Getting fustrated [RESOLVED]
Started by
Noitora
, Feb 19 2008 07:03 PM
-
This topic is locked
#16
Posted 23 February 2008 - 06:57 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
#17
Posted 25 February 2008 - 02:43 AM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
ComboFix 08-02-20.2 - Owner 2008-02-25 0:38:01.19 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.602 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\aareqmap.ini
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\bbeeg.ini2
C:\WINDOWS\system32\geebb.dll
C:\WINDOWS\system32\geebb.exe
C:\WINDOWS\system32\meehuvyx.dll
C:\WINDOWS\system32\sohnwpju.dll
C:\WINDOWS\system32\vwrgqtem.dll
C:\WINDOWS\system32\xyvuheem.ini
.
((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 15:51 . 2008-02-21 12:32 388,608 --a------ C:\WINDOWS\system32\kmd .exe
2008-02-20 15:49 . 2008-02-20 17:48 158,208 --a------ C:\WINDOWS\system32\dllcache\msconfig .exe
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-11 23:57 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 00:05 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 00:33 --------- d-----w C:\Program Files\Warcraft III
2008-02-21 10:46 --------- d-----w C:\Program Files\Windows Live
2008-02-21 10:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-25 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-25 01:56 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 08:31:09 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-21 10:31:14 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 00:40:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 0:42:35
ComboFix-quarantined-files.txt 2008-02-25 08:42:33
ComboFix2.txt 2008-02-22 01:45:15
ComboFix3.txt 2008-02-21 21:06:18
ComboFix4.txt 2008-02-20 23:35:17
ComboFix5.txt 2008-02-20 22:49:49
.
2008-02-15 07:24:30 --- E O F ---
How am I getting geebb.exe back over and over? I keep deleting it constantly
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.602 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\aareqmap.ini
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\bbeeg.ini2
C:\WINDOWS\system32\geebb.dll
C:\WINDOWS\system32\geebb.exe
C:\WINDOWS\system32\meehuvyx.dll
C:\WINDOWS\system32\sohnwpju.dll
C:\WINDOWS\system32\vwrgqtem.dll
C:\WINDOWS\system32\xyvuheem.ini
.
((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 15:51 . 2008-02-21 12:32 388,608 --a------ C:\WINDOWS\system32\kmd .exe
2008-02-20 15:49 . 2008-02-20 17:48 158,208 --a------ C:\WINDOWS\system32\dllcache\msconfig .exe
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-11 23:57 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 00:05 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 00:33 --------- d-----w C:\Program Files\Warcraft III
2008-02-21 10:46 --------- d-----w C:\Program Files\Windows Live
2008-02-21 10:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-25 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-25 01:56 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre> ----a-w 50,528 2008-02-25 07:54:28 C:\Program Files\AIM6\aim6 .exe ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe ----a-w 388,608 2008-02-21 20:32:40 C:\WINDOWS\system32\kmd .exe ----a-w 158,208 2008-02-21 01:48:35 C:\WINDOWS\system32\dllcache\msconfig .exe </pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 08:31:09 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-21 10:31:14 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 00:40:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 0:42:35
ComboFix-quarantined-files.txt 2008-02-25 08:42:33
ComboFix2.txt 2008-02-22 01:45:15
ComboFix3.txt 2008-02-21 21:06:18
ComboFix4.txt 2008-02-20 23:35:17
ComboFix5.txt 2008-02-20 22:49:49
.
2008-02-15 07:24:30 --- E O F ---
How am I getting geebb.exe back over and over? I keep deleting it constantly
Edited by Noitora, 25 February 2008 - 02:44 AM.
#18
Posted 25 February 2008 - 08:39 AM
Rorschach112
-
- Retired Staff
-
- 47,710 posts
Ralphie
Hello
1. Close any open browsers.
2. Open notepad and copy/paste the text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Please do an online scan with Kaspersky WebScanner
Click on Kaspersky Online Scanner and click Accept
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
1. Close any open browsers.
2. Open notepad and copy/paste the text in the quotebox below into it:
File:: ----a-w 50,528 2008-02-25 07:54:28 C:\Program Files\AIM6\aim6 .exe ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe ----a-w 388,608 2008-02-21 20:32:40 C:\WINDOWS\system32\kmd .exe ----a-w 158,208 2008-02-21 01:48:35 C:\WINDOWS\system32\dllcache\msconfig .exe RenV:: ----a-w 50,528 2008-02-25 07:54:28 C:\Program Files\AIM6\aim6 .exe ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe ----a-w 388,608 2008-02-21 20:32:40 C:\WINDOWS\system32\kmd .exe ----a-w 158,208 2008-02-21 01:48:35 C:\WINDOWS\system32\dllcache\msconfig .exe
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Please do an online scan with Kaspersky WebScanner
Click on Kaspersky Online Scanner and click Accept
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Scan Options:
Scan Mail Bases - Click OK
- Now under select a target to scan:Select My Computer
- This will program will start and scan your system.
