[ryanrevland24]

(highjack this and AWF logs are attached) THANKS FOR ALL YOUR HELP!

AWF WITH OPTION1 is listed below:

Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Mon 02/11/2008
The current time is: 21:34:08.46


bak folders found
~~~~~~~~~~~


Directory of C:\WINDOWS\SYSTEM32\BAK

08/03/2004 11:56 PM 15,360 ctfmon.exe
1 File(s) 15,360 bytes

Directory of C:\PROGRA~1\DIGITA~1\BIN\BAK

10/13/2004 05:24 PM 913,408 DPAgnt.exe
1 File(s) 913,408 bytes

Directory of C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK

10/23/2007 08:57 PM 68,856 GoogleToolbarNotifier.exe
1 File(s) 68,856 bytes

Directory of C:\PROGRA~1\TRENDM~1\INTERN~1\BAK

08/24/2006 10:25 PM 3,112,960 pccguide.exe
1 File(s) 3,112,960 bytes

Directory of C:\PROGRA~1\TRENDM~1\INTERN~1\TMAS_OE\BAK

08/18/2006 12:06 PM 315,392 TMAS_OEMon.exe
1 File(s) 315,392 bytes

Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

03/09/2005 03:00 AM 98,304 E_FATIAIA.EXE
1 File(s) 98,304 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

15360 Aug 3 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 Aug 3 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
913408 Oct 13 2004 "C:\Program Files\DigitalPersona\Bin\DPAgnt.exe"
913408 Oct 13 2004 "C:\Program Files\DigitalPersona\Bin\bak\DPAgnt.exe"
52272 Oct 23 2007 "C:\Program Files\Google\googletoolbar1user.exe"
126136 Oct 23 2007 "C:\Program Files\Google\Google Updater\GoogleUpdater.exe"
69632 Nov 13 2007 "C:\Program Files\Google\Google Earth\googleearth.exe"
26694 Jan 17 2008 "C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe"
138680 Oct 23 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
126136 Oct 23 2007 "C:\Program Files\Google\Google Updater\2.2.969.23408\GoogleUpdaterRestartManager.exe"
68856 Oct 23 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
3112960 Aug 24 2006 "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
3112960 Aug 24 2006 "C:\Program Files\Trend Micro\Internet Security 2007\bak\pccguide.exe"
471040 Aug 18 2006 "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEImp.exe"
483328 Aug 18 2006 "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OL\TMAS_OLImp.exe"
315392 Aug 18 2006 "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\bak\TMAS_OEMon.exe"
14860 Feb 6 2008 "C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAIA.EXE"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_photo_r2a5c1\E_FATIAIA.EXE"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\E_FATIAIA.EXE"


end of report

Whats next please (step by step)



Thanks so much for all your help!!

Attached Files

•  hijackthis.txt   7.42KB   75 downloads
•  awf.txt   2.87KB   120 downloads

Edited by ryanrevland24, 12 February 2008 - 04:46 PM.
removed e-mail address to avoid spam