Troj/Virtum-Gen Virus [RESOLVED]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Troj/Virtum-Gen Virus [RESOLVED], Found on my computer but unable to get rid of it

Options

socceraddict07 View Member Profile	Feb 10 2008, 07:24 PM Post #1
New Member Posts: 5 OS: Windows Vista	I have followed all the instructions on the Hijack This prerequsite post but my computer still seems to be affected by the Troj/Virtum-Gen Virus. It is slower than it was before, unwanted popups often appear, and occasionally a page will be flooded with chinese/japanese characters over top of the text. Following is my Hijackthis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:22:11 PM, on 2/10/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\TpShocks.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Windows\tsnp2std.exe C:\Windows\vsnp2std.exe C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\rundll32.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Windows\system32\taskeng.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Windows\system32\taskeng.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Dembo\Desktop\HiJackThis_v2.exe C:\Windows\explorer.exe C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://my.wm.edu/cp/home/displaylogin R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lenovo.com/welcome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [TPFNF7] "C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe" /r O4 - HKLM\..\Run: [TPHOTKEY] "C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe" O4 - HKLM\..\Run: [TPKMAPHELPER] "C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" -helper O4 - HKLM\..\Run: [tsnp2std] C:\Windows\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\Windows\vsnp2std.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Dembo\AppData\Local\Temp\pmkjg.dll,#1 O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Dembo\AppData\Local\Temp\mlllm.dll,c O4 - HKCU\..\Run: [a2b250f0] rundll32.exe "C:\Users\Dembo\AppData\Local\Temp\fthiydsm.dll",b O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\Windows\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe O23 - Service: On Screen Display (TPHKSVC) - Unknown owner - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10537 bytes I will also include an uninstall list as well: Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Common File Installer Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Flash CS3 Adobe Flash CS3 Professional Adobe Flash Player 9 ActiveX Adobe Flash Player 9 Plugin Adobe Flash Player ActiveX Adobe Flash Video Encoder Adobe Help Center 2.1 Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop Elements 5.0 Adobe Premiere Elements 3.0 Adobe Premiere Elements 3.0 Adobe Premiere Elements 3.0 Templates Adobe Reader 8.1.1 Adobe Setup Adobe Shockwave Player Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin AFPL Ghostscript 8.50 AFPL Ghostscript Fonts Apple Mobile Device Support Apple Software Update AVG Anti-Spyware 7.5 Before You Know It 3.6 Bonjour Core for Windows CambridgeSoft Activation Client CambridgeSoft ChemBioDraw Ultra 11.0 CambridgeSoft ENotebook 11.0 F-Secure SSH Client HijackThis 2.0.2 HP Driver Diagnostics Intel® Graphics Media Accelerator Driver iTunes J2SE Runtime Environment 5.0 Update 11 Java™ SE Runtime Environment 6 Learn to Play Magic Lenovo Registration Lenovo System Interface Driver Magic Online Magic Workstation 0.94f MATLAB R2007a Memory Stick File Rescue MestReC 4.7.0 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB929729) Microsoft Office Excel MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Standard 2007 Microsoft Office Standard 2007 Microsoft Office Word MUI (English) 2007 Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (CSSQL05) Microsoft SQL Server 2005 Tools Express Edition Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (2.0.0.6) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MTG GamePack for Magic Workstation On Screen Display PC-Doctor 5 for Windows PDF Settings PDF Writer Picasa 2 Presentation Director QuickTime RealPlayer Registry patch for Windows Vista USB S3 PM Enablement Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista Rhapsody Player Engine Ruckus Player Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Security Update for Excel 2007 (KB936509) Security Update for Office 2007 (KB934062) Security Update for Office 2007 (KB936514) Security Update for the 2007 Microsoft Office System (KB936960) Shadow of Legend Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002) Sophos Anti-Virus Sophos AutoUpdate SoundMAX Spelling Dictionaries Support For Adobe Reader 8 Spy Sweeper Spybot - Search & Destroy SSH Secure Shell Startup Control Panel SUPERAntiSpyware Free Edition Texas Instruments PCIxx21/x515/xx12 drivers. ThinkPad Bluetooth with Enhanced Data Rate Software 6.0.1.3500 ThinkPad FullScreen Magnifier ThinkPad Keyboard Customizer Utility ThinkPad Mobility Center Customization ThinkPad Modem ThinkPad Power Management Driver ThinkPad Power Manager ThinkPad UltraNav Driver ThinkPad UltraNav Utility ThinkVantage Active Protection System ThinkVantage Technologies Welcome Message Update for Office 2007 (KB932080) Update for Office 2007 (KB934391) Update for Office 2007 (KB934393) Update for Outlook 2007 (KB937608) Update for Outlook 2007 Junk Email Filter (kb943597) Update for Word 2007 (KB934173) USB2.0 PC Camera (SN9C201&202) Ventrilo Client VitalSource Bookshelf vitalsource KEY 3 Wallpapers Windows Media Player Firefox Plugin WinZip World of Warcraft X-Win32 7.1