- The scan will take a while so be patient and let it run.
- Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
- Save the file to your desktop.
- Copy and paste that information in your next post.
Edited by Rorschach112, 25 February 2008 - 08:40 AM.
#19
Posted 25 February 2008 - 03:02 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
ComboFix 08-02-20.2 - Owner 2008-02-25 12:36:45.20 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.541 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
----a-w 50,528 2008-02-25 07:54:28 C:\Program Files\AIM6\aim6 .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 15:51 . 2008-02-21 12:32 388,608 --a------ C:\WINDOWS\system32\kmd .exe
2008-02-20 15:49 . 2008-02-20 17:48 158,208 --a------ C:\WINDOWS\system32\dllcache\msconfig .exe
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-25 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-25 01:56 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 12:39:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 12:41:14
ComboFix-quarantined-files.txt 2008-02-25 20:41:12
ComboFix2.txt 2008-02-25 08:42:36
ComboFix3.txt 2008-02-22 01:45:15
ComboFix4.txt 2008-02-21 21:06:18
ComboFix5.txt 2008-02-20 23:35:17
.
2008-02-15 07:24:30 --- E O F ---
Ok the other one is next
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.541 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
----a-w 50,528 2008-02-25 07:54:28 C:\Program Files\AIM6\aim6 .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 )))))))))))))))))))))))))))))))
.
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 15:51 . 2008-02-21 12:32 388,608 --a------ C:\WINDOWS\system32\kmd .exe
2008-02-20 15:49 . 2008-02-20 17:48 158,208 --a------ C:\WINDOWS\system32\dllcache\msconfig .exe
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-25 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-25 01:56 --------- d-----w C:\Program Files\Alwil Software
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre> ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe ----a-w 388,608 2008-02-21 20:32:40 C:\WINDOWS\system32\kmd .exe ----a-w 158,208 2008-02-21 01:48:35 C:\WINDOWS\system32\dllcache\msconfig .exe </pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 12:39:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 12:41:14
ComboFix-quarantined-files.txt 2008-02-25 20:41:12
ComboFix2.txt 2008-02-25 08:42:36
ComboFix3.txt 2008-02-22 01:45:15
ComboFix4.txt 2008-02-21 21:06:18
ComboFix5.txt 2008-02-20 23:35:17
.
2008-02-15 07:24:30 --- E O F ---
Ok the other one is next
#20
Posted 25 February 2008 - 05:00 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 25, 2008 2:59:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/02/2008
Kaspersky Anti-Virus database records: 580494
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\
I:\
J:\
K:\
Scan Statistics:
Total number of scanned objects: 137896
Number of viruses found: 13
Number of infected objects: 264
Number of suspicious objects: 0
Duration of the scan process: 01:55:37
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Desktop\[4][email protected]/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\Owner\Desktop\[4][email protected] ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\My Backup -- 07-04-02 0547PM\WINDOWS\system32\VB6STKIT.DLL Object is locked skipped
C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: Virus.Win32.Trats.d skipped
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\AIM6\aim6 .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\AIM6\aim6.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Veoh Networks\Veoh\VeohClient.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr .Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr .Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr.Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\birukjre.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\bmvudvbn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dllcache\msconfig .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\doekppdk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gadgoiue.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebb.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hxdgdfwr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kvjnjusr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mfojmken.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nciicxhm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\oepycktq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\podagohq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX1B.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX4.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX42.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX5.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sbgndwip.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tpvqcedp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tvnykkvg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtmuwjyy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vwrgqtem.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wnrryxay.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xbqkekxl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xkaeqrqg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_140715.18.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_140715.18.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-20_155545.70.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_155545.70.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-21_130018.20.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-21_130018.20.zip ZIP: infected - 1 skipped
C:\RECYCLER\S-1-5-21-1813564023-1912572731-1404579102-1007\Dc1.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090407.exe Infected: Trojan-Downloader.Win32.Agent.hvx skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090447.exe Infected: Trojan-Downloader.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090456.exe Infected: not-a-virus:AdWare.Win32.Agent.aev skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090461.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gs skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090468.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090469.exe Infected: not-a-virus:AdWare.Win32.Agent.adm skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090471.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090471.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090472.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP132\A0092700.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP132\A0092700.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP136\A0093101.exe Infected: Trojan-Downloader.Win32.Agent.hvx skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP139\A0097114.exe Infected: not-a-virus:Downloader.Win32.AdvancedCleaner.c skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0099357.dll Infected: not-a-virus:FraudTool.Win32.DeusCleaner.b skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0099358.exe Infected: not-a-virus:FraudTool.Win32.DeusCleaner.b skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0101336.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102347.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102349.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102350.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103356.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103357.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103358.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103359.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103384.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103385.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103392.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103394.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103412.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103573.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103574.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103580.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104566.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104570.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104572.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104582.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104586.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104588.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105584.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105586.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105594.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105596.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105608.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105610.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105624.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105625.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105629.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105631.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105643.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105645.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105691.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105743.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105744.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105745.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105775.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106768.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106770.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106771.