Virus Attack

Custom / CUSTOM
May 8, 2009 at 15:34:22
Specs: Microsoft Windows XP Home Edition, 2.405 GHz / 3327 MB
I'm having multiple problems due to infectious viruses I suspect. I'm having a slow connection, (might be due to just bad connection... but that doesn't happen often.) most big name sites not loading, and random re-directs from unrelated search topics. Network problems have been occurring as well. I've tried running my malware and anti-spyware programs (Malwarebytes and SB S&SD) and they are not running. I've tried un and reinstalling both programs but the installations had errors and are now corrupted. I'm getting the dreaded flag that I need to download anti-virus due to malicious software in my toolbar and I'm getting windows that pop-up on either side. The program is called winiblue I think. I've been trying for an hour or so to get a scan and clean for free from somewhere and nothing's turned out right yet. Any ideas? I have Hijackthis! and can post a log if need be. Thank you for your time.

See More: Virus Attack

Report •


#1
May 8, 2009 at 16:21:23
I'll look at the Hijack This log.

How do you know when a politician is lying? His mouth is moving.


Report •

#2
May 8, 2009 at 17:04:53
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:03:42 PM, on 5/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Razer\Lycosa\razerhid.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\system32\rundll78.exe
C:\WINDOWS\system32\sysregi.exe
C:\Documents and Settings\Crotch Ninja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\TEMP\tempo-7994565.tmp
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Documents and Settings\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [Lycosa] "C:\Program Files\Razer\Lycosa\razerhid.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Hotfix-KB5504305] C:\WINDOWS\system32\rundll78.exe
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\Run: [Nod32 Runtime] sysregi.exe
O4 - HKLM\..\RunServices: [Hotfix-KB5504305] C:\WINDOWS\system32\rundll78.exe
O4 - HKLM\..\RunServices: [Nod32 Runtime] sysregi.exe
O4 - HKCU\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\bin\TrayIcon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Crotch Ninja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Hotfix-KB5504305] C:\WINDOWS\system32\rundll78.exe
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O4 - HKCU\..\RunServices: [Hotfix-KB5504305] C:\WINDOWS\system32\rundll78.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://asp.mathxl.com/wizmodules/te...
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Player...
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpc...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g...
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Player...
O17 - HKLM\System\CCS\Services\Tcpip\..\{35D22771-F6E8-41D5-B9F3-DE21509DE95E}: NameServer = 85.255.112.159,85.255.112.16
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16
O17 - HKLM\System\CS1\Services\Tcpip\..\{35D22771-F6E8-41D5-B9F3-DE21509DE95E}: NameServer = 85.255.112.159,85.255.112.16
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.181,85.255.112.81
O17 - HKLM\System\CS3\Services\Tcpip\..\{35D22771-F6E8-41D5-B9F3-DE21509DE95E}: NameServer = 85.255.112.181,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - SDSD - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)

--
End of file - 10301 bytes


Report •

#3
May 8, 2009 at 17:22:52
Delete everything below. I really like the fake hotfix & the fake nod32 file, not to mention the hijacked name servers.

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min

O4 - HKLM\..\Run: [Nod32 Runtime] sysregi.exe

O4 - HKLM\..\RunServices: [Hotfix-KB5504305] C:\WINDOWS\system32\rundll78.exe

O4 - HKLM\..\RunServices: [Nod32 Runtime] sysregi.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{35D22771-F6E8-41D5-B9F3-DE21509DE95E}: NameServer = 85.255.112.159,85.255.112.16

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16

O17 - HKLM\System\CS1\Services\Tcpip\..\{35D22771-F6E8-41D5-B9F3-DE21509DE95E}: NameServer = 85.255.112.159,85.255.112.16

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.181,85.255.112.81

O17 - HKLM\System\CS3\Services\Tcpip\..\{35D22771-F6E8-41D5-B9F3-DE21509DE95E}: NameServer = 85.255.112.181,85.255.112.81

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.159,85.255.112.16

How do you know when a politician is lying? His mouth is moving.


Report •

Related Solutions

#4
May 8, 2009 at 17:56:01
I deleted the items on the list and here is the revised list after restart. I tried my SB S&D as well as Malwarebytes, they installed but do not run. Network and internet seems to be working fine so far. Thank you.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:54:10 PM, on 5/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ500

0MUI.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Razer\Lycosa\razerhid.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common

Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common

Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Crotch Ninja\Local

Settings\Application

Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start

Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local

Page =
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Window Title = Microsoft Internet Explorer

provided by CenturyTel
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Interne

t Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for

Internet Explorer -

{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program

Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter -

{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

C:\Documents and Settings\avgssie.dll (file missing)
O2 - BHO: (no name) -

{7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper -

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper -

{DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program

Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl -

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program

Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [JMB36X Configure]

C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog

Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog

Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ500

0MUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program

Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeathAdder] C:\Program

Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [Lycosa] "C:\Program

Files\Razer\Lycosa\razerhid.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher]

"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware]

C:\Program Files\Malwarebytes'

Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [AGEIA PhysX SysTray] C:\Program

Files\AGEIA Technologies\bin\TrayIcon.exe
O4 - HKCU\..\Run:

[BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Program Files\Common

Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and

Settings\Crotch Ninja\Local Settings\Application

Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program

Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows

Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunServices: [Hotfix-KB5504305]

C:\WINDOWS\system32\rundll78.exe
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: AIM -

{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program

Files\AIM\aim.exe
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}

(Installation Support) - C:\Program

Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B}

(TTestGenXInstallObject) -

http://asp.mathxl.com/wizmodules/te...

enXInstall.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421}

(Pearson Installation Assistant 2) -

http://asp.mathxl.com/books/_Player...

cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}

(Crucial cpcScan) -

http://www.crucial.com/controls/cpc...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binar...

Client.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}

(Shockwave Flash Object) -

http://fpdownload2.macromedia.com/g...

lash/swflash.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947}

(Pearson MathXL Player) -

http://asp.mathxl.com/books/_Player...
O23 - Service: Apple Mobile Device - Apple Inc. -

C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) -

Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter

(JavaQuickStarterService) - Sun Microsystems, Inc. -

C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) -

SDSD - C:\Program

Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling

Service (LightScribeService) - Hewlett-Packard Company -

C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) -

NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner -

C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Windows Defender (WinDefend) - Unknown

owner - C:\Program Files\Windows Defender\MsMpEng.exe

(file missing)

--
End of file - 8608 bytes


Report •

#5
May 8, 2009 at 19:45:49
The log looks pretty good. What was the problem with anti malware. Why wouldn't it run? Did it install but not update? Try it as admin &/or safe mode.

How do you know when a politician is lying? His mouth is moving.


Report •

#6
May 9, 2009 at 11:39:49
I have no idea. I am admin... and it doesn't even come up in the Task Manager... even for a second. I double click and nothing happens. I tried AVG installing and everytime I installed it it said that it could not verify the serial number. "Normally caused by a corrupted installation" AVG would prompt me to reinstall it or close... There would be no errors during any of the installations... they just don't do anything after installation... it's weird. I haven't tried safe mode yet. Silly me, I'll give that a shot. Thank you very much for the help.

Report •

#7
May 9, 2009 at 15:41:38
I had one that wouldn't let me run anti malware so I put the HD in an external USB enclosure, connected it to my laptop & ran it from there.

How do you know when a politician is lying? His mouth is moving.


Report •

#8
May 10, 2009 at 00:20:34
Hi,

You can try installing Malware Bytes in safe mode with networking. After you are done with the scan, install Smit Fraud Fix. Or, you can try trojan remover also. Let mi know if you need further assistance.

Regards,

S. Kannur.
deeskannur@gmail.com


Report •

#9
May 18, 2009 at 12:27:55
Alright, here's the deal. I don't think I've ever successfully started up in safe mode on this computer. If I know this the correct button is F8 at startup but that just lets me change what source I want to boot off of not how mode to start in. Is there another key that I use? I've caught the google redirect as well as a lot of pop ups and nothing yet on the anti-virus software I plan on that working here after I figure out safe mode.