kahdah View Member Profile	Feb 10 2008, 07:30 PM Post #2
GeekU Teacher Posts: 13,543 From: Florida OS: Windows xp,Vista business	Hello socceraddict07 Welcome to G2Go. =============== Please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

kahdah View Member Profile	Feb 10 2008, 08:05 PM Post #4
GeekU Teacher Posts: 13,543 From: Florida OS: Windows xp,Vista business	Please download the OTMoveIt2 by OldTimer. Save it to your desktop. Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator") Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE C:\Users\Dembo\AppData\Local\Temp\pmkjg.dll C:\Users\Dembo\AppData\Local\Temp\mlllm.dll C:\Users\Dembo\AppData\Local\Temp\fthiydsm.dll HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\a2b250f0 Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste. Click the red Moveit! button. A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply. Close OTMoveIt2 If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. ======================================= After that � double-click the Superantispyware icon on your desktop to run it. It will ask if you want to update the program definitions, click Yes. Under Configuration and Preferences, click the Preferences button. Click the Scanning Control tab. Under Scanner Options make sure the following are checked: Close browsers before scanning Scan for tracking cookies Scan for Alternate Data streams Terminate memory threats before quarantining. Please leave the others unchecked. Click the Close button to leave the control center screen. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.* Then run Superantispyware. Double click on the icon to start Superantispyware. On the main screen, under Scan for Harmful Software click Scan your computer. On the left check C:\Fixed Drive. On the right, under Complete Scan, choose Perform Complete Scan. Click Next to start the scan. Please be patient while it scans your computer. After the scan is complete a summary box will appear. Click OK. Make sure everything in the white box has a check next to it, then click Next. It will quarantine what it found and if it asks if you want to reboot, click Yes. 1. To retrieve the removal information for me please do the following: 2. After reboot, double-click the SUPERAntispyware icon on your desktop. 3. Click Preferences. Click the Statistics/Logs tab. 4. Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. 5. It will open in your default text editor (such as Notepad/Wordpad). 6. Please highlight everything in the notepad, then right-click and choose copy. 7. Click close and close again to exit the program. Save the log information. If needed (still infected) paste this info along with your HijackThis log and the OT Moveit 2 log.