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106777.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106782.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106783.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106784.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106785.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106786.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106787.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106789.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106790.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106791.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106811.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106819.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106824.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106834.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107842.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107843.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107846.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107856.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107857.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107861.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107863.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107864.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107865.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107897.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107903.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107904.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107914.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107916.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107919.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107920.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107940.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107959.exe Infected: Trojan-Downloader.Win32.Agent.auv skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107960.exe Infected: Trojan-Downloader.Win32.Agent.auv skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107975.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107978.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108002.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108005.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108007.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108019.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108021.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108028.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108030.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108031.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108043.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108044.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108045.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108046.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108047.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108048.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108049.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108050.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108051.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108052.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108053.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108054.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108055.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108056.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108057.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108058.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108060.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108061.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108062.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108063.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108067.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108073.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108074.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108199.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108200.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0109154.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109159.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109160.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110424.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110425.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110476.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110478.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110485.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110486.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110487.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110492.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110515.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110516.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110521.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110630.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP152\A0110649.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP152\A0110693.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110730.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110731.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110734.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP154\A0110880.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110901.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110912.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110913.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110918.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110931.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110974.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111027.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111028.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111034.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111055.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111057.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111068.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111069.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111070.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111071.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111077.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115170.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115173.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115184.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115186.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115187.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115229.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115230.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115231.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115232.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115235.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115240.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP163\A0115384.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116401.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116402.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116406.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116418.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116419.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116420.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP167\change.log Object is locked skipped
C:\VundoFix Backups\aqfvvwfy.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ctcydkqq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\frlscxtd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\gautpxrv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\geebb.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\geebb.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\ghsdlqgy.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\gqkflxqv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ihseygtq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\jkkhhif.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\kjjmqsfj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\kmd.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\leiwjhve.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\MSConfig.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\nmjhrsst.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\nwiyxdtu.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\otlcuxnk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\pgpgopkk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\qfnwxcba.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\sskqosbc.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\sstqq.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\tpvmewey.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\wlwlyfvd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\xgiisrax.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\yaaaxfgt.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ymrlpohi.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\yuyeuutv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem with SmartCP.txt Object is locked skipped
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp Infected: Virus.Win32.Trats.d skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{8819B2E5-2504-4F6E-9C7C-32B19344FC7E}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{01A2EF39-2FCE-47CD-8A9F-117F4E17E210}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP167\change.log Object is locked skipped
Scan process completed.