Report •

#10
May 18, 2009 at 14:05:32
Hi,
Can you please post your AVZ log:

1) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

2) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

3) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteStdScr(3);
RebootWindows(true);
end.

Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

Note: Use the normal mode

--------------------------------------------
To Private Message me Click Here


Report •

#11
May 18, 2009 at 18:04:23
It sounds like F8 is giving you the F12 menu. Try F12.

How do you know when a politician is lying? His mouth is moving.


Report •

#12
May 22, 2009 at 10:12:14
http://rapidshare.com/files/2360275...

There is the link. Tried F12 nothing. I'll try once more. Once again your help is very very appreciated. I'm lost when it comes to certain ways around tricky malware.


Report •

#13
May 22, 2009 at 10:42:56
Run this script in AVZ; your computer will reboot:


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 QuarantineFile('C:\WINDOWS\system32\rundll78.exe','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\a62op0k2.SYS','');
 QuarantineFile('C:\DOCUME~1\CROTCH~1\LOCALS~1\Temp\asbp2poa.sys','');
 TerminateProcessByName('c:\windows\temp\tempo-4356844.tmp');
 QuarantineFile('c:\windows\temp\tempo-4356844.tmp','');
 DeleteFile('c:\windows\temp\tempo-4356844.tmp');
 DeleteFile('C:\DOCUME~1\CROTCH~1\LOCALS~1\Temp\asbp2poa.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\a62op0k2.SYS');
 DeleteFile('C:\WINDOWS\system32\rundll78.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.


After your computer reboots follow:

Attach a Combofix log, please review and follow these instructions carefully.

Download it here -> http://download.bleepingcomputer.co...

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post.