socceraddict07 View Member Profile	Feb 10 2008, 11:07 PM Post #5
New Member Posts: 5 OS: Windows Vista	Thanks a lot, everything seems to be working fine now. I'm running one more scan just to make sure, but here were the results from the scans you asked me to perform. I believe it may have been from the keygen things; my roommate had borrowed my computer just a little while before things went bad. [Custom Input] < C:\Users\Dembo\AppData\Local\Temp\pmkjg.dll > File/Folder C:\Users\Dembo\AppData\Local\Temp\pmkjg.dll not found. < C:\Users\Dembo\AppData\Local\Temp\mlllm.dll > File/Folder C:\Users\Dembo\AppData\Local\Temp\mlllm.dll not found. < C:\Users\Dembo\AppData\Local\Temp\fthiydsm.dll > File/Folder C:\Users\Dembo\AppData\Local\Temp\fthiydsm.dll not found. < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer > Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer deleted successfully. < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds > Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cmds deleted successfully. < HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\a2b250f0 > Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\a2b250f0 deleted successfully. OTMoveIt2 v1.0.19 log created on 02102008_211731 SUPERAntiSpyware Scan Log Generated 02/10/2008 at 11:48 PM Application Version : 3.6.1000 Core Rules Database Version : 3399 Trace Rules Database Version: 1391 Scan type : Complete Scan Total Scan Time : 02:20:05 Memory items scanned : 300 Memory threats detected : 0 Registry items scanned : 7939 Registry threats detected : 0 File items scanned : 198570 File threats detected : 84 Adware.Tracking Cookie C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@2.go.globaladsales[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@208.122.40[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@a.findarticles[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ad.uk.tangozebra[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ad.zanox[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adfarm1.adition[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adinterax[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.addesktop[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.ak.facebook[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.cnn[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.expotv[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.gmodules[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.gmodules[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.newgrounds[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.revsci[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.statonly[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.us.e-planning[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.zam[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adserver.easyad[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adserver.ens-news[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adultadworld[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@advertising[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ameriprisestats[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@anad.tacoda[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@angleinteractive.directtrack[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@apmebf[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@atdmt[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@azjmp[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@bizadverts[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@bs.serving-sys[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@cgm.adbureau[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@clicksor[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@clicktorrent[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@collective-media[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@crackserialkeygen[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@creative.adsrevenue[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@directtrack[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@doubleclick[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@eas.apm.emediate[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ecnext.advertserve[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ehg-wizardsofthecoast.hitbox[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@eyewonder[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@fastclick[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@findarticles[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@gcc-00.googleadservices[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@hmt.connexpromotions[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@interclick[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@keywordmax[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@linksynergy[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@media.mtvnservices[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@media.southparkstudios[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@media6degrees[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@mediafire[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@pandasoftware.112.2o7[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@partner2profit[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@path.pureadstracking[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@pornhub[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@precisionclick[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@qnsr[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@rb4.worldsex[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@richmedia.yahoo[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@roiservice[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@sales.liveperson[3].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@sales.liveperson[4].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@servedby.adxpower[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@servedby.adxpower[3].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@server.cpmstar[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@serving-sys[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@specificclick[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@stats.file2upload[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@stats.gamestop[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@statsgod[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@trackfees[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@tribalfusion[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@usenext[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.3dstats[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.googleadservices[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.googleadservices[3].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.keygen[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.pornhub[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.pornhub[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www.trackfees[2].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@www6.addfreestats[1].txt C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@zedo[2].txt Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:57:55 PM, on 2/10/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\TpShocks.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Windows\tsnp2std.exe C:\Windows\vsnp2std.exe C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://my.wm.edu/cp/home/displaylogin R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lenovo.com/welcome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [TPFNF7] "C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe" /r O4 - HKLM\..\Run: [TPHOTKEY] "C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe" O4 - HKLM\..\Run: [TPKMAPHELPER] "C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" -helper O4 - HKLM\..\Run: [tsnp2std] C:\Windows\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\Windows\vsnp2std.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Dembo\AppData\Local\Temp\pmkjg.dll,#1 O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Dembo\AppData\Local\Temp\mlllm.dll,c O4 - HKCU\..\Run: [a2b250f0] rundll32.exe "C:\Users\Dembo\AppData\Local\Temp\fthiydsm.dll",b O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\Windows\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe O23 - Service: On Screen Display (TPHKSVC) - Unknown owner - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10312 bytes

kahdah View Member Profile	Feb 11 2008, 06:48 PM Post #6
GeekU Teacher Posts: 13,543 From: Florida OS: Windows xp,Vista business	Please re-open Hijackthis and click on "Do a system scan only" Then place a check mark next to these entries below: O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Dembo\AppData\Local\Temp\pmkjg.dll,#1 O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Dembo\AppData\Local\Temp\mlllm.dll,c O4 - HKCU\..\Run: [a2b250f0] rundll32.exe "C:\Users\Dembo\AppData\Local\Temp\fthiydsm.dll",b Now click on Fix Checked and then close Hijackthis. ==================================================== After that Please go HERE to run Panda's TotalScan Select the bubble for Full scan It will start downloading the files it requires for the scan (Note: It may take a couple of minutes) Then the scan will begin When the scan completes, click the Save button on the right of Scan details Save it to a convenient location. Post the contents of the TotalScan report and a new Hijackthis log as well.