KASPERSKY ONLINE SCANNER REPORT
Monday, February 25, 2008 2:59:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/02/2008
Kaspersky Anti-Virus database records: 580494
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\
I:\
J:\
K:\
Scan Statistics:
Total number of scanned objects: 137896
Number of viruses found: 13
Number of infected objects: 264
Number of suspicious objects: 0
Duration of the scan process: 01:55:37
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Desktop\[4][email protected]/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\Owner\Desktop\[4][email protected] ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\My Backup -- 07-04-02 0547PM\WINDOWS\system32\VB6STKIT.DLL Object is locked skipped
C:\Program Files\Common Files\Real\Update_OB\realsched.exe Infected: Virus.Win32.Trats.d skipped
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\AIM6\aim6 .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\AIM6\aim6.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Veoh Networks\Veoh\VeohClient.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr .Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr .Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\Program Files\Windows Live\Messenger\MsnMsgr.Exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\birukjre.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\bmvudvbn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dllcache\msconfig .exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\doekppdk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gadgoiue.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\geebb.exe.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\hxdgdfwr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kvjnjusr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mfojmken.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nciicxhm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\oepycktq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\podagohq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX1B.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX4.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX42.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\RCX5.tmp.vir Infected: Virus.Win32.Trats.d skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sbgndwip.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tpvqcedp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tvnykkvg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vtmuwjyy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vwrgqtem.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wnrryxay.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xbqkekxl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xkaeqrqg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_140715.18.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_140715.18.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-20_155545.70.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-20_155545.70.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-02-21_130018.20.zip/geebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-02-21_130018.20.zip ZIP: infected - 1 skipped
C:\RECYCLER\S-1-5-21-1813564023-1912572731-1404579102-1007\Dc1.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090407.exe Infected: Trojan-Downloader.Win32.Agent.hvx skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090447.exe Infected: Trojan-Downloader.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090456.exe Infected: not-a-virus:AdWare.Win32.Agent.aev skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090461.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gs skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090468.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090469.exe Infected: not-a-virus:AdWare.Win32.Agent.adm skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090471.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090471.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP131\A0090472.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP132\A0092700.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP132\A0092700.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP136\A0093101.exe Infected: Trojan-Downloader.Win32.Agent.hvx skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP139\A0097114.exe Infected: not-a-virus:Downloader.Win32.AdvancedCleaner.c skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0099357.dll Infected: not-a-virus:FraudTool.Win32.DeusCleaner.b skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0099358.exe Infected: not-a-virus:FraudTool.Win32.DeusCleaner.b skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0101336.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102347.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102349.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0102350.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103356.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103357.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103358.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103359.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103384.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103385.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103392.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103394.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP141\A0103412.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103573.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103574.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103580.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0103581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104566.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104570.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP143\A0104572.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104581.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104582.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104586.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0104588.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105584.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105586.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105594.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105596.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105608.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105610.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105624.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105625.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105629.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105631.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105643.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105645.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP144\A0105691.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105743.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105744.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105745.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0105775.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106768.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106770.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106771.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106777.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106782.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106783.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106784.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106785.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106786.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106787.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106789.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106790.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106791.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106811.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106819.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106824.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP145\A0106834.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107842.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107843.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107846.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107856.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107857.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107861.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107863.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107864.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107865.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107897.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107903.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107904.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107914.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107916.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107919.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP146\A0107920.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107940.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107959.exe Infected: Trojan-Downloader.Win32.Agent.auv skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107960.exe Infected: Trojan-Downloader.Win32.Agent.auv skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107975.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0107978.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108002.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108005.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108007.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108019.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108021.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108028.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108030.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP147\A0108031.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108043.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108044.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108045.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108046.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108047.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108048.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108049.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108050.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108051.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108052.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108053.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108054.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108055.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108056.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108057.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108058.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108060.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108061.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108062.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108063.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108067.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108073.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108074.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108199.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0108200.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP148\A0109154.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109159.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109160.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0109177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110177.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110424.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP149\A0110425.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110476.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110478.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110485.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110486.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110487.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP150\A0110492.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110515.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110516.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110521.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP151\A0110630.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP152\A0110649.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP152\A0110693.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110730.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110731.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110732.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110733.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP153\A0110734.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP154\A0110880.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110901.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110912.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110913.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP156\A0110918.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110931.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110974.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110983.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP157\A0110985.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111026.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111027.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111028.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP158\A0111034.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111055.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111057.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111068.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111069.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111070.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111071.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP159\A0111077.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115170.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115173.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115184.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115186.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP161\A0115187.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115229.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115230.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115231.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115232.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115235.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP162\A0115240.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP163\A0115384.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116401.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116402.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116406.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116418.exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116419.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP164\A0116420.Exe Infected: Virus.Win32.Trats.d skipped
C:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP167\change.log Object is locked skipped
C:\VundoFix Backups\aqfvvwfy.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ctcydkqq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\frlscxtd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\gautpxrv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\geebb.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\geebb.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\ghsdlqgy.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\gqkflxqv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ihseygtq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\jkkhhif.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\kjjmqsfj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\kmd.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\leiwjhve.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\MSConfig.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\nmjhrsst.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\nwiyxdtu.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\otlcuxnk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\pgpgopkk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\qfnwxcba.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\sskqosbc.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\sstqq.exe.bad Infected: Virus.Win32.Trats.d skipped
C:\VundoFix Backups\tpvmewey.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\wlwlyfvd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\xgiisrax.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\yaaaxfgt.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\ymrlpohi.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\VundoFix Backups\yuyeuutv.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem with SmartCP.txt Object is locked skipped
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp Infected: Virus.Win32.Trats.d skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{8819B2E5-2504-4F6E-9C7C-32B19344FC7E}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{01A2EF39-2FCE-47CD-8A9F-117F4E17E210}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{348DB8EC-73A3-48FB-ADE8-4BD3BBE539B1}\RP167\change.log Object is locked skipped
Scan process completed.