--------------------------------------------
To Private Message me Click Here


Report •

#14
May 22, 2009 at 12:21:10
Part 1 of 2

ComboFix 09-05-22.03 - Crotch Ninja 05/22/2009 14:02.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2917 [GMT -5:00]
Running from: c:\documents and settings\Crotch Ninja\Desktop\123.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\documents and settings\All Users\Application Data\78129A72.exe
c:\windows\10429sza5bot55a.cpl
c:\windows\10557spyz59.ocx
c:\windows\10589hacztool3cd5.bin
c:\windows\10650szy749.exe
c:\windows\1096zwor568a9.ocx
c:\windows\11342viruz9e45.exe
c:\windows\11759zp96e6.dll
c:\windows\1185spa9se711z.cpl
c:\windows\1191vir25z8.dll
c:\windows\12000hzcktoo59c9.cpl
c:\windows\12001not-a-virus19z5.bin
c:\windows\12295wormz57.exe
c:\windows\12352sp95bzt466.exe
c:\windows\125945rzj606.bin
c:\windows\126spyw5ze1789.exe
c:\windows\126zdow5loader2019.bin
c:\windows\12806wor979z5.cpl
c:\windows\12830virus590z.ocx
c:\windows\13050n9t-a-vi5us2z3.exe
c:\windows\132509azktool6de.dll
c:\windows\1352thzef9143.exe
c:\windows\13679spamboz4a5.dll
c:\windows\138589roz599.exe
c:\windows\13z35vi5u9747.cpl
c:\windows\141threat95z73.bin
c:\windows\144z3n5t-a-virus915.bin
c:\windows\147599irzs457.ocx
c:\windows\1502s5y2a9z.bin
c:\windows\15127spazb9t159.exe
c:\windows\15399zpy1dc.dll
c:\windows\153z8n9t-a-virus256.bin
c:\windows\15549spambot4ez.exe
c:\windows\15559troj275z.dll
c:\windows\15559wormzd9.cpl
c:\windows\15890t5ojz2b.ocx
c:\windows\15975roj739z.exe
c:\windows\159doznl9ader2299.ocx
c:\windows\159esteal349z.ocx
c:\windows\15bdspywaze5912.cpl
c:\windows\15z95troj3d9.dll
c:\windows\166085a9ktool2z0.cpl
c:\windows\16688tr9j3z85.exe
c:\windows\16862n5t-a-ziru9100.cpl
c:\windows\1741h5cktoo9412z.ocx
c:\windows\175769ot-a-viruz290.dll
c:\windows\178z4spambo549c.ocx
c:\windows\17995wz5m354.ocx
c:\windows\17z65pambot149.cpl
c:\windows\18115oz-a-virus1349.bin
c:\windows\185cbackdoor259z.dll
c:\windows\1889vi59z89.dll
c:\windows\1896zs5ambot71c.ocx
c:\windows\19139zpam59t4c.cpl
c:\windows\19433spzmb9t5fe.cpl
c:\windows\1948spyw95z1385.ocx
c:\windows\195659zambot1a.ocx
c:\windows\195699py2zf.bin
c:\windows\19569hacktool4z.dll
c:\windows\19999s5y79z.exe
c:\windows\19d3bazkdoor15745.bin
c:\windows\19daddwar52z11.exe
c:\windows\19z09troj5cb.cpl
c:\windows\19z15tr9j745.ocx
c:\windows\19z69viru5722.cpl
c:\windows\1a159reat1z05.cpl
c:\windows\1a54threatz0469.bin
c:\windows\1b1c9parze625.ocx
c:\windows\1b25tzi9f1305.exe
c:\windows\1c25addwarz1591.dll
c:\windows\1d57downloazer1973.bin
c:\windows\1d99thizf16575.dll
c:\windows\1z89downloader1542.dll
c:\windows\1z995troj38a.dll
c:\windows\1za3spyw5re9330.bin
c:\windows\20235vizus593.cpl
c:\windows\20308not-az9irus5fc.dll
c:\windows\20375hazktool952.exe
c:\windows\211569acktool19az.dll
c:\windows\21300wor59z0.exe
c:\windows\2145zro9157.bin
c:\windows\215zhacktoo57d59.bin
c:\windows\21959troj75z.exe
c:\windows\22148hack5ooz91d.bin
c:\windows\2224hackz5o9267.ocx
c:\windows\22528trzj499.cpl
c:\windows\2252sp9rze1839.exe
c:\windows\2255tz9ef59.dll
c:\windows\2284haczt5ol397.dll
c:\windows\22914vir9sz57.bin
c:\windows\22dzvir1539.exe
c:\windows\22z95ha5ktool339.cpl
c:\windows\23084v9rz5734.dll
c:\windows\23350szambot59.exe
c:\windows\23555spy9baz.cpl
c:\windows\235bzpa9se5125.exe
c:\windows\23759zpambot4ff9.exe
c:\windows\23f5szarse269.exe
c:\windows\2446559oj4zb.bin
c:\windows\2459thiefz51.bin
c:\windows\24z54wor92ab5.dll
c:\windows\24z7ha9ktoo560b.ocx
c:\windows\251baddzar9554.ocx
c:\windows\251dspar9e3z7.bin
c:\windows\254z4s59602.cpl
c:\windows\25710n5t-9-virus1z3.exe
c:\windows\25742vir5951z.exe
c:\windows\2580zwor960f.bin
c:\windows\2591z9reat265215.ocx
c:\windows\26356s9y52z.dll
c:\windows\26555wozm2d9.ocx
c:\windows\269thzef2695.ocx
c:\windows\276095rm7z5.ocx
c:\windows\27890virus9zc5.ocx
c:\windows\28318not-a-v5rus9bz.bin
c:\windows\28402spam9zt15f.exe
c:\windows\28797wz5m45c.bin
c:\windows\28999zor59e4.exe
c:\windows\2899z5orm7ff.bin
c:\windows\289zdownloa5er1811.bin
c:\windows\29125zarse545.ocx
c:\windows\2917zpy5b9.cpl
c:\windows\29493not-a-5irus5z2.dll
c:\windows\29537zirus455.dll
c:\windows\2994z5orm28c9.dll
c:\windows\29951s5ambot2fez.cpl
c:\windows\2996downloa9er5z98.cpl
c:\windows\29990tzoj1455.dll
c:\windows\29b2vzr13285.ocx
c:\windows\2a55thief303z9.cpl
c:\windows\2aaadowzloader29175.bin
c:\windows\2dbsp59se1z71.cpl
c:\windows\2ee8a9dwarz1885.dll
c:\windows\2f25zownlo9der259.bin
c:\windows\2z5ebackd9or2760.bin
c:\windows\2z615not-a9vir5s1c.exe
c:\windows\2zfavir14995.bin
c:\windows\30193hackzo5l7a5.dll
c:\windows\30316zp915f.bin
c:\windows\303bad5zar92165.exe
c:\windows\3121vi92835z.exe
c:\windows\317do9nzoa5er569.cpl
c:\windows\31993virzs5e55.dll
c:\windows\31zfvir1995.dll
c:\windows\32156hac5to9l41z.bin
c:\windows\3233backdozr14995.cpl
c:\windows\3239downz5ader2970.exe
c:\windows\325z8v9rus28.exe
c:\windows\3397s9y5arez71.ocx
c:\windows\3502spy9a5e80z.cpl
c:\windows\35649spy6z9.cpl
c:\windows\35696hacktool2e6z.cpl
c:\windows\3588szeal29609.cpl
c:\windows\35c7backdoor1z599.exe
c:\windows\35dthief59z9.exe
c:\windows\35z74t9oj6a4.exe
c:\windows\3641t95j6zb.exe
c:\windows\36c9downl5ader92z.ocx
c:\windows\36zespy9are1035.exe
c:\windows\391v5z935.cpl
c:\windows\3949notz5-virus290.exe
c:\windows\39729ackdoo510z0.exe
c:\windows\39985rojzc2.bin
c:\windows\39dzs5eal1859.exe
c:\windows\3a41thz5at19910.dll
c:\windows\3a589ddwaze2166.bin
c:\windows\3acbb5zk9oor2831.ocx
c:\windows\3az5thr9at2584.dll
c:\windows\3b9b9ownzoade52517.exe
c:\windows\3b9dsp9wzre5258.cpl
c:\windows\3c4b9z5ef1767.cpl
c:\windows\3dz9threat559.exe
c:\windows\3e50zparse31929.cpl
c:\windows\3e85stza92284.dll
c:\windows\3z5aste9l17425.dll
c:\windows\4006t9oj75bz.exe
c:\windows\409bs95waze1897.dll
c:\windows\410zt9ief25145.cpl
c:\windows\4132v592403z.ocx
c:\windows\414backdozr2995.cpl
c:\windows\41559py5are1971z.cpl
c:\windows\42519irz304.bin
c:\windows\42ez59r2869.exe
c:\windows\4309zo5m166.dll
c:\windows\4345sp9warz1539.dll
c:\windows\43zcthie55659.cpl
c:\windows\44579iz1643.bin
c:\windows\4459t9oj7z.dll
c:\windows\4469ownloadzr556.dll
c:\windows\4555sparse9476z.dll
c:\windows\4567zo5nloader1295.bin
c:\windows\4897zt95l2289.exe
c:\windows\48c0addwaz530279.exe
c:\windows\4a95vir1z82.exe
c:\windows\4adow9l5adez141.ocx
c:\windows\4bz5bac9door1927.cpl
c:\windows\4f2dt9reat1z505.exe
c:\windows\4f519ownlozder850.dll
c:\windows\50249pzmbo549e.cpl
c:\windows\502bd5wnloaz9r385.ocx
c:\windows\5199thiefz829.bin
c:\windows\5199zp53a5.ocx
c:\windows\519f95wnloadzr849.bin
c:\windows\5202trz925d.cpl
