The Kaspersky log got gut off, could you attach that also please.
Regards,
RatHat
Computer Badly Infected, Obfuskated Maybe[RESOLVED]
Started by
Gene323
, May 03 2008 04:44 PM
-
This topic is locked
#16
Posted 06 May 2008 - 09:14 PM
RatHat
-
- Expert
-
- 7,829 posts
Ex Malware Expert
The Kaspersky log got gut off, could you attach that also please.
Regards,
RatHat
#18
Posted 06 May 2008 - 09:35 PM
RatHat
-
- Expert
-
- 7,829 posts
Ex Malware Expert
OK, it will take me a bit of time to go through these logs, but I'll get back to you as soon as I can.
Regards,
RatHat
Regards,
RatHat
#19
Posted 06 May 2008 - 09:43 PM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
thanks so much. take as much time as you need.
#20
Posted 07 May 2008 - 02:57 PM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
my computer froze last night(sometimes the graphics card overheats), and when i booted it up this morning, it started up normally.
#21
Posted 07 May 2008 - 09:56 PM
RatHat
-
- Expert
-
- 7,829 posts
Ex Malware Expert
Thats good news Gene!
Please disable TeaTimer for now until we have finished. TeaTimer can be re-activated once your HijackThis log is clean.
Please uninstall the P2P programs that you have; Shareza and uTorrent, and any others installed on your computer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Please download ATF Cleaner by Atribune.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Start OTScanIt.exe Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new DSS log.
Let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.
Regards,
RatHat
Please disable TeaTimer for now until we have finished. TeaTimer can be re-activated once your HijackThis log is clean.
- Open Spybot Search & Destroy.
- In the Mode menu click "Advanced mode" if not already selected.
- Choose "Yes" at the Warning prompt.
- Expand the "Tools" menu.
- Click "Resident".
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- In the File menu click "Exit" to exit Spybot Search & Destroy.
Please uninstall the P2P programs that you have; Shareza and uTorrent, and any others installed on your computer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Please download ATF Cleaner by Atribune.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Start OTScanIt.exe Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.
[Kill Explorer]
[Registry - Non-Microsoft Only]
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
YN -> {81559C35-8464-49F7-BB0E-07A383BEF910} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [SpywareGuard]
< Drives - Autoruns > ->
NY -> AUTORUN.INF [[AutoRun] | open=setup.exe | icon=setup.exe,0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ] -> E:\AUTORUN.INF [ CDFS ]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {4A368E80-174F-4872-96B5-0B27DDD11DB2} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Bars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Bars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Bars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Bars [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Bars [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Bars [HKEY_USERS\S-1-5-21-789336058-1604221776-839522115-1003\] > -> HKEY_USERS\S-1-5-21-789336058-1604221776-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75}[HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.]
[Registry - Additional Scans - Non-Microsoft Only]
< App Paths [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
NY -> AU3_Spy.exe -> %ProgramFiles%\AutoHotkey\AU3_Spy.exe [Reg Error: Value Path does not exist or could not be read.]
NY -> AutoScriptWriter.exe -> %ProgramFiles%\AutoHotkey\AutoScriptWriter\AutoScriptWriter.exe [Reg Error: Value Path does not exist or could not be read.]
NY -> CTMVNS.dll -> %ProgramFiles%\Creative\Creative Zen Nano Plus\CTMVNS.DLL [Reg Error: Value Path does not exist or could not be read.]
YN -> install.exe -> Reg Error: Value does not exist or could not be read. [Reg Error: Value Path does not exist or could not be read.]
YN -> msimn.exe -> [%ProgramFiles%\Outlook Express]
YN -> setup.exe -> Reg Error: Value does not exist or could not be read. [Reg Error: Value Path does not exist or could not be read.]
YN -> Shareaza.exe -> %ProgramFiles%\Shareaza\Shareaza.exe [D:\Program Files\Shareaza]
NY -> SopCast.exe -> %ProgramFiles%\SopCast\SopCast.exe [Reg Error: Value Path does not exist or could not be read.]
YN -> table30.exe -> Reg Error: Value does not exist or could not be read. [Reg Error: Value Path does not exist or could not be read.]