#22
Posted 25 February 2008 - 06:21 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
ComboFix 08-02-20.2 - 2008-02-25 16:14:22.21 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 16:16:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 16:18:27
ComboFix-quarantined-files.txt 2008-02-26 00:18:19
ComboFix2.txt 2008-02-25 20:41:15
ComboFix3.txt 2008-02-25 08:42:36
ComboFix4.txt 2008-02-22 01:45:15
ComboFix5.txt 2008-02-21 21:06:18
.
2008-02-15 07:24:30 --- E O F ---
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre> ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe </pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 16:16:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 16:18:27
ComboFix-quarantined-files.txt 2008-02-26 00:18:19
ComboFix2.txt 2008-02-25 20:41:15
ComboFix3.txt 2008-02-25 08:42:36
ComboFix4.txt 2008-02-22 01:45:15
ComboFix5.txt 2008-02-21 21:06:18
.
2008-02-15 07:24:30 --- E O F ---
#23
Posted 25 February 2008 - 06:35 PM
Rorschach112
-
- Retired Staff
-
- 47,710 posts
Ralphie
Hello
1. Close any open browsers.
2. Open notepad and copy/paste the text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
1. Close any open browsers.
2. Open notepad and copy/paste the text in the quotebox below into it:
KillAll:: File:: C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp C:\Program Files\Veoh Networks\Veoh\VeohClient .exe C:\WINDOWS\system32\kmd .exe C:\WINDOWS\system32\dllcache\msconfig .exe Folder:: C:\Documents and Settings\Owner\Desktop\[4][email protected] RenV:: ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe ----a-w 388,608 2008-02-21 20:32:40 C:\WINDOWS\system32\kmd .exe ----a-w 158,208 2008-02-21 01:48:35 C:\WINDOWS\system32\dllcache\msconfig .exe
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Edited by Rorschach112, 25 February 2008 - 06:36 PM.
#24
Posted 25 February 2008 - 07:41 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
ComboFix 08-02-20.2 - 2008-02-25 16:14:22.21 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 16:16:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 16:18:27
ComboFix-quarantined-files.txt 2008-02-26 00:18:19
ComboFix2.txt 2008-02-25 20:41:15
ComboFix3.txt 2008-02-25 08:42:36
ComboFix4.txt 2008-02-22 01:45:15
ComboFix5.txt 2008-02-21 21:06:18
.
2008-02-15 07:24:30 --- E O F ---
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\dllcache\msconfig .exe
C:\WINDOWS\system32\kmd .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
<pre> ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe </pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-25 20:33:49 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 16:16:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-02-25 16:18:27
ComboFix-quarantined-files.txt 2008-02-26 00:18:19
ComboFix2.txt 2008-02-25 20:41:15
ComboFix3.txt 2008-02-25 08:42:36
ComboFix4.txt 2008-02-22 01:45:15
ComboFix5.txt 2008-02-21 21:06:18
.
2008-02-15 07:24:30 --- E O F ---
#25
Posted 25 February 2008 - 08:02 PM
Rorschach112
-
- Retired Staff
-
- 47,710 posts
Ralphie
One thing is refusing to go
1. Close any open browsers.
2. Open notepad and copy/paste the text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
1. Close any open browsers.
2. Open notepad and copy/paste the text in the quotebox below into it:
File:: C:\Program Files\Veoh Networks\Veoh\VeohClient .exe RenV:: ----a-w 3,497,984 2008-02-25 07:30:33 C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Edited by Rorschach112, 25 February 2008 - 08:02 PM.