c:\windows\5235z9roj615.exe
c:\windows\5290ste5l15z9.exe
c:\windows\53431spamzo92ae.bin
c:\windows\534cdownl59derz833.cpl
c:\windows\5391stealz870.dll
c:\windows\5391tz9e51558.exe
c:\windows\5396spars92469z.dll
c:\windows\5474nzt-9-5irus7b6.dll
c:\windows\5496sparse9z0.cpl
c:\windows\54f7thrza926530.bin
c:\windows\54z1v5r18609.exe
c:\windows\5515spywa9z2636.exe
c:\windows\5556w9rm488z.bin
c:\windows\5568spy9z0.bin
c:\windows\559t9zj496.exe
c:\windows\55cct9ief28z5.ocx
c:\windows\55f4vzr3900.bin
c:\windows\5655spazbot759.ocx
c:\windows\56909iru55bz.dll
c:\windows\569cdownzoader2587.dll
c:\windows\56z4sp9372.dll
c:\windows\5725s59mbzt75b.exe
c:\windows\5784spyzd59.bin
c:\windows\585bth5ez92143.bin
c:\windows\5877spa5se29z5.ocx
c:\windows\58d95ownloader107z.ocx
c:\windows\5919azdware191.cpl
c:\windows\59328spambzt458.cpl
c:\windows\5947hackto5l59z.ocx
c:\windows\5955sparze1350.exe
c:\windows\595eaddwzre833.exe
c:\windows\59aespywarez4959.dll
c:\windows\59d9dow5lza9er755.ocx
c:\windows\59z3downloader3259.exe
c:\windows\59z47sp9378.dll
c:\windows\5b5ds9ezl979.ocx
c:\windows\5e0esteaz2995.cpl
c:\windows\5e71b5zkd9or2404.bin
c:\windows\5e8zpyw9re1955.dll
c:\windows\5f39dzware369.dll
c:\windows\5f469zdware2608.exe
c:\windows\5f59z9arse453.ocx
c:\windows\5fdthie9z57.ocx
c:\windows\5fezte5l5779.dll
c:\windows\5z07viru54d9.cpl
c:\windows\5z97thief2295.dll
c:\windows\5z9thief981.ocx
c:\windows\5z9worm523.bin
c:\windows\61e0z5eal3089.exe
c:\windows\6475zpywar92403.bin
c:\windows\64989p5warz2507.ocx
c:\windows\6565downloa5e9215z.cpl
c:\windows\658zst5a9619.exe
c:\windows\659dthief29z9.cpl
c:\windows\6671szywa9e1695.exe
c:\windows\6695downloader955z.cpl
c:\windows\6899addzare2651.exe
c:\windows\6899vi5us4zc.cpl
c:\windows\690cszarse1855.ocx
c:\windows\6952zroj59e.bin
c:\windows\6973t5zef1499.dll
c:\windows\6987bazkdoo92225.exe
c:\windows\69a3thre5z12957.dll
c:\windows\69zathief195.dll
c:\windows\6e09thze51538.cpl
c:\windows\6e2d9i51100z.exe
c:\windows\6e78spywa9e599z.bin
c:\windows\6edd9ow5loader1z37.cpl
c:\windows\6f5f9ownlo5dez994.ocx
c:\windows\6z50vir591.exe
c:\windows\6z95ste9l2052.exe
c:\windows\719bthiefz7275.bin
c:\windows\7205s9ealz63.ocx
c:\windows\72e2threatz5993.cpl
c:\windows\72e9hr5zt17748.cpl
c:\windows\739atzrea529957.dll
c:\windows\73fthr5at26980z.ocx
c:\windows\7499adzware2925.cpl
c:\windows\757dt5r9az20013.cpl
c:\windows\7593sz5al1278.exe
c:\windows\75a3s59al211z.bin
c:\windows\75dczownloader2609.bin
c:\windows\75f7dow5loadz9201.ocx
c:\windows\77badzwn5oader994.dll
c:\windows\792sparsz5287.cpl
c:\windows\7943szam5ot9fa.ocx
c:\windows\7952spywaz52198.cpl
c:\windows\7975wo5m4cz.cpl
c:\windows\79azspyware3596.cpl
c:\windows\79z2thr5at4328.dll
c:\windows\79z4worm5f0.ocx
c:\windows\7a53downlo5der7z89.bin
c:\windows\7fc4addw9ze1305.ocx
c:\windows\7z9st5al652.bin
c:\windows\7zfcaddware5796.ocx
c:\windows\807ba9kdoor158z.ocx
c:\windows\814spamb5tz129.dll
c:\windows\8629acktooz355.bin
c:\windows\8909virz512a.dll
c:\windows\8923tro5511z.bin
c:\windows\9049ro569z.cpl
c:\windows\9051no5-z-virus5d0.bin
c:\windows\90530hacktooz455.bin
c:\windows\9136trojzd75.bin
c:\windows\9179spzmbot755.cpl
c:\windows\92049h5cztool6d1.dll
c:\windows\92093trzj5d5.dll
c:\windows\926z5troja2.cpl
c:\windows\9292tz5eat21336.cpl
c:\windows\92e0spywzre1751.ocx
c:\windows\94554vzrus67.dll
c:\windows\9476v5rus798z.dll
c:\windows\95205orz49f.exe
c:\windows\9555parze3260.dll
c:\windows\957ctzief393.cpl
c:\windows\965ztr5j4679.exe
c:\windows\96985vi5uz559.ocx
c:\windows\9845viz5s559.bin
c:\windows\989625irus15z.exe
c:\windows\98c7s5zrse1780.exe
c:\windows\9919sp5z1d.cpl
c:\windows\991znot-a-9i5us6d5.cpl
c:\windows\99578zirus215.bin
c:\windows\9960tzoj158.exe
c:\windows\99a7zp5ware2094.cpl
c:\windows\99b1szyware855.dll
c:\windows\99z08vi5us366.bin
c:\windows\9a35teal17z2.bin
c:\windows\9b7spywaze2655.cpl
c:\windows\9c1f5zwnloader2894.cpl
c:\windows\9cc8spywarz2259.ocx
c:\windows\9d5eszyware5430.dll
c:\windows\9z66vir1645.ocx
c:\windows\9z876vi5us67d.bin
c:\windows\a7bstea9159z.ocx
c:\windows\b3f9ddware50z6.bin
c:\windows\b4cvz519809.ocx
c:\windows\bathrea9192z25.ocx
c:\windows\c9bsparze11589.cpl
c:\windows\d9caddware591z.bin
c:\windows\e05zhie527559.bin
c:\windows\efst9zl5734.cpl
c:\windows\system32\_000047_.tmp.dll
c:\windows\system32\1038do5nloazer903.dll
c:\windows\system32\1092zp575c.bin
c:\windows\system32\10z43ha9ktool75b5.ocx
c:\windows\system32\114a5ddwarz893.cpl
c:\windows\system32\11609sp9mb5tzf7.exe
c:\windows\system32\116195zrus69a.dll
c:\windows\system32\11971t5ojzeb.ocx
c:\windows\system32\12299troj51z.cpl
c:\windows\system32\123ca9dwar52626z.bin
c:\windows\system32\12965woz525b9.ocx
c:\windows\system32\12c69h5eat2446z.bin
c:\windows\system32\130259pambot34dz.dll
c:\windows\system32\13530hacktz9l23d.bin
c:\windows\system32\13593wormz04.dll
c:\windows\system32\1395st5zl1845.bin
c:\windows\system32\13bb5ckdooz639.cpl
c:\windows\system32\1402495zj2f0.cpl
c:\windows\system32\14386ha9ktool57z.exe
c:\windows\system32\145b9p5zare99.cpl
c:\windows\system32\14870spambzt2559.exe
c:\windows\system32\14z47spamb9t6e95.exe
c:\windows\system32\15425spa9zot498.ocx
c:\windows\system32\15498zp5165.ocx
c:\windows\system32\15551n9tza5virus3b6.bin
c:\windows\system32\15598spyz9e.bin
c:\windows\system32\155z8s9y308.ocx
c:\windows\system32\1560z5ot9a-virus56b.exe
c:\windows\system32\158539ackt5ol54z.dll
c:\windows\system32\161zwo9m2c55.cpl
c:\windows\system32\16359spam5otz92.exe
c:\windows\system32\1652zs9y60a.dll
c:\windows\system32\1676thi9f150z.ocx
c:\windows\system32\16ac5p9warz1396.exe
c:\windows\system32\17115sz9526.ocx
c:\windows\system32\17395worm1aez.ocx
c:\windows\system32\17687h9cktool50bz.dll
c:\windows\system32\179z8tr9j1655.exe
c:\windows\system32\1817znot-a-v9rus55.bin
c:\windows\system32\1863zw9r5dc.bin
c:\windows\system32\18914zorm659.exe
c:\windows\system32\18cdszarse2597.bin
c:\windows\system32\18z05w9rm7485.exe
c:\windows\system32\18z77no5-a-viru9282.exe
c:\windows\system32\19412no9-a5virusz92.cpl
c:\windows\system32\198z8troj965.cpl
c:\windows\system32\19959wozm6f8.bin
c:\windows\system32\19c5spywar94z6.cpl
c:\windows\system32\19z5downloader1113.dll
c:\windows\system32\1bd8adzwa953218.exe
c:\windows\system32\1bf9adzwar52998.cpl
c:\windows\system32\1d59sp9zare767.bin
c:\windows\system32\1f045ownloa9ez2553.bin
c:\windows\system32\1f435ddware9193z.cpl
c:\windows\system32\1f9bthie529z6.exe
c:\windows\system32\1z3569orm35b.exe
c:\windows\system32\1z540s9ambo553e.exe
c:\windows\system32\1z56vi9952.cpl
c:\windows\system32\1z5spy59.dll