YN -> wab.exe -> [%ProgramFiles%\Outlook Express]
YN -> wabmig.exe -> [%ProgramFiles%\Outlook Express]
YN -> winnt32.exe -> Reg Error: Value does not exist or could not be read. [Reg Error: Value Path does not exist or could not be read.]
YN -> WORDPAD.EXE -> [Reg Error: Value Path does not exist or could not be read.]
YN -> WRITE.EXE -> [Reg Error: Value Path does not exist or could not be read.]
< Approved Shell Extensions [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Media Band]
YN -> {42071714-76d4-11d1-8b24-00a0c9068ff3} [HKEY_LOCAL_MACHINE] -> [Display Panning CPL Extension]
YN -> {764BF0E1-F219-11ce-972D-00AA00A14F56} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Shell extensions for file compression]
YN -> {81559C35-8464-49F7-BB0E-07A383BEF910} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [SpywareGuard]
YN -> {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Encryption Context Menu]
< Security Settings > ->
YN -> ~EmptyValue -> Reg Error: Key does not exist or could not be opened.
[Files/Folders - Created Within 90 days]
NY -> 9 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp
NY -> 3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp
[Files/Folders - Modified Within 90 days]
NY -> 9 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp
NY -> 3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp
[File - Lop Check: Additional Folder Scans - Non-Microsoft Only]
NY -> adaptv.vo.llnwd.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\adaptv.vo.llnwd.net
NY -> o15 -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\adaptv.vo.llnwd.net\o15
NY -> AdPlayer8_005774.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\adaptv.vo.llnwd.net\o15\client\AdPlayer8_005774.swf
NY -> AdPlayer8_005935.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\adaptv.vo.llnwd.net\o15\client\AdPlayer8_005935.swf
NY -> AdPlayer8_006086.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\adaptv.vo.llnwd.net\o15\client\AdPlayer8_006086.swf
NY -> AdPlayer8-3.0_007199.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\adaptv.vo.llnwd.net\o15\client\AdPlayer8-3.0_007199.swf
NY -> addictinggames.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\addictinggames.com
NY -> akimages.metacafe.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\akimages.metacafe.com
NY -> arcade.itch.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\arcade.itch.com
NY -> bin.clearspring.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\bin.clearspring.com
NY -> bitcast-d.bitgravity.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\bitcast-d.bitgravity.com
NY -> cdn-ll-static.viddler.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\cdn-ll-static.viddler.com
NY -> chat.kongregate.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\chat.kongregate.com
NY -> gamez -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\chat.kongregate.com\gamez
NY -> chatango.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\chatango.com
NY -> chime.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\chime.tv
NY -> cimages.broadcaster.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\cimages.broadcaster.com
NY -> cnet.a.mms.mavenapps.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\cnet.a.mms.mavenapps.net
NY -> crackle.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\crackle.com
NY -> d.yimg.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\d.yimg.com
NY -> downloads.zdnet.co.uk -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\downloads.zdnet.co.uk
NY -> dv.ouou.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\dv.ouou.com
NY -> es.youtube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\es.youtube.com
NY -> espn360.channelfinder.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\espn360.channelfinder.net
NY -> fhm.permissiontv.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\fhm.permissiontv.com
NY -> flash.quantserve.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\flash.quantserve.com
NY -> flash.revver.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\flash.revver.com
NY -> gannett.a.mms.mavenapps.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\gannett.a.mms.mavenapps.net
NY -> hosted.nowlive.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\hosted.nowlive.com
NY -> im1music.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\im1music.net
NY -> im1musicc.cs-webhost.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\im1musicc.cs-webhost.com
NY -> images.amazon.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\images.amazon.com
NY -> images.video.msn.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\images.video.msn.com
NY -> soapbox1_1.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\images.video.msn.com\res\flash\633374031660000000\soapbox1_1.swf
NY -> 633390781200000000 -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\images.video.msn.com\res\flash\633390781200000000
NY -> soapbox1_1.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\images.video.msn.com\res\flash\633390781200000000\soapbox1_1.swf
NY -> img.ku6.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\img.ku6.com
NY -> kaktuz.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\kaktuz.com
NY -> xmoov-flv-player.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\kaktuz.com\data\other\xmoovflv\player\xmoov-flv-player.swf
NY -> popup-2008-03-20-0932 -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\l.yimg.com\cosmos.bcst.yahoo.com\ver\260.0\popup-2008-03-20-0932
NY -> POP_meta.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\l.yimg.com\cosmos.bcst.yahoo.com\ver\260.0\popup-2008-03-20-0932\swf\POP_meta.swf
NY -> us.yimg.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\l.yimg.com\us.yimg.com
