MSDOS.SYS 2006-12-07 19:38 0 -rahs---- C:\IO.SYS 2006-12-07 19:38 0 --a------ C:\CONFIG.SYS 2006-12-07 19:38 0 --a------ C:\AUTOEXEC.BAT 2006-12-07 19:38 <DIR> d-------- C:\WINDOWS\system32\xircom 2006-12-07 19:38 <DIR> d-------- C:\Program Files\xerox 2006-12-07 19:38 <DIR> d-------- C:\Program Files\microsoft frontpage 2006-12-07 19:37 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2006-12-07 19:36 <DIR> dr------- C:\WINDOWS\Offline Web Pages 2006-12-07 19:36 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM 2006-12-07 19:36 <DIR> d--h----- C:\Program Files\WindowsUpdate 2006-12-07 19:36 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files 2006-12-07 19:35 64,512 --a------ C:\WINDOWS\system32\acctres.dll 2006-12-07 19:35 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2006-12-07 19:35 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2006-12-07 19:35 <DIR> d-------- C:\WINDOWS\system32\DirectX 2006-12-07 19:35 <DIR> d-------- C:\Program Files\Common Files\Services 2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\isign32.dll 2006-12-07 19:34 81,920 --a------ C:\WINDOWS\system32\ils.dll 2006-12-07 19:34 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2006-12-07 19:34 73,728 --a------ C:\WINDOWS\system32\icwdial.dll 2006-12-07 19:34 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2006-12-07 19:34 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2006-12-07 19:34 69,632 --a------ C:\WINDOWS\system32\msconf.dll 2006-12-07 19:34 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-12-07 19:34 67,584 --a------ C:\WINDOWS\system32\srclient.dll 2006-12-07 19:34 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll 2006-12-07 19:34 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll 2006-12-07 19:34 48,128 --a------ C:\WINDOWS\system32\inetres.dll 2006-12-07 19:34 465,176 --a------ C:\WINDOWS\system32\wuapi.dll 2006-12-07 19:34 45,568 --a------ C:\WINDOWS\system32\safrslv.dll 2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2006-12-07 19:34 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll 2006-12-07 19:34 41,240 --a------ C:\WINDOWS\system32\wups.dll 2006-12-07 19:34 382,464 --a------ C:\WINDOWS\system32\qmgr.dll 2006-12-07 19:34 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll 2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2006-12-07 19:34 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2006-12-07 19:34 29,696 --a------ C:\WINDOWS\system32\safrdm.dll 2006-12-07 19:34 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2006-12-07 19:34 274,944 --a------ C:\WINDOWS\system32\mstask.dll 2006-12-07 19:34 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll 2006-12-07 19:34 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll 2006-12-07 19:34 239,104 --a------ C:\WINDOWS\system32\srrstr.dll 2006-12-07 19:34 23,040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-12-07 19:34 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll 2006-12-07 19:34 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll 2006-12-07 19:34 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2006-12-07 19:34 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2006-12-07 19:34 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe 2006-12-07 19:34 170,496 --a------ C:\WINDOWS\system32\srsvc.dll 2006-12-07 19:34 16,896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-12-07 19:34 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2006-12-07 19:34 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-12-07 19:34 127,256 --a------ C:\WINDOWS\system32\wucltui.dll 2006-12-07 19:34 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe 2006-12-07 19:34 12,288 --a------ C:\WINDOWS\system32\mstinit.exe 2006-12-07 19:34 105,984 --a------ C:\WINDOWS\system32\msoert2.dll 2006-12-07 19:34 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll 2006-12-07 19:34 <DIR> d---s---- C:\WINDOWS\Tasks 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Restore 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\system32\Macromed 2006-12-07 19:34 <DIR> d-------- C:\WINDOWS\srchasst 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Outlook Express 2006-12-07 19:34 <DIR> d-------- C:\Program Files\NetMeeting 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Movie Maker 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Internet Explorer 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\System 2006-12-07 19:34 <DIR> d-------- C:\Program Files\Common Files\MSSoap 2006-12-07 19:33 <DIR> d-------- C:\WINDOWS\Registration 2006-12-07 19:33 <DIR> d-------- C:\Program Files\ComPlus Applications 2006-12-07 19:32 97,792 --a------ C:\WINDOWS\system32\comrepl.dll 2006-12-07 19:32 9,728 --a------ C:\WINDOWS\system32\reset.exe 2006-12-07 19:32 80,384 --a------ C:\WINDOWS\system32\charmap.exe 2006-12-07 19:32 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2006-12-07 19:32 605,696 --a------ C:\WINDOWS\system32\getuname.dll 2006-12-07 19:32 56,832 --a------ C:\WINDOWS\system32\sol.exe 2006-12-07 19:32 55,296 --a------ C:\WINDOWS\system32\freecell.exe 2006-12-07 19:32 54,272 --a------ C:\WINDOWS\system32\stclient.dll 2006-12-07 19:32 5,632 --a------ C:\WINDOWS\system32\write.exe 2006-12-07 19:32 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2006-12-07 19:32 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2006-12-07 19:32 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2006-12-07 19:32 35,328 --a------ C:\WINDOWS\system32\winchat.exe 2006-12-07 19:32 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll 2006-12-07 19:32 33,792 --a------ C:\WINDOWS\system32\regini.exe 2006-12-07 19:32 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2006-12-07 19:32 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2006-12-07 19:32 227,840 --a------ C:\WINDOWS\system32\avtapi.dll 2006-12-07 19:32 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe 2006-12-07 19:32 