c:\windows\system32\1z615hackto5l4039.cpl
c:\windows\system32\1z869ackdoo52915.exe
c:\windows\system32\1z90wo9m1b25.ocx
c:\windows\system32\1z964wo5m935.dll
c:\windows\system32\20399zirus5c6.ocx
c:\windows\system32\20z9s9y4e45.bin
c:\windows\system32\21195hacktzol9fe.dll
c:\windows\system32\215aadzw9re2714.bin
c:\windows\system32\2176995rus2aez.cpl
c:\windows\system32\21975hazkt5ol625.cpl
c:\windows\system32\21z275orm9b.exe
c:\windows\system32\2209znot5a-virusfd.cpl
c:\windows\system32\22252not-a-virus2f9z.ocx
c:\windows\system32\2249doznlo9der5777.cpl
c:\windows\system32\22945hackzool2a59.cpl
c:\windows\system32\22d1addwa5e214z9.dll
c:\windows\system32\23057zorm5f9.bin
c:\windows\system32\23596hacktzo52.exe
c:\windows\system32\2423spy9a5e13z2.bin
c:\windows\system32\24z709orm69a5.dll
c:\windows\system32\25075not-azv9rus550.bin
c:\windows\system32\25085not-a-virus5z9.bin
c:\windows\system32\2509wormz64.bin
c:\windows\system32\2510zspy593.dll
c:\windows\system32\25513sp5m9oz43c.ocx
c:\windows\system32\255cdo59loader239z.cpl
c:\windows\system32\25981hacktoolz6a.ocx
c:\windows\system32\2599spa9bot4dz.dll
c:\windows\system32\25cfspyzare2195.bin
c:\windows\system32\25z96worm3f99.ocx
c:\windows\system32\26169spam5ot514z.cpl
c:\windows\system32\26196v5rus2z5.exe
c:\windows\system32\27078n5z-a-virus958.cpl
c:\windows\system32\27205hreat2z6949.exe
c:\windows\system32\27205tezl1920.ocx
c:\windows\system32\27505s9y2z0.bin
c:\windows\system32\27823nz9-a-vir5s5c3.exe
c:\windows\system32\27952not-a-vi9us3cz.ocx
c:\windows\system32\27zbaddwa59823.bin
c:\windows\system32\28018n9z-a-v5rus58d.cpl
c:\windows\system32\28057tzoj459.dll
c:\windows\system32\280z5hack5ool9d0.ocx
c:\windows\system32\28194t9ojz57.exe
c:\windows\system32\283569ro5z0.exe
c:\windows\system32\284209ot-a5virzs67b.cpl
c:\windows\system32\2855tzre9t46825.dll
c:\windows\system32\287565pyz9.cpl
c:\windows\system32\29565vzrus902.bin
c:\windows\system32\29584spzm9ot46e.ocx
c:\windows\system32\295z6hackto9l501.dll
c:\windows\system32\29752s9a5zot6a6.cpl
c:\windows\system32\29785tro9z3f.cpl
c:\windows\system32\297z9spa9bot7e5.exe
c:\windows\system32\29866w5rz1209.bin
c:\windows\system32\29996s9y1dz5.cpl
c:\windows\system32\299fsteal556z.dll
c:\windows\system32\2b45spa59ez194.bin
c:\windows\system32\2bb9backzoor915.cpl
c:\windows\system32\2cba95ware97z.cpl
c:\windows\system32\2cz9steal954.bin
c:\windows\system32\2d92backdoor2859z.bin
c:\windows\system32\2dz9st5al2724.dll
c:\windows\system32\2ea5a9dware2z10.exe
c:\windows\system32\2ea9ste5lz56.dll
c:\windows\system32\2f25spywa9e1z255.cpl
c:\windows\system32\2fa59ywzre2501.ocx
c:\windows\system32\2ffcthreatz93995.bin
c:\windows\system32\301z2spam59t2ce.ocx
c:\windows\system32\3042zspambo5d9.dll
c:\windows\system32\3097z9p559e.bin
c:\windows\system32\3109trojz52.exe
c:\windows\system32\3150z9irus562.dll
c:\windows\system32\32311spamzo5699.ocx
c:\windows\system32\32435vi9us6f6z.ocx
c:\windows\system32\32501z9amb5t6b7.ocx
c:\windows\system32\330zsp5rs9278.exe
c:\windows\system32\339csparsz5985.exe
c:\windows\system32\33evi59z57.bin
c:\windows\system32\3472vi53095z.exe
c:\windows\system32\3492add5arez152.cpl
c:\windows\system32\35897zroj324.ocx
c:\windows\system32\35fddzwnloader9988.exe
c:\windows\system32\36d9downloaz5r597.dll
c:\windows\system32\36f0zhreat997385.cpl
c:\windows\system32\3729backdooz2952.cpl
c:\windows\system32\379z5p971c.bin
c:\windows\system32\3929th59at32264z.cpl
c:\windows\system32\3982z59mbot5b8.ocx
c:\windows\system32\3a35azdware1592.bin
c:\windows\system32\3a4ctzr5a94620.bin
c:\windows\system32\3a9ftzre5t8199.dll
c:\windows\system32\3b8z9ack5oor337.exe
c:\windows\system32\3c515own9oader30z1.dll
c:\windows\system32\3d54spyzare1955.ocx
c:\windows\system32\3ef4thzef13985.dll
c:\windows\system32\3z49v5r29889.bin
c:\windows\system32\3z869ownloader11765.cpl
c:\windows\system32\3zdf9hie5754.exe
c:\windows\system32\409bspy95ze1821.bin
c:\windows\system32\41509py3cz.ocx
c:\windows\system32\41955pywaze1529.dll
c:\windows\system32\41b05parse3269z.exe
c:\windows\system32\42z2spa5se2952.exe
c:\windows\system32\430a5pazse901.exe
c:\windows\system32\43ecaddwzre935.ocx
c:\windows\system32\44ecthrza959978.dll
c:\windows\system32\452zr9j2cd.dll
c:\windows\system32\4591s5azbot9e1.dll
c:\windows\system32\45f7backdoorz3609.bin
c:\windows\system32\45z5downloa9er912.exe
c:\windows\system32\4653hackto5lzc9.bin
c:\windows\system32\465o9m6cbz.cpl
c:\windows\system32\4850szeal594.bin
c:\windows\system32\4872ad5w9ze1045.bin
c:\windows\system32\48ddbackdoor908z5.bin
c:\windows\system32\497dvir1z95.cpl
c:\windows\system32\49c3spaz9e3555.ocx
c:\windows\system32\49caddw5ze1219.ocx
c:\windows\system32\4abzt9al2513.bin
c:\windows\system32\4ae9spyware5z43.dll
c:\windows\system32\4b9zsteal2535.ocx
c:\windows\system32\4ba0zack9oor4915.exe
c:\windows\system32\4c62backdo9r29z45.dll
c:\windows\system32\4ccfspzrs59422.ocx
c:\windows\system32\4d6bthizf54009.bin
c:\windows\system32\4e5cvi5z099.cpl
c:\windows\system32\4z90thr9at17574.exe
c:\windows\system32\4z95sparse215.bin
c:\windows\system32\50910szy53d.exe
c:\windows\system32\50ecst5al2596z.cpl
c:\windows\system32\5136szea59594.exe
c:\windows\system32\51ebdo5nlo9dzr506.exe
c:\windows\system32\51z23worm2fc9.dll
c:\windows\system32\5237worm94z.dll
c:\windows\system32\5294threa5225z2.bin
c:\windows\system32\5299vz51528.bin
c:\windows\system32\52e4back9oor3z315.dll
c:\windows\system32\52z8spar95563.exe
c:\windows\system32\532cdownl5ad9z758.exe
c:\windows\system32\5359spambotz8.ocx
c:\windows\system32\5396thief9059z.cpl
c:\windows\system32\539zs5y38c9.exe
c:\windows\system32\53f8s5ezl9796.cpl
c:\windows\system32\5401addwa5z293.exe
c:\windows\system32\5466backdoorz590.dll
c:\windows\system32\5545za5ktoo97e4.exe
c:\windows\system32\5559thi5z9329.dll
c:\windows\system32\5570spzrs91815.dll
c:\windows\system32\5579nzt-a-v9rus789.exe
c:\windows\system32\558d9ackdoor568z.cpl
c:\windows\system32\5597zhief224.exe
c:\windows\system32\55b4dzwnl9ader219.ocx
c:\windows\system32\55ecth9eatz3321.ocx
c:\windows\system32\56270spyz92.dll
c:\windows\system32\56529zckdoor195.cpl
c:\windows\system32\56fdowzlo5der1987.ocx
c:\windows\system32\57699worz4e1.exe
c:\windows\system32\5781sp9zbot1c1.exe
c:\windows\system32\5795spam9zt6b5.dll
c:\windows\system32\5798viz117.bin
c:\windows\system32\57z0h9cktool51a.cpl
c:\windows\system32\57zv5r1939.exe
c:\windows\system32\5815spy6fz9.dll
c:\windows\system32\58579tzoj240.ocx
c:\windows\system32\590tzoj96d.bin
c:\windows\system32\5956spz457.ocx
c:\windows\system32\59z6w95md1.cpl
c:\windows\system32\5a1dthz9at791.dll