NY -> pagead2.googlesyndication.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\pagead2.googlesyndication.com
NY -> seal.buysafe.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\seal.buysafe.com
NY -> si.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\si.com
NY -> smartandfinal.shoplocal.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\smartandfinal.shoplocal.com
NY -> songs.im1musicc.cs-webhost.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\songs.im1musicc.cs-webhost.com
NY -> southpark.comedycentral.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\southpark.comedycentral.com
NY -> ssl-images-amazon.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\ssl-images-amazon.com
NY -> static.espn.go.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\static.espn.go.com
NY -> static.youku.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\static.youku.com
NY -> suitesmart.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\suitesmart.com
NY -> swf.redlasso.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\swf.redlasso.com
NY -> tvliveshows.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\tvliveshows.com
NY -> twitter.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\twitter.com
NY -> twitter_badge.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\twitter.com\flash\twitter_badge.swf
NY -> ui.tudou.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\ui.tudou.com
NY -> tudouplayer_17.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\ui.tudou.com\bin\player2\tudouplayer_17.swf
NY -> uncutvideo.aol.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\uncutvideo.aol.com
NY -> ustream.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\ustream.tv
NY -> video.supernovatube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\video.supernovatube.com
NY -> viralchart.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\viralchart.com
NY -> void.snocap.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\void.snocap.com
NY -> wideo.turbo.fr -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\wideo.turbo.fr
NY -> wp.vizu.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\wp.vizu.com
NY -> www.56.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.56.com
NY -> www.addictinggames.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.addictinggames.com
NY -> www.aolcdn.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.aolcdn.com
NY -> ch_news -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.aolcdn.com\ch_news
NY -> www.bigmoneyarcade.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.bigmoneyarcade.com
NY -> viewgame.php -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.bigmoneyarcade.com\viewgame.php
NY -> www.blogger.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.blogger.com
NY -> www.dailymotion.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.dailymotion.com
NY -> www.danitykane.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.danitykane.com
NY -> www.dumpalink.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.dumpalink.com
NY -> www.flurl.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.flurl.com
NY -> www.guba.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.guba.com
NY -> www.hulu.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.hulu.com
NY -> playerembed.swf -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.hulu.com\playerembed.swf
NY -> www.justin.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.justin.tv
NY -> www.livevideo.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.livevideo.com
NY -> www.mogulus.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.mogulus.com
NY -> www.mtv.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.mtv.com
NY -> www.myvemma.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.myvemma.com
NY -> www.pluggd.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.pluggd.tv
NY -> www.rawkins.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.rawkins.com
NY -> www.rawprint.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.rawprint.com
NY -> www.sexyandfunny.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.sexyandfunny.com
NY -> www.southparkzone.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.southparkzone.com
NY -> www.spike.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.spike.com
NY -> www.surfthechannel.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.surfthechannel.com
NY -> www.thedailyshow.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.thedailyshow.com
NY -> www.the-n.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.the-n.com
NY -> www.tudou.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.tudou.com
NY -> www.ustream.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\#SharedObjects\ASWVWAU7\www.ustream.tv
NY -> #ads1.msn.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ads1.msn.com
NY -> #akimages.metacafe.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#akimages.metacafe.com
NY -> #arcade.itch.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#arcade.itch.com
NY -> #assets.espn.go.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#assets.espn.go.com
NY -> #au.youtube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#au.youtube.com
NY -> #bankofamerica.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bankofamerica.com
NY -> #bin.clearspring.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
NY -> #bitcast-d.bitgravity.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bitcast-d.bitgravity.com
NY -> #c.distralytics.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#c.distralytics.com
NY -> #ca.youtube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ca.youtube.com