20,992 --a------ C:\WINDOWS\system32\msg.exe 2006-12-07 19:32 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2006-12-07 19:32 183,808 --a------ C:\WINDOWS\system32\accwiz.exe 2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe 2006-12-07 19:32 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe 2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2006-12-07 19:32 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe 2006-12-07 19:32 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2006-12-07 19:32 15,360 --a------ C:\WINDOWS\system32\logoff.exe 2006-12-07 19:32 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\tscon.exe 2006-12-07 19:32 14,848 --a------ C:\WINDOWS\system32\shadow.exe 2006-12-07 19:32 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe 2006-12-07 19:32 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe 2006-12-07 19:32 126,976 --a------ C:\WINDOWS\system32\mshearts.exe 2006-12-07 19:32 123,392 --a------ C:\WINDOWS\system32\mplay32.exe 2006-12-07 19:32 119,808 --a------ C:\WINDOWS\system32\winmine.exe 2006-12-07 19:32 114,688 --a------ C:\WINDOWS\system32\calc.exe 2006-12-07 19:32 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Windows Media Player 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Online Services 2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN Gaming Zone 2006-12-07 19:32 <DIR> d-------- C:\Program Files\MSN 2006-12-07 19:32 <DIR> d-------- C:\Program Files\Messenger 2006-12-07 19:31 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll 2006-12-07 19:31 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2006-12-07 19:31 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll 2006-12-07 19:31 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2006-12-07 19:31 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2006-12-07 19:31 67,072 --a------ C:\WINDOWS\system32\rdshost.exe 2006-12-07 19:31 655,360 --a------ C:\WINDOWS\system32\mstscax.dll 2006-12-07 19:31 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll 2006-12-07 19:31 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe 2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\remotepg.dll 2006-12-07 19:31 60,416 --a------ C:\WINDOWS\system32\colbact.dll 2006-12-07 19:31 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll 2006-12-07 19:31 58,880 --a------ C:\WINDOWS\system32\licwmi.dll 2006-12-07 19:31 56,320 --a------ C:\WINDOWS\system32\servdeps.dll 2006-12-07 19:31 540,160 --a------ C:\WINDOWS\system32\comuid.dll 2006-12-07 19:31 538,624 --a------ C:\WINDOWS\system32\spider.exe 2006-12-07 19:31 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll 2006-12-07 19:31 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2006-12-07 19:31 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll 2006-12-07 19:31 407,552 --a------ C:\WINDOWS\system32\mstsc.exe 2006-12-07 19:31 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2006-12-07 19:31 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll 2006-12-07 19:31 343,040 --a------ C:\WINDOWS\system32\mspaint.exe 2006-12-07 19:31 295,424 --a------ C:\WINDOWS\system32\termsrv.dll 2006-12-07 19:31 225,792 --a------ C:\WINDOWS\system32\catsrv.dll 2006-12-07 19:31 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2006-12-07 19:31 20,480 --a------ C:\WINDOWS\system32\qprocess.exe 2006-12-07 19:31 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2006-12-07 19:31 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2006-12-07 19:31 185,344 --a------ C:\WINDOWS\system32\cmprops.dll 2006-12-07 19:31 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll 2006-12-07 19:31 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2006-12-07 19:31 147,968 --a------ C:\WINDOWS\system32\rdchost.dll 2006-12-07 19:31 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe 2006-12-07 19:31 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2006-12-07 19:31 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2006-12-07 19:31 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2006-12-07 19:31 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2006-12-07 19:31 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll 2006-12-07 19:31 11,264 --a------ C:\WINDOWS\system32\icaapi.dll 2006-12-07 19:31 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe 2006-12-07 19:31 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll 2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\MsDtc 2006-12-07 19:31 <DIR> d-------- C:\WINDOWS\system32\Com 2006-12-07 19:31 <DIR> d-------- C:\Program Files\Windows NT (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-28 14:16 -------- d-------- C:\Program Files\Common Files 2006-12-09 11:04 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-12-08 14:45 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2006-12-07 17:02 2174976 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-11-15 15:44 18273 --a------ C:\WINDOWS\system32\drivers\klop.sys 2006-11-01 17:42 94314 --a------ C:\WINDOWS\system32\klogon.dll 2006-10-19 15:56 713216 --a------ C:\WINDOWS\system32\sxs.dll 2006-10-13 14:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 14:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 14:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\Ultimate Defender.install] @="\"C:\\Documents and Settings\\Assya\\Local Settings\\Temporary Internet Files\\Content.IE5\\12F12OG8\\udefender_eE28o2QRe8[1].exe\" continue" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "Babylon Client"="C:\\Program Files\\Babylon\\Babylon-Pro\\Babylon.exe -AutoStart" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\"" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000004 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "NoClose"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-12-28 20:19:52.72 C:\ComboFix.txt ... 06-12-28 20:19 C:\ComboFix2.txt ... 06-12-28 18:19 C:\ComboFix3.txt ... 06-12-27 17:50