c:\windows\system32\5ac0spywaz52490.ocx
c:\windows\system32\5ac59ddzare1395.dll
c:\windows\system32\5b57vir6z49.bin
c:\windows\system32\5cd3ad5z9re2686.bin
c:\windows\system32\5d56ba5kzo9r543.exe
c:\windows\system32\5dfezow5loader593.dll
c:\windows\system32\5f505py9arez1.bin
c:\windows\system32\5f59s9zal2625.cpl
c:\windows\system32\5fdbthief90z0.cpl
c:\windows\system32\5z0369orm44.dll
c:\windows\system32\5z987troj47b.dll
c:\windows\system32\6044hack9oolz25.dll
c:\windows\system32\6050zorm9d4.exe
c:\windows\system32\6210szarse18559.ocx
c:\windows\system32\6233steaz5169.exe
c:\windows\system32\6250not-a-viru93acz.exe
c:\windows\system32\6291zor964d5.bin
c:\windows\system32\62ad59arse3166z.dll
c:\windows\system32\63915pywarez025.dll
c:\windows\system32\657zs95al495.bin
c:\windows\system32\6585v9r3z32.cpl
c:\windows\system32\6615addware489z.cpl
c:\windows\system32\671259r6z7.ocx
c:\windows\system32\6715azd9are2264.cpl
c:\windows\system32\685bvi9255z.bin
c:\windows\system32\6903dow5zoade9539.bin
c:\windows\system32\691cback5zor3251.ocx
c:\windows\system32\69a9spazs5686.bin
c:\windows\system32\69dt5iez2437.exe
c:\windows\system32\69e1spar5e9448z.cpl
c:\windows\system32\69fetzief19159.ocx
c:\windows\system32\6afzthreat201965.bin
c:\windows\system32\6b915tealz930.exe
c:\windows\system32\6cz5ba9kdoor2665.dll
c:\windows\system32\6dd6a5dw9ze177.bin
c:\windows\system32\6dzdthie917605.bin
c:\windows\system32\6ed85ownlzader494.exe
c:\windows\system32\6f94threa529803z.ocx
c:\windows\system32\6z5as9eal130.cpl
c:\windows\system32\706a5hre9tz4467.bin
c:\windows\system32\70989parse2050z.cpl
c:\windows\system32\7209wo9mz5d.cpl
c:\windows\system32\7426v5rz095.exe
c:\windows\system32\7592zhief24709.ocx
c:\windows\system32\7598spywzre9039.cpl
c:\windows\system32\7655thizf9919.ocx
c:\windows\system32\7755addware196z.dll
c:\windows\system32\78z5down5oader1950.ocx
c:\windows\system32\792zspywa5e1698.dll
c:\windows\system32\79z25parse110.cpl
c:\windows\system32\7a05bac9zoor993.dll
c:\windows\system32\7abz5pa9se1049.exe
c:\windows\system32\7c97b9ck5oor388z.cpl
c:\windows\system32\7c9sparsz165.exe
c:\windows\system32\7cz95hr9at15565.bin
c:\windows\system32\7da2spz5se2169.dll
c:\windows\system32\7zcav951423.cpl
c:\windows\system32\82zir2598.ocx
c:\windows\system32\8375sp9z93.bin
c:\windows\system32\8656spamb9z6435.exe
c:\windows\system32\86f5h9ezt17271.bin
c:\windows\system32\86z8s5am9ot4a0.exe
c:\windows\system32\90755virzs462.exe
c:\windows\system32\9159zpy163.cpl
c:\windows\system32\9185hacktooz69.dll
c:\windows\system32\9209sp5119z.exe
c:\windows\system32\923225zy438.bin
c:\windows\system32\927975pz7f2.cpl
c:\windows\system32\93z42hackt5ol5c9.ocx
c:\windows\system32\9407sz5m9ot251.bin
c:\windows\system32\94705not-a-5irzs7c6.dll
c:\windows\system32\9506zo5nloader2740.ocx
c:\windows\system32\95655spy650z.bin
c:\windows\system32\957fsp5rse1574z.dll
c:\windows\system32\9592znot-a-virus95.ocx
c:\windows\system32\972th9ef1205z.ocx
c:\windows\system32\97555vzrus62e.exe
c:\windows\system32\988szyware2857.exe
c:\windows\system32\992z9virus615.dll
c:\windows\system32\9954wzrm55b.cpl
c:\windows\system32\99z5hac5tool76d.cpl
c:\windows\system32\9b55backdzor288.exe
c:\windows\system32\9c075zeal2638.dll
c:\windows\system32\9ca5zir31475.cpl
c:\windows\system32\9d45backdooz2749.ocx
c:\windows\system32\9d61backdzor951.bin
c:\windows\system32\9f5backzoor2950.ocx
c:\windows\system32\9z205irus2c9.dll
c:\windows\system32\9z5935irus54a.dll
c:\windows\system32\a4zspywar5390.cpl
c:\windows\system32\a9evi95z77.ocx
c:\windows\system32\b9bstza93055.bin
c:\windows\system32\c75zparse2297.exe
c:\windows\system32\cb5down5zad9r763.bin
c:\windows\system32\d65thizf9697.dll
c:\windows\system32\d905zeal2225.dll
c:\windows\system32\drivers\gxvxcesixlypdwkmoyiqvhoppfmitlklxsqhb.sys
c:\windows\system32\drivers\gxvxckjivnoflfmxolrlnqvhppekiejmoeasw.sys
c:\windows\system32\drivers\gxvxcouotpwwrwvatxlelnkwfysvxcvytdktl.sys
c:\windows\system32\drivers\gxvxcspvgopxtsdiseamnaopwoyexwjyowrkj.sys
c:\windows\system32\drivers\gxvxctkbnrbqpuirirfwxbqfoexylkllovmow.sys
c:\windows\system32\drivers\msqpdxrvdcofub.sys
c:\windows\system32\drivers\TDSSmxst.sys
c:\windows\system32\eafszea59964.exe
c:\windows\system32\f87thzef5099.cpl
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcpibekobpphwbdwypmltvstihrexaeiqw.dll
c:\windows\system32\msqpdxbpyhcrkv.dll
c:\windows\system32\setup2.exe
c:\windows\system32\sysregi.exe
c:\windows\system32\TDSSarxx.dll
c:\windows\system32\TDSSdxcp.dll
c:\windows\system32\TDSSkkai.log
c:\windows\system32\TDSSmtve.dat
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnvuo.dll
c:\windows\system32\TDSSoitt.dll
c:\windows\system32\TDSSsahc.dll
c:\windows\system32\TDSSvoqm.dll
c:\windows\system32\TDSSxhyf.log
c:\windows\system32\z079troj95.bin
c:\windows\system32\z09downloader599.dll
c:\windows\system32\z1985troj47d.bin
c:\windows\system32\z2095spy5cd9.bin
c:\windows\system32\z2785teal2419.ocx
c:\windows\system32\z2869d5ware667.exe
c:\windows\system32\z29895ot-9-virus370.bin
c:\windows\system32\z3938hackto9l455.dll
c:\windows\system32\z4c25ownload9r2068.ocx
c:\windows\system32\z4cb9tea52275.bin
c:\windows\system32\z51bspywar9797.exe
c:\windows\system32\z5510spy98c.bin
c:\windows\system32\z5651wo9m759.ocx
c:\windows\system32\z5769d5ware1343.bin
c:\windows\system32\z61859pambot2f0.ocx
c:\windows\system32\z64eth5eat99407.dll
c:\windows\system32\z736downl5a9er2650.exe
c:\windows\system32\z7f5stea935.bin
c:\windows\system32\z8737not-a-9irus4375.ocx
c:\windows\system32\z95599roj7ab5.exe
c:\windows\system32\z9942n5t9a-virus79e.cpl
c:\windows\system32\z996downloader22459.exe
c:\windows\system32\zc47download9r5888.cpl
c:\windows\system32\zcefspa9se650.cpl
c:\windows\system32\ze55t9ief1068.dll
c:\windows\system32\zf59spa9se711.bin
c:\windows\system32\zf73v9r521.exe
c:\windows\welik.exe
c:\windows\z08595roj403.exe
c:\windows\z0928viru52f5.bin
c:\windows\z18879roj579.exe
c:\windows\z2758worm45c9.bin
c:\windows\z3370t59j60c.ocx
c:\windows\z4c8addw5r92446.exe
c:\windows\z544tro9cb5.ocx
c:\windows\z5507sp9249.ocx
c:\windows\z67a9ir2405.ocx
c:\windows\z7565ddwar93188.dll
c:\windows\z84csteal15259.cpl
c:\windows\z8919troj5b5.bin
c:\windows\z8992hackto5l7c0.dll
c:\windows\z9453troj35c.dll
c:\windows\z95dad9ware4585.ocx
c:\windows\z995or93c1.bin
c:\windows\z9daspyw5re1611.bin
c:\windows\zb0aa5dware18809.bin
c:\windows\zc969te5l93.cpl
c:\windows\ze10spar9e5104.dll
c:\windows\ze5csteal849.ocx
c:\windows\zf765p9ware824.dll
G:\Autorun.inf
G:\install.exe
G:\resycled
g:\resycled\boot.com