NY -> #carlsjr.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#carlsjr.com
NY -> #cbslocal.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cbslocal.com
NY -> #cdn.gigya.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn.gigya.com
NY -> #cdn.widgetserver.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn.widgetserver.com
NY -> #cdn-ll-static.viddler.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn-ll-static.viddler.com
NY -> #chat.kongregate.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chat.kongregate.com
NY -> #chatango.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chatango.com
NY -> #chime.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chime.tv
NY -> #cimages.broadcaster.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cimages.broadcaster.com
NY -> #cnet.a.mms.mavenapps.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cnet.a.mms.mavenapps.net
NY -> #core.mochibot.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#core.mochibot.com
NY -> #cosmos.bcst.yahoo.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cosmos.bcst.yahoo.com
NY -> #crackle.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#crackle.com
NY -> #d.yimg.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#d.yimg.com
NY -> #dailymotion.alice.it -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#dailymotion.alice.it
NY -> #downloads.zdnet.co.uk -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#downloads.zdnet.co.uk
NY -> #dv.ouou.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#dv.ouou.com
NY -> #emg.sourceradio.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#emg.sourceradio.com
NY -> #es.youtube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#es.youtube.com
NY -> #espn360.channelfinder.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#espn360.channelfinder.net
NY -> #fhm.permissiontv.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#fhm.permissiontv.com
NY -> #flash.quantserve.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.quantserve.com
NY -> #flash.revver.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flash.revver.com
NY -> #flickr.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#flickr.com
NY -> #gannett.a.mms.mavenapps.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#gannett.a.mms.mavenapps.net
NY -> #hosted.nowlive.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#hosted.nowlive.com
NY -> #im1music.net -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#im1music.net
NY -> #im1musicc.cs-webhost.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#im1musicc.cs-webhost.com
NY -> #images.amazon.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.amazon.com
NY -> #images.video.msn.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#images.video.msn.com
NY -> #img.ku6.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.ku6.com
NY -> #kaktuz.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kaktuz.com
NY -> #l.yimg.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#l.yimg.com
NY -> #login.yahoo.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#login.yahoo.com
NY -> #media.mtvnservices.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.mtvnservices.com
NY -> #media.scanscout.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.scanscout.com
NY -> #media1.break.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media1.break.com
NY -> #memecounter.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#memecounter.com
NY -> #mochibot.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mochibot.com
NY -> #msn.foxsports.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#msn.foxsports.com
NY -> #pagead2.googlesyndication.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pagead2.googlesyndication.com
NY -> #pandora.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pandora.com
NY -> #player.cbsradio.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#player.cbsradio.com
NY -> #player.cdn.targetspot.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#player.cdn.targetspot.com
NY -> #player.hulu.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#player.hulu.com
NY -> #pub.widgetbox.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#pub.widgetbox.com
NY -> #resources.imeem.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#resources.imeem.com
NY -> #s.mcstatic.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.mcstatic.com
NY -> #seal.buysafe.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#seal.buysafe.com
NY -> #si.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#si.com
NY -> #smartandfinal.shoplocal.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#smartandfinal.shoplocal.com
NY -> #songs.im1musicc.cs-webhost.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#songs.im1musicc.cs-webhost.com
NY -> #southpark.comedycentral.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#southpark.comedycentral.com
NY -> #ssl-images-amazon.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ssl-images-amazon.com
NY -> #static.espn.go.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.espn.go.com
NY -> #static.youku.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
NY -> #stb.msn.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#stb.msn.com
NY -> #suitesmart.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#suitesmart.com
NY -> #swf.redlasso.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#swf.redlasso.com
NY -> #tvliveshows.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#tvliveshows.com
NY -> #twitter.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#twitter.com
NY -> #ui.tudou.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ui.tudou.com
NY -> #uncutvideo.aol.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#uncutvideo.aol.com