#26
Posted 25 February 2008 - 08:09 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
Veoh is my video client lol
#27
Posted 25 February 2008 - 08:14 PM
Rorschach112
-
- Retired Staff
-
- 47,710 posts
Ralphie
Were you taking that out of the fix all this time ?
The above Veoh file is a Vundo file infecter, it is not your legitimate file. We need to remove it or we can't fix your PC
So please go ahead and follow my above instructions
The above Veoh file is a Vundo file infecter, it is not your legitimate file. We need to remove it or we can't fix your PC
So please go ahead and follow my above instructions
#28
Posted 25 February 2008 - 08:30 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
Nah I wasnt, just saying. but I did follow the directions, here is the log
ComboFix 08-02-20.2 - Owner 2008-02-25 18:15:46.22 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-02-24 23:30 3497984 C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-26 02:00:12 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 18:27:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\Explorer.exe [6.00.2900.2180]
-> C:\WINDOWS\HKNTDLL.dll
.
Completion time: 2008-02-25 18:29:01
ComboFix-quarantined-files.txt 2008-02-26 02:28:52
ComboFix2.txt 2008-02-26 00:18:27
ComboFix3.txt 2008-02-25 20:41:15
ComboFix4.txt 2008-02-25 08:42:36
ComboFix5.txt 2008-02-22 01:45:15
.
2008-02-15 07:24:30 --- E O F ---
ComboFix 08-02-20.2 - Owner 2008-02-25 18:15:46.22 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe
.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 12:47 . 2008-02-25 12:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 02:47 . 2008-02-21 02:47 268 --ah----- C:\sqmdata03.sqm
2008-02-21 02:47 . 2008-02-21 02:47 244 --ah----- C:\sqmnoopt03.sqm
2008-02-20 01:15 . 2008-02-20 01:15 36,734 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Program Files\RadLight Company
2008-02-20 01:10 . 2008-02-20 01:10 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\RadLight Company
2008-02-19 16:56 . 2008-02-20 18:17 <DIR> d-------- C:\VundoFix Backups
2008-02-19 00:50 . 2008-02-19 00:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-19 00:50 . 2008-02-19 00:50 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-16 22:52 . 2008-02-17 23:54 202 --a------ C:\WINDOWS\wininit.ini
2008-02-16 22:30 . 2008-02-20 15:46 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-16 22:30 . 2008-02-16 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 22:20 . 2008-02-16 22:20 6,029,648 --a------ C:\Program Files\Firefox Setup 2.0.0.12.exe
2008-02-15 00:01 . 2008-02-24 23:32 157,383 --a------ C:\WINDOWS\BM2fdf5f1a.xml
2008-02-15 00:01 . 2008-02-25 00:02 21 --a------ C:\WINDOWS\pskt.ini
2008-02-14 22:27 . 2008-02-14 22:27 <DIR> d-------- C:\WINDOWS\cache
2008-02-14 21:15 . 2008-02-14 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 11:08 . 2008-02-13 11:08 22 --a------ C:\WINDOWS\system32\ati64hlp.stb
2008-02-11 16:35 . 2008-02-25 12:33 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-10 19:25 . 2008-02-10 19:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 00:11 . 2008-02-08 03:04 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\Azureus
2008-02-06 14:07 . 2008-02-06 14:07 <DIR> d---s---- C:\Documents and Settings\Hossea\UserData
2008-02-02 21:57 . 2008-02-14 22:27 <DIR> dr-h----- C:\Documents and Settings\Hossea\Application Data\yahoo!