Report •

#15
May 22, 2009 at 12:22:26
Part 2 of 2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gxvxcserv.sys
-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS
-------\Service_MSQPDXSERV.SYS
-------\Legacy_MSQPDXSERV.SYS


((((((((((((((((((((((((( Files Created from 2009-04-22 to 2009-05-22 )))))))))))))))))))))))))))))))
.

2009-05-22 17:03 . 2009-05-22 18:32 -------- d-----w c:\program files\avz4
2009-05-09 18:22 . 2009-05-09 18:22 -------- d-----w c:\program files\Flagship Studios
2009-05-09 01:11 . 2009-05-09 01:11 -------- d-----w c:\program files\AVG
2009-05-08 22:18 . 2009-05-08 22:18 195584 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\5\27706285-76adf003-n\WMINative.dll
2009-05-07 19:33 . 2009-05-19 05:00 25 ----a-w c:\windows\popcinfot.dat
2009-05-07 09:37 . 2009-05-07 09:37 25 ----a-w c:\program files\popcinfot.dat
2009-05-07 08:54 . 2009-05-07 08:54 -------- d-----w c:\documents and settings\All Users\Application Data\PopCap Games
2009-05-07 08:53 . 2009-05-19 05:00 -------- d-----w c:\program files\Plants vs Zombies
2009-04-30 20:50 . 2009-05-02 18:30 -------- d-----w c:\program files\Peggle Nights from PopCap Games
2009-04-29 21:19 . 2009-04-29 21:19 41808 ----a-w c:\windows\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 18:38 . 2008-04-13 22:56 -------- d-----w c:\program files\Mozilla Firefox 3 Beta 5
2009-05-22 16:16 . 2007-12-01 20:54 -------- d-----w c:\documents and settings\Crotch Ninja\Application Data\uTorrent
2009-05-21 17:37 . 2008-06-25 00:18 -------- d-----w c:\program files\Warcraft III
2009-05-21 15:12 . 2007-09-16 14:29 -------- d-----w c:\program files\World of Warcraft
2009-05-20 16:36 . 2007-09-15 16:22 -------- d-----w c:\documents and settings\Crotch Ninja\Application Data\U3
2009-05-20 03:18 . 2007-09-16 14:45 -------- d-----w c:\program files\Steam
2009-05-20 03:11 . 2007-09-22 16:59 138184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-20 03:11 . 2007-09-22 16:59 183112 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-19 22:18 . 2007-09-23 15:58 -------- d-----w c:\program files\StepMania
2009-05-19 15:41 . 2007-01-09 07:20 -------- d-----w c:\documents and settings\Crotch Ninja\Application Data\Xfire
2009-05-19 05:03 . 2007-11-03 11:10 107888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-05-18 01:37 . 2007-09-16 14:22 -------- d-----w c:\program files\Starcraft
2009-05-16 22:01 . 2007-01-09 07:20 -------- d-s---w c:\program files\Xfire
2009-05-09 00:48 . 2008-12-11 05:26 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-09 00:47 . 2008-12-11 05:26 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-06 15:33 . 2009-01-27 06:50 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-05 00:22 . 2009-04-02 20:37 -------- d-----w c:\program files\Uplink Demo
2009-04-30 04:38 . 2007-09-15 16:58 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-19 23:26 . 2009-04-19 22:49 -------- d-----w c:\program files\Braid
2009-04-19 22:21 . 2009-04-19 22:20 -------- d-----w c:\documents and settings\Crotch Ninja\Application Data\Braid
2009-04-19 16:24 . 2009-04-19 16:24 -------- d-----w c:\documents and settings\Crotch Ninja\Application Data\Slam Dunk Studios, LLC
2009-04-14 23:11 . 2009-04-14 23:10 -------- d-----w c:\program files\iTunes
2009-04-14 23:11 . 2009-04-14 23:10 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-14 23:10 . 2009-04-14 23:10 -------- d-----w c:\program files\iPod
2009-04-14 23:10 . 2007-09-16 19:21 -------- d-----w c:\program files\Common Files\Apple
2009-04-14 22:37 . 2009-04-14 22:37 75048 ----a-w c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-06 19:22 . 2009-04-06 19:22 -------- d-----w c:\documents and settings\Crotch Ninja\Application Data\Broken Rules
2009-04-03 07:15 . 2009-04-03 07:15 57344 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-3513b493-n\Decora-SSE.dll
2009-04-03 07:15 . 2009-04-03 07:15 24064 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-37379758-n\Decora-D3D.dll
2009-04-03 07:15 . 2009-04-03 07:15 315392 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-3f618b7b-n\jogl.dll
2009-04-03 07:15 . 2009-04-03 07:15 20480 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-3f618b7b-n\jogl_awt.dll
2009-04-03 07:15 . 2009-04-03 07:15 114688 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-3f618b7b-n\jogl_cg.dll
2009-04-03 07:15 . 2009-04-03 07:15 348160 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-5a0d7702-n\msvcr71.dll
2009-04-03 07:15 . 2009-04-03 07:15 20480 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-107a190a-n\gluegen-rt.dll
2009-04-03 07:15 . 2009-04-03 07:15 499712 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-5a0d7702-n\msvcp71.dll
2009-04-03 07:15 . 2009-04-03 07:15 499712 ----a-w c:\documents and settings\Lonnie\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-5a0d7702-n\jmc.dll
2009-04-03 00:35 . 2009-04-03 00:35 -------- d-----w c:\program files\Mplayer
2009-04-03 00:33 . 2009-04-03 00:33 -------- d-----w c:\program files\Quake III Arena
2009-03-25 18:47 . 2009-03-25 18:47 57344 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-2a4c6e1a-n\Decora-SSE.dll
2009-03-25 18:47 . 2009-03-25 18:47 499712 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-7faa6ddc-n\msvcp71.dll
2009-03-25 18:47 . 2009-03-25 18:47 499712 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-7faa6ddc-n\jmc.dll
2009-03-25 18:47 . 2009-03-25 18:47 348160 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-7faa6ddc-n\msvcr71.dll
2009-03-25 18:47 . 2009-03-25 18:47 24064 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-35f05e17-n\Decora-D3D.dll
2009-03-24 20:39 . 2007-10-13 06:55 -------- d-----w c:\program files\Guild Wars
2009-03-24 18:46 . 2008-10-12 09:14 -------- d-----w c:\program files\Defcon
2009-03-24 07:51 . 2007-09-22 09:26 -------- d-----w c:\program files\Electronic Arts
2009-03-19 21:32 . 2009-03-19 21:32 23400 ----a-w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 21:32 . 2008-01-29 19:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 15:42 . 2009-04-15 05:06 217088 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Mozilla\Firefox\Profiles\7ls61urz.default\extensions\NPDyyno@dyyno.com\Plugins\npDyyno.dll
2009-03-15 22:21 . 2009-03-15 22:21 57344 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\37\3976f065-6d66c288-n\Decora-SSE.dll
2009-03-15 22:21 . 2009-03-15 22:21 24064 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\37\2c4a0065-7f8741d4-n\Decora-D3D.dll
2009-03-15 22:21 . 2009-03-15 22:21 315392 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-40db31d2-n\jogl.dll
2009-03-15 22:21 . 2009-03-15 22:21 20480 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-40db31d2-n\jogl_awt.dll
2009-03-15 22:21 . 2009-03-15 22:21 114688 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-40db31d2-n\jogl_cg.dll
2009-03-15 22:21 . 2009-03-15 22:21 20480 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-125f9465-n\gluegen-rt.dll
2009-03-15 22:21 . 2009-03-15 22:21 503808 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-2c316326-n\msvcp71.dll
2009-03-15 22:21 . 2009-03-15 22:21 499712 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-2c316326-n\jmc.dll
2009-03-15 22:21 . 2009-03-15 22:21 348160 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-2c316326-n\msvcr71.dll
2009-03-15 22:21 . 2008-11-24 06:23 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-15 22:20 . 2009-03-15 22:20 152576 ----a-w c:\documents and settings\Crotch Ninja\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-03-06 14:22 . 2004-10-08 12:01 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-06 06:59 . 2009-03-22 21:56 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-06 06:59 . 2007-11-09 01:53 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-03 00:18 . 2004-10-08 12:01 826368 ----a-w c:\windows\system32\wininet.dll
2009-03-01 00:26 . 2009-03-01 00:26 15360 ----a-r c:\documents and settings\Crotch Ninja\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E910.exe
2009-03-01 00:26 . 2009-03-01 00:26 11264 ----a-r c:\documents and settings\Crotch Ninja\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E96.exe
2009-02-24 20:16 . 2008-08-19 07:45 664 ----a-w c:\windows\system32\d3d9caps.dat
2008-12-11 04:26 . 2007-09-09 19:57 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-11 04:26 . 2007-09-09 19:57 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-11 04:26 . 2007-09-09 19:57 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-11 04:26 . 2007-09-09 19:57 46720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-11 04:26 . 2007-09-09 19:57 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\Crotch Ninja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-24 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-08-14 352256]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-09-26 872448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2007-04-03 753664]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 155648]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"Lycosa"="c:\program files\Razer\Lycosa\razerhid.exe" [2007-11-20 147456]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-17 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-15 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-10-08 87039]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\killrno0b\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"c:\\Program Files\\Steam\\SteamApps\\killrno0b\\garrysmod\\hl2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Soldat\\Soldat.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Steam\\SteamApps\\killrno0b\\diprip warm up\\hl2.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Steam\\SteamApps\\common\\need for speed undercover\\nfs.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\painkiller gold edition\\Bin\\Painkiller.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\trials 2 second edition\\launcher.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\monster trucks nitro\\MonsterTrucksNitro.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\painkiller gold edition\\Bin\\Editor\\PainEditor.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=
"c:\\Program Files\\THQ\\Dawn of War\\W40kWA.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\peggle deluxe\\Peggle.exe"=
"c:\\Documents and Settings\\Crotch Ninja\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\battleforge\\Bootstrapper.exe"=
"DEFGÎ,‘|-‘|q-‘|x-‘|>"= DEFGÎ,‘|-‘|q-‘|x-‘|>:Nod32 Runtime
"c:\\Program Files\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 ahci8086;ahci8086;c:\windows\system32\drivers\ahci8086.sys [7/19/2006 7:34 PM 119808]
R2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [3/22/2007 9:04 PM 9728]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [10/14/2008 2:28 PM 22784]
R3 LycoFltr;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys [10/14/2008 2:48 PM 21888]
S2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" --> c:\program files\Windows Defender\MsMpEng.exe [?]
S3 athena;athena;c:\windows\system32\DRIVERS\athena.sys --> c:\windows\system32\DRIVERS\athena.sys [?]
S3 physX32;physX32;c:\windows\system32\drivers\physX32.sys [12/5/2007 10:19 PM 120320]
.
Contents of the 'Scheduled Tasks' folder