NY -> #ustream.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ustream.tv
NY -> #video.google.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com
NY -> #video.nbc.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.nbc.com
NY -> #video.nbcuni.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.nbcuni.com
NY -> #video.supernovatube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.supernovatube.com
NY -> #viralchart.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#viralchart.com
NY -> #void.snocap.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#void.snocap.com
NY -> #wideo.turbo.fr -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wideo.turbo.fr
NY -> #wp.vizu.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#wp.vizu.com
NY -> #www.56.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com
NY -> #www.addictinggames.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.addictinggames.com
NY -> #www.aolcdn.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.aolcdn.com
NY -> #www.bigmoneyarcade.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.bigmoneyarcade.com
NY -> #www.blogger.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.blogger.com
NY -> #www.burgerslayer.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.burgerslayer.com
NY -> #www.cbs.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.cbs.com
NY -> #www.comedycentral.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.comedycentral.com
NY -> #www.dailymotion.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.dailymotion.com
NY -> #www.danitykane.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.danitykane.com
NY -> #www.dumpalink.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.dumpalink.com
NY -> #www.flurl.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.flurl.com
NY -> #www.foxnews.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.foxnews.com
NY -> #www.guba.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.guba.com
NY -> #www.hulu.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.hulu.com
NY -> #www.justin.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.justin.tv
NY -> #www.liveleak.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.liveleak.com
NY -> #www.livevideo.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.livevideo.com
NY -> #www.mogulus.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.mogulus.com
NY -> #www.mtv.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.mtv.com
NY -> #www.mtvu.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.mtvu.com
NY -> #www.myvemma.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.myvemma.com
NY -> #www.nba.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.nba.com
NY -> #www.pluggd.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.pluggd.tv
NY -> #www.rawkins.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.rawkins.com
NY -> #www.rawprint.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.rawprint.com
NY -> #www.sexyandfunny.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.sexyandfunny.com
NY -> #www.southparkzone.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.southparkzone.com
NY -> #www.spike.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.spike.com
NY -> #www.surfthechannel.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.surfthechannel.com
NY -> #www.thedailyshow.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.thedailyshow.com
NY -> #www.the-n.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.the-n.com
NY -> #www.time.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.time.com
NY -> #www.tudou.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.tudou.com
NY -> #www.ustream.tv -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.ustream.tv
NY -> #www.veoh.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.veoh.com
NY -> #www.vidilife.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.vidilife.com
NY -> #www.widgetbox.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.widgetbox.com
NY -> #www.youtube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com
NY -> #www.zdnet.co.uk -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.zdnet.co.uk
NY -> #youtube.com -> D:\Documents and Settings\Eugene\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#youtube.com
[Extra Files]
C:\Program Files\DAEMON Tools\SetupDTSB.exe
C:\Program Files\Shareaza\Downloads\east far lowridin movement (1).mp3
C:\Users\Gene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5L52J4DZ\sc[1].exe
[Empty Temp Folders]The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new DSS log.
Let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.
Regards,
RatHat
#22
Posted 07 May 2008 - 10:41 PM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
OTFixit keeps freezing when i hit run fix. i try to wait it out, but nothing happens. The only thing in the log is
Files moved on Reboot...
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
Files moved on Reboot...
File move failed. E:\AUTORUN.INF scheduled to be moved on reboot.
Edited by Gene323, 07 May 2008 - 11:09 PM.
#23
Posted 08 May 2008 - 12:09 AM
RatHat
-
- Expert
-
- 7,829 posts
Ex Malware Expert
OK, lets run a different program.
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
Regards,
RatHat
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
Regards,
RatHat
#24
Posted 08 May 2008 - 04:26 AM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
ComboFix:
ComboFix 08-05-01.3 - Eugene 2008-05-08 3:20:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.661 [GMT -7:00]
Running from: D:\Documents and Settings\Eugene\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-08 to 2008-05-08 )))))))))))))))))))))))))))))))
.