2008-02-02 19:47 . 2008-02-02 19:48 <DIR> d-------- C:\Documents and Settings\Hossea\Shared
2008-02-02 19:47 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\Hossea\Incomplete
2008-02-02 19:47 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\LimeWire
2008-02-02 19:45 . 2007-04-12 06:52 <DIR> d-------- C:\Documents and Settings\Hossea\WINDOWS
2008-02-02 19:45 . 2007-04-12 07:40 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\You've Got Pictures Screensaver
2008-02-02 19:45 . 2007-04-12 07:39 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\SampleView
2008-02-02 19:45 . 2007-04-12 07:43 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\McAfee
2008-02-02 19:45 . 2007-04-13 23:11 <DIR> d-------- C:\Documents and Settings\Hossea\Application Data\AOL
2008-01-28 17:08 . 2008-01-28 17:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-01-28 17:05 . 2008-02-25 12:36 <DIR> d-------- C:\Program Files\AIM6
2008-01-27 15:56 . 2008-01-27 15:56 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 11:02 --------- d-----w C:\Program Files\Warcraft III
2008-02-25 10:08 --------- d-----w C:\Program Files\Windows Live
2008-02-25 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-20 23:46 --------- d-----w C:\Program Files\Windows Defender
2008-02-20 09:08 --------- d-----w C:\Program Files\DivX
2008-02-15 10:44 --------- d-----w C:\Program Files\Google
2008-02-15 07:21 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-02-15 07:05 497,152 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
2008-02-15 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-15 05:22 --------- d-----w C:\Program Files\WC3Banlist
2008-02-08 20:23 --------- d-----w C:\Program Files\QuickTime
2008-02-04 21:52 --------- d-----w C:\Program Files\LimeWire
2008-01-31 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-30 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-29 01:06 --------- d-----w C:\Program Files\Common Files\AOL
2008-01-29 01:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-01-26 21:58 --------- d-----w C:\Program Files\World of Warcraft
2008-01-21 23:33 --------- d-----w C:\Documents and Settings\Guest\Application Data\Ventrilo
2008-01-20 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Azureus
2008-01-15 08:27 --------- d-----w C:\Program Files\Opera
2008-01-11 06:27 --------- d-----w C:\Program Files\Steam
2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-01-04 21:58 43,528 ----a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-01-04 19:59 --------- d--h--r C:\Documents and Settings\Guest\Application Data\yahoo!
2007-12-28 09:06 --------- d-----w C:\Program Files\Azureus
2007-12-27 09:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\sysfolderazipcnt.dll
2007-12-21 04:01 58,904 ----a-w C:\WINDOWS\system32\azipcontmn.dll
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-20 09:52 7,292,416 ----a-w C:\Program Files\NETGEAR WG311v3 PCI Adapter.msi
2006-03-15 22:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
2006-01-27 01:55 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2005-10-06 23:17 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-02-24 23:54 50528]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="zHotkey.exe" [2005-05-03 13:02 543232 C:\WINDOWS\zHotkey.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 577536 C:\WINDOWS\soundman.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311v3 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG311v3 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG311v3 Smart Wizard.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6 .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2007-12-04 05:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 12:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-09-25 13:54 229952 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-02-21 02:36 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
%WINDIR%\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2004-11-02 19:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2008-02-19 14:00 2441216 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-01 14:01 1266936 c:\program files\steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
--a------ 2004-11-15 14:04 135168 C:\Program Files\Digital Media Reader\shwiconem.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-17 23:24 526848 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-02-24 23:30 3497984 C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2007-03-14 16:03 24104 C:\Program Files\Zune\ZuneLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVG Anti-Spyware Guard"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"ZuneNetworkSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"rpcapd"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gusvc"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"aswUpdSv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BEL;Belkin 11Mbps Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\BELNDS.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 09:31]
.
Contents of the 'Scheduled Tasks' folder
"2008-02-26 02:00:12 C:\WINDOWS\Tasks\ATF-Cleaner.job"
- C:\Documents and Settings\Owner\Desktop\Stuff\Anti Virus and Protectors\ATF-Cleaner.exe
"2008-02-25 10:30:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 18:27:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\Explorer.exe [6.00.2900.2180]
-> C:\WINDOWS\HKNTDLL.dll
.
Completion time: 2008-02-25 18:29:01
ComboFix-quarantined-files.txt 2008-02-26 02:28:52
ComboFix2.txt 2008-02-26 00:18:27
ComboFix3.txt 2008-02-25 20:41:15
ComboFix4.txt 2008-02-25 08:42:36
ComboFix5.txt 2008-02-22 01:45:15
.
2008-02-15 07:24:30 --- E O F ---
#29
Posted 25 February 2008 - 08:34 PM
Rorschach112
-
- Retired Staff
-
- 47,710 posts
Ralphie
That has done the job
Can you post a new HijackThis log and tell me how your PC is running
Can you post a new HijackThis log and tell me how your PC is running
#30
Posted 25 February 2008 - 08:39 PM
Noitora
- Topic Starter
-
- Member
-
- 45 posts
Member
Ok here is the Result:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:39:30 PM, on 2/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
--
End of file - 4039 bytes
Its running fine now, just still wondering where I encountered that geebb.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:39:30 PM, on 2/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\zHotkey.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
--
End of file - 4039 bytes
Its running fine now, just still wondering where I encountered that geebb.exe
Edited by Noitora, 25 February 2008 - 08:41 PM.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