0

Much better, very good job. Navigate to and delete this file from normal mode: C:\Documents and Settings\Assya\Local Settings\Temporary Internet Files\Content.IE5\12F12OG8\udefender_eE28o2QRe8[1].exe Go to this link, http://virusscan.jotti.org/ copy the following file into the "upload and scan box", click submit then post the results: C:\WINDOWS\system32\38F032101D.sys Purge the restore folder again and run AFT-Cleaner from normal mode. Go to the following Panda link and run there free scan as a double check. Panda Free online Scan Just follow the directions and save the log when the scan is complete. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

I don't find C:\Documents and Settings\Assya\Local Settings\Temporary Internet Files\Content.IE5\12F12OG8\udefender_eE28o2QRe8[1].exe Also, I still can't enable my Windows firewall.

0

And I didn't find C:\WINDOWS\system32\38F032101D.sys

0

Scanned with Panda after purged the restore folder and ran AFT-Cleaner from normal mode. It found spywares, rootkits and 1 suspected file. Here is the report i saved from the scan: Adware:adware/surfaccuracy - Not disinfected - Windows Registry Adware:adware/ist.yoursitebar - Not disinfected - Windows Registry Spyware:Cookie/Yadro - Not disinfected - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP6\PdmHist\5d4.42D0317001C72AC4.history\0000000a.bak Spyware:Cookie/Adrevolver- Not disinfected - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP6\PdmHist\5d4.42D0317001C72AC4.history\00000011.bak Spyware:Cookie/Toplist - Not disinfected - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP6\PdmHist\5d4.42D0317001C72AC4.history\00000013.bak Spyware:Cookie/Doubleclick - Not disinfected - C:\Documents and Settings\Assya\Cookies\assya@doubleclick[1].txt Spyware:Cookie/Tribalfusion - Not disinfected - C:\Documents and Settings\Assya\Cookies\assya@tribalfusion[2].txt Potentially unwanted tool:Application/Processor - Not disinfected - C:\Documents and Settings\Assya\Desktop\SDFix.exe[SDFix\apps\Process.exe] Potentially unwanted tool:Application/Processor - Not disinfected - C:\Documents and Settings\Assya\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe] Potentially unwanted tool:Application/Processor - Not disinfected - C:\Documents and Settings\Assya\DoctorWeb\Quarantine\Process.exe Potentially unwanted tool:Application/ProcessorProcessor - Not disinfected - C:\Documents and Settings\Assya\DoctorWeb\Quarantine\Process0.exe Possible Virus. - Not disinfected - C:\RECYCLER\NPROTECT\00043783.exe Also, still CAN'T ENABLE my MICROSOFT FIREWALL, what else can i do? Thank you very much for the help.