2008-05-08 03:20 . 2008-05-08 03:20 1,024 --ah----- D:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-06 11:04 . 2008-05-06 11:04 <DIR> d----c--- D:\Documents and Settings\Administrator.GENE
2008-05-06 11:04 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator.GENE\NTUSER.DAT.LOG
2008-05-05 11:08 . 2008-05-05 11:08 <DIR> d----c--- D:\Deckard
2008-05-05 03:11 . 2008-05-05 03:11 <DIR> d----c--- D:\Program Files\Trend Micro
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Program Files\Malwarebytes' Anti-Malware
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\Eugene\Application Data\Malwarebytes
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\WINDOWS\system32\Kaspersky Lab
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-03 15:25 . 2008-05-03 15:25 <DIR> d----c--- D:\Documents and Settings\Administrator
2008-05-03 15:25 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator\NTUSER.DAT.LOG
2008-05-03 03:17 . 2008-05-06 13:16 <DIR> d----c--- D:\Program Files\SpywareGuard
2008-05-03 03:13 . 2008-05-06 13:17 <DIR> d----c--- D:\Program Files\SpywareBlaster
2008-05-03 03:13 . 2008-05-03 03:13 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 03:13 . 2005-08-25 18:18 118,784 --a--c--- D:\WINDOWS\system32\MSSTDFMT.DLL
2008-05-03 03:13 . 2005-08-25 18:19 115,920 --a--c--- D:\WINDOWS\system32\MSINET.OCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 04:04 --------- dc----w D:\Program Files\SopCast
2008-05-08 04:04 --------- dc----w D:\Program Files\AutoHotkey
2008-05-07 23:42 --------- dc----w D:\Program Files\Warcraft III
2008-05-04 20:50 --------- dc----w D:\Program Files\Java
2008-05-03 09:57 --------- dc----w D:\Documents and Settings\Eugene\Application Data\uTorrent
2008-04-20 22:50 --------- dc----w D:\Program Files\ClamWin
2008-04-14 00:53 --------- dc----w D:\Program Files\Paint.NET
2008-04-08 05:56 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Joost
2008-03-30 02:46 --------- dc----w D:\Program Files\Joost
2008-03-28 20:41 --------- dc----w D:\Program Files\Winamp
2008-03-28 20:40 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Winamp
2008-03-24 23:07 --------- dc----w D:\Program Files\Microsoft Bootvis
2008-03-19 09:47 1,845,248 -c--a-w D:\WINDOWS\system32\win32k.sys
2008-03-08 19:52 --------- dc----w D:\Documents and Settings\Eugene\Application Data\dvdcss
2008-03-01 13:06 826,368 -c--a-w D:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 -c--a-w D:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 -c--a-w D:\WINDOWS\system32\dnsrslvr.dll
2008-02-10 00:34 691,545 -c--a-w D:\WINDOWS\unins000.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="D:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
"ClamWin"="D:\Program Files\ClamWin\bin\ClamTray.exe" [2008-04-19 16:35 77824]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 11:37 79224]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
D:\Documents and Settings\Eugene\Start Menu\Programs\Startup\
SpywareGuard.lnk - D:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= D:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike\\hl.exe"=
"D:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Warcraft III\\war3.exe"=
"D:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"D:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"D:\\Program Files\\SopCast\\sopvod.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"D:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"D:\\Program Files\\Warcraft III\\listchecker\\pickup.listchecker.exe"=
"D:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Warcraft Bnet
R0 SI3112;SiI-3512 SATALink Controller;D:\WINDOWS\system32\DRIVERS\SI3112.sys [2007-01-26 13:55]
R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;D:\WINDOWS\system32\drivers\Envy24HF.sys [2007-03-15 09:56]
S3 NPF;NetGroup Packet Filter Driver;D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 13:22]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-08 03:21:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-05-08 3:24:29
ComboFix-quarantined-files.txt 2008-05-08 10:23:26
Pre-Run: 21,873,688,576 bytes free
Post-Run: 21,879,894,016 bytes free
104 --- E O F --- 2008-04-08 18:13:15
HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:24:58 AM, on 5/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ClamWin\bin\ClamTray.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\SpywareGuard\sgmain.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\notepad.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ClamWin] "D:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1008570530140
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
--
End of file - 4881 bytes
I added recovery console after
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(1)\WINDOWSX="Microsoft Windows XP Home Edition" /fastdetect
scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional" /FASTDETECT
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
ComboFix 08-05-01.3 - Eugene 2008-05-08 3:20:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.661 [GMT -7:00]
Running from: D:\Documents and Settings\Eugene\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-08 to 2008-05-08 )))))))))))))))))))))))))))))))
.