2009-05-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 19:34]

2009-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1383384898-1343024091-1004.job
- c:\documents and settings\Crotch Ninja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-24 05:23]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AGEIA PhysX SysTray - c:\program files\AGEIA Technologies\bin\TrayIcon.exe
HKCU-Run-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
mWindow Title = Microsoft Internet Explorer provided by CenturyTel
uInternet Settings,ProxyOverride = *.local
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Crotch Ninja\Application Data\Mozilla\Firefox\Profiles\7ls61urz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\Crotch Ninja\Application Data\Mozilla\Firefox\Profiles\7ls61urz.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\documents and settings\Crotch Ninja\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Dyyno\Dyyno Player\npvlc.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 5\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-22 14:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-484763869-1383384898-1343024091-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bf,c4,84,50,4e,7e,ed,f4,85,42,d8,4f,83,a2,06,58,dc,f5,8d,12,8b,58,fa,
2b,8c,e6,72,2c,66,b7,ab,01,24,b2,5c,86,27,17,84,9e,6f,3b,62,c7,0d,0f,a2,75,\
"??"=hex:21,0d,ec,15,3a,1d,ea,d3,17,7f,1c,7b,a9,6f,9b,50

[HKEY_USERS\S-1-5-21-484763869-1383384898-1343024091-1004\Software\SecuROM\License information*]
"datasecu"=hex:e9,d4,e2,73,57,13,66,20,34,f2,b0,d8,d7,4e,8b,7f,a5,f0,c2,fc,ad,
94,b2,86,36,f5,6b,9c,00,6c,34,31,f8,0d,62,cc,69,86,ee,62,e1,02,71,ab,d1,71,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
Completion time: 2009-05-22 14:11
ComboFix-quarantined-files.txt 2009-05-22 19:10

Pre-Run: 16,688,902,144 bytes free
Post-Run: 18,581,364,736 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /usepmtimer /NoExecute=OptIn

996 --- E O F --- 2009-05-05 01:17


Report •

#16
May 22, 2009 at 12:23:25
Just attach the file to rapidshare.com and paste the link please.

--------------------------------------------
To Private Message me Click Here


Report •

#17
May 22, 2009 at 12:31:09
Follow these steps next in order numbered:

1) Run this script in AVZ:


begin
CreateQurantineArchive('c:\quarantine.zip');
end.

2) A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/ Then, Private Message me the Download link to the uploaded file.

3) Lastly, uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. Or Start > run > type 123 /u > ok.

4) Also, if you use Windows System restore, turn it off > reboot.

Download and run Kaspersky AVP tool:

http://devbuilds.kaspersky-labs.com...

Once you download and start the tool select all the objects/places to be scanned and hit Scan. Fix what it detects and at the end of the scan post screen shot/log of detected items that is fixed and which it could not fix.

Then turn system restore back on, if you wish; this to remove malware from system volume information files. How to turn it off/on: http://support.kaspersky.com/faq/?q... Let me know if your antivirus still detects anything and is unable to get rid of it.

--------------------------------------------
To Private Message me Click Here


Report •

#18
May 28, 2009 at 10:39:12
Is your original problems solved? Your malware free. Scan your computer with malwarebyte/superantispyware fix what it detects post a scan log at the end.

-------------------------------------------------


Report •

#19
June 2, 2009 at 15:51:26
I am currently rescanning to find any malicious software but another problem has occurred. I'm experiencing severe latency on my internet connection. It is not the connection itself because my brothers computer across the hall is functioning just fine with internet. It is taking from 30 seconds to a minute to visually load the page almost as bad as a dial up connection if not worse and I am running on Century Tel 756kb line. I'll post a log if my malware and anti-spyware programs find anything. Any other suggestions that could fix my specific problem other than just scanning?

Report •

#20
June 5, 2009 at 14:23:33
Follow Response Number 18.

-------------------------------------------------


Report •

#21
June 6, 2009 at 13:29:11
Problem solved. Thank you.

Report •

#22
June 6, 2009 at 13:43:19
How did you fix it?

-------------------------------------------------


Report •


Ask Question