0

I don't see any problems in the Panda scan. You should look in the old Norton C:\RECYCLER\NPROTECT folder and if nothing is in there that you need , delete it. To delete go to start> run> type rmdir /s \\?\C:\RECYCLER\NPROTECT (note: there is a space after rmdir, and after /s) then press enter. For the firewall try "solution for case 1 at this link http://windowsxp.mvps.org/sharedaccess.htm

0

First, you're great! Thank you so much for your help. I feel much more secure now. Some last questions: I deleted that file C:\RECYCLER\NPROTECT\00043783.exe - should i delete the NPROTECT directory? I don't know for what reason I can need it. I've installed the free Comodo firewall, without solving the problem with Microsoft firewall, or uninstalling Microsoft firewall. Is it ok? Am I protected? I've installed java, as you've sugested and the SpywareBlaster. And I plan to keep AVG Anti spyware, which I've installed earlier, hope it won't expire after some time. My only worry is Antivirus. I've installed the trial version for Kaspervsky, but it will end after 30 month. May I use a free anti-virus instead? Any suggestions which one? All the applications I've installed for solving my problem (SDFix, SmitFraudFix, drweb cureit, combofix, KillBox, gmer, ATF-Cleaner, hijackthis) - what should i do with them? Uninstall and delete them? Is there quarantined files in there I can free by mistake, that can damage my computer again? And the last one. What applications you recomend to have for security in the future. I still don't understand what virus I had and how I got it. :-) Thank you and Merry Christmas!!!

0

You can delete the nprotect folder . I use zonealarm (free) firewall, my windows firewall is turned off there is no uninstalling it. I use AVG 7.5 free antivirus and spywareblaster as an antispyware, should you change av's be sure to download the one you want, go offline, uninstall the one you want to get rid of, install the new one and update it immediately. You can uninstall/delete all the tools the files quarantined will delete with them. I keep AFT-Cleaner because it is so quick and easy to use. I believe you have all the tools you need. Just stay away from shady sites and keep the tools you have updated at least weekly.

0

Logfile of HijackThis v1.99.1 Scan saved at 19:08:33, on 4/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\IVT BlueSoleil\BTNtService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\msasvc.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\oodag.exe C:\Program Files\Trend Micro\PC-cillin 2004\Tmntsrv.exe C:\Program Files\Trend Micro\PC-cillin 2004\tmproxy.exe C:\Program Files\Trend Micro\PC-cillin 2004\PccPfw.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\QTRAYIME.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iTunes\iTunes.exe C:\WINDOWS\system32\ntvdm.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\msrr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Ackei\My Documents\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Arovax AntiSpyware] C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe /s O4 - HKLM\..\Run: [CameraFixer] ; C:\WINDOWS\CameraFixer.exe O4 - HKLM\..\Run: [snpstd3] ; C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] ; C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe O4 - HKLM\..\Run: [{382CDD2E-05D8-3076-0606-050913200354}] ; "C:\Program Files\Common Files\{382CDD2E-05D8-3076-0606-050913200354}\Update.exe" mc-110-12-0001411 O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe O4 - HKCU\..\Run: [ctfmon.exe] ; C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [foxy] ; "C:\Program Files\Foxy\Foxy.exe" -tray O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/no... O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: MsgPlusLoader.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\IVT BlueSoleil\BTNtService.exe O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001411 (file missing) O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Trend Micro Personal Firewall (PccPfw) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\PC-cillin 2004\PccPfw.exe O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\PC-cillin 2004\Tmntsrv.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\PC-cillin 2004\tmproxy.exe

0