2008-05-08 03:20 . 2008-05-08 03:20 1,024 --ah----- D:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-06 11:04 . 2008-05-06 11:04 <DIR> d----c--- D:\Documents and Settings\Administrator.GENE
2008-05-06 11:04 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator.GENE\NTUSER.DAT.LOG
2008-05-05 11:08 . 2008-05-05 11:08 <DIR> d----c--- D:\Deckard
2008-05-05 03:11 . 2008-05-05 03:11 <DIR> d----c--- D:\Program Files\Trend Micro
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Program Files\Malwarebytes' Anti-Malware
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\Eugene\Application Data\Malwarebytes
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\WINDOWS\system32\Kaspersky Lab
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-03 15:25 . 2008-05-03 15:25 <DIR> d----c--- D:\Documents and Settings\Administrator
2008-05-03 15:25 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator\NTUSER.DAT.LOG
2008-05-03 03:17 . 2008-05-06 13:16 <DIR> d----c--- D:\Program Files\SpywareGuard
2008-05-03 03:13 . 2008-05-06 13:17 <DIR> d----c--- D:\Program Files\SpywareBlaster
2008-05-03 03:13 . 2008-05-03 03:13 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 03:13 . 2005-08-25 18:18 118,784 --a--c--- D:\WINDOWS\system32\MSSTDFMT.DLL
2008-05-03 03:13 . 2005-08-25 18:19 115,920 --a--c--- D:\WINDOWS\system32\MSINET.OCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 04:04 --------- dc----w D:\Program Files\SopCast
2008-05-08 04:04 --------- dc----w D:\Program Files\AutoHotkey
2008-05-07 23:42 --------- dc----w D:\Program Files\Warcraft III
2008-05-04 20:50 --------- dc----w D:\Program Files\Java
2008-05-03 09:57 --------- dc----w D:\Documents and Settings\Eugene\Application Data\uTorrent
2008-04-20 22:50 --------- dc----w D:\Program Files\ClamWin
2008-04-14 00:53 --------- dc----w D:\Program Files\Paint.NET
2008-04-08 05:56 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Joost
2008-03-30 02:46 --------- dc----w D:\Program Files\Joost
2008-03-28 20:41 --------- dc----w D:\Program Files\Winamp
2008-03-28 20:40 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Winamp
2008-03-24 23:07 --------- dc----w D:\Program Files\Microsoft Bootvis
2008-03-19 09:47 1,845,248 -c--a-w D:\WINDOWS\system32\win32k.sys
2008-03-08 19:52 --------- dc----w D:\Documents and Settings\Eugene\Application Data\dvdcss
2008-03-01 13:06 826,368 -c--a-w D:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 -c--a-w D:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 -c--a-w D:\WINDOWS\system32\dnsrslvr.dll
2008-02-10 00:34 691,545 -c--a-w D:\WINDOWS\unins000.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="D:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
"ClamWin"="D:\Program Files\ClamWin\bin\ClamTray.exe" [2008-04-19 16:35 77824]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 11:37 79224]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
D:\Documents and Settings\Eugene\Start Menu\Programs\Startup\
SpywareGuard.lnk - D:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= D:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike\\hl.exe"=
"D:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Warcraft III\\war3.exe"=
"D:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"D:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"D:\\Program Files\\SopCast\\sopvod.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"D:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"D:\\Program Files\\Warcraft III\\listchecker\\pickup.listchecker.exe"=
"D:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Warcraft Bnet
R0 SI3112;SiI-3512 SATALink Controller;D:\WINDOWS\system32\DRIVERS\SI3112.sys [2007-01-26 13:55]
R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;D:\WINDOWS\system32\drivers\Envy24HF.sys [2007-03-15 09:56]
S3 NPF;NetGroup Packet Filter Driver;D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 13:22]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-08 03:21:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-05-08 3:24:29
ComboFix-quarantined-files.txt 2008-05-08 10:23:26
Pre-Run: 21,873,688,576 bytes free
Post-Run: 21,879,894,016 bytes free
104 --- E O F --- 2008-04-08 18:13:15
HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:24:58 AM, on 5/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ClamWin\bin\ClamTray.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\SpywareGuard\sgmain.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\notepad.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ClamWin] "D:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1008570530140
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
--
End of file - 4881 bytes
I added recovery console after
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(1)\WINDOWSX="Microsoft Windows XP Home Edition" /fastdetect
scsi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional" /FASTDETECT
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
Edited by Gene323, 08 May 2008 - 04:29 AM.
#25
Posted 08 May 2008 - 05:10 AM
RatHat
-
- Expert
-
- 7,829 posts
Ex Malware Expert
Looking good Gene,
1. Please open Notepad
2. Now copy/paste the entire content of the codebox below into the Notepad window:
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
Also let me know if you are having any more problems with the computer.