socceraddict07 View Member Profile	Feb 11 2008, 10:32 PM Post #7
New Member Posts: 5 OS: Windows Vista	TotalScan: ;***************************************************************************** ***************************************************************************** *************** ANALYSIS: 2008-02-11 23:27:35 PROTECTIONS: 2 MALWARE: 16 SUSPECTS: 0 ;*************************************************************************** ***************************************************************************** ***************** PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== Sophos Anti-Virus <NULL> No No Spy Sweeper with AntiVirus 5.5.1.3356 Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@trafficmp[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@atdmt[2].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@fastclick[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@tribalfusion[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@mediaplex[2].txt 00147036 Cookie/Adverserve TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adverserve[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@com[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@advertising[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@media.adrevolver[1].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@ads.pointroll[1].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@overture[1].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@questionmarket[1].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@adrevolver[1].txt 02887528 Cookie/AdvancedCleaner TrackingCookie No 0 Yes No C:\Users\Dembo\AppData\Roaming\Microsoft\Windows\Cookies\Low\dembo@advancedcleaner[2].txt 02896806 Spyware/Virtumonde Spyware No 1 Yes No C:\Deckard\System Scanner\backup\Users\Dembo\AppData\Local\Temp\wjrbalrp.dll ;=============================================================================== ================================================================================= =================== SUSPECTS Location ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:29:30 PM, on 2/11/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\TpShocks.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Windows\tsnp2std.exe C:\Windows\vsnp2std.exe C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://my.wm.edu/cp/home/displaylogin R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lenovo.com/welcome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [TPFNF7] "C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe" /r O4 - HKLM\..\Run: [TPHOTKEY] "C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe" O4 - HKLM\..\Run: [TPKMAPHELPER] "C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" -helper O4 - HKLM\..\Run: [tsnp2std] C:\Windows\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\Windows\vsnp2std.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe" O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/cabs/ascstubie.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\Windows\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe O23 - Service: On Screen Display (TPHKSVC) - Unknown owner - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10329 bytes

kahdah View Member Profile	Feb 11 2008, 10:42 PM Post #8
GeekU Teacher Posts: 13,543 From: Florida OS: Windows xp,Vista business	Looks good. Let's remove what we used. Make sure you have an Internet Connection. Double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator") Click on the CleanUp! button A list of tool components used in the Cleanup of malware will be downloaded. If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so. Click Yes to begin the Cleanup process and remove these components, including this application. You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes. ============== After that delete your cookies and after that Your log is clean. To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein ->Here

socceraddict07 View Member Profile	Feb 11 2008, 10:54 PM Post #9
New Member Posts: 5 OS: Windows Vista	Thanks a lot, everything seems to be running smoothly. I will make sure to keep this forum in mind for future reference.

kahdah View Member Profile	Feb 12 2008, 03:01 AM Post #10
GeekU Teacher Posts: 13,543 From: Florida OS: Windows xp,Vista business	You are welcome Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If your the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

kahdah View Member Profile	Feb 12 2008, 03:01 AM Post #11
GeekU Teacher Posts: 13,543 From: Florida OS: Windows xp,Vista business	Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Need Help with Permanent Removal of Virtum-Gen Virus [RESOLVED] 12	27 / 8,390	7th November 2007 - 09:09 PM WezVillag started - last by Stamper19
Virus, Spyware and Trojan Removal Troj/Virtum-Gen virus detected by sophos [RESOLVED] 12	27 / 1,157	2nd October 2008 - 10:04 AM amanda732 started - last by Egwene
Virus, Spyware and Trojan Removal Need help removing Troj/Virtum-Gen virus [RESOLVED]	12 / 1,591	9th December 2008 - 05:05 PM klay44 started - last by Essexboy
Virus, Spyware and Trojan Removal Need help removing Troj/Virtum-Gen Virus [RESOLVED]	3 / 406	9th December 2008 - 10:38 PM bwelty started - last by fenzodahl512