Regards,
RatHat
1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
File:: C:\Program Files\DAEMON Tools\SetupDTSB.exe C:\Program Files\Shareaza\Downloads\east far lowridin movement (1).mp3 C:\Users\Gene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5L52J4DZ\sc[1].exe
3. Save the above as CFScript.txt
4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
- A new HijackThis log.
Also let me know if you are having any more problems with the computer.
Regards,
RatHat
#26
Posted 08 May 2008 - 05:40 AM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
I deleted the Shareaza folder myself before I saw your update. Computer feels like its running fine. Im just a little worried because the Kapersky scan found so many things and I dont feel like I got rid of it. Here is the combofix log, it didnt ask me to restart.
ComboFix 08-05-01.3 - Eugene 2008-05-08 4:34:19.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.644 [GMT -7:00]
Running from: D:\Documents and Settings\Eugene\Desktop\ComboFix.exe
Command switches used :: D:\Documents and Settings\Eugene\Desktop\cfscript.txt
* Created a new restore point
FILE ::
C:\Program Files\DAEMON Tools\SetupDTSB.exe
C:\Program Files\Shareaza\Downloads\east far lowridin movement (1).mp3
C:\Users\Gene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5L52J4DZ\sc[1].exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\DAEMON Tools\SetupDTSB.exe
C:\Users\Gene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5L52J4DZ\sc[1].exe
.
((((((((((((((((((((((((( Files Created from 2008-04-08 to 2008-05-08 )))))))))))))))))))))))))))))))
.
2008-05-08 03:20 . 2008-05-08 03:20 1,024 --ah----- D:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-06 11:04 . 2008-05-06 11:04 <DIR> d----c--- D:\Documents and Settings\Administrator.GENE
2008-05-06 11:04 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator.GENE\NTUSER.DAT.LOG
2008-05-05 11:08 . 2008-05-05 11:08 <DIR> d----c--- D:\Deckard
2008-05-05 03:11 . 2008-05-05 03:11 <DIR> d----c--- D:\Program Files\Trend Micro
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Program Files\Malwarebytes' Anti-Malware
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\Eugene\Application Data\Malwarebytes
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\WINDOWS\system32\Kaspersky Lab
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-03 15:25 . 2008-05-03 15:25 <DIR> d----c--- D:\Documents and Settings\Administrator
2008-05-03 15:25 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator\NTUSER.DAT.LOG
2008-05-03 03:17 . 2008-05-06 13:16 <DIR> d----c--- D:\Program Files\SpywareGuard
2008-05-03 03:13 . 2008-05-06 13:17 <DIR> d----c--- D:\Program Files\SpywareBlaster
2008-05-03 03:13 . 2008-05-03 03:13 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 03:13 . 2005-08-25 18:18 118,784 --a--c--- D:\WINDOWS\system32\MSSTDFMT.DLL
2008-05-03 03:13 . 2005-08-25 18:19 115,920 --a--c--- D:\WINDOWS\system32\MSINET.OCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 04:04 --------- dc----w D:\Program Files\SopCast
2008-05-08 04:04 --------- dc----w D:\Program Files\AutoHotkey
2008-05-07 23:42 --------- dc----w D:\Program Files\Warcraft III
2008-05-04 20:50 --------- dc----w D:\Program Files\Java
2008-05-03 09:57 --------- dc----w D:\Documents and Settings\Eugene\Application Data\uTorrent
2008-04-20 22:50 --------- dc----w D:\Program Files\ClamWin
2008-04-14 00:53 --------- dc----w D:\Program Files\Paint.NET
2008-04-08 05:56 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Joost
2008-03-30 02:46 --------- dc----w D:\Program Files\Joost
2008-03-28 20:41 --------- dc----w D:\Program Files\Winamp
2008-03-28 20:40 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Winamp
2008-03-24 23:07 --------- dc----w D:\Program Files\Microsoft Bootvis
2008-03-19 09:47 1,845,248 -c--a-w D:\WINDOWS\system32\win32k.sys
2008-03-08 19:52 --------- dc----w D:\Documents and Settings\Eugene\Application Data\dvdcss
2008-03-01 13:06 826,368 -c--a-w D:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 -c--a-w D:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 -c--a-w D:\WINDOWS\system32\dnsrslvr.dll
2008-02-10 00:34 691,545 -c--a-w D:\WINDOWS\unins000.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="D:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
"ClamWin"="D:\Program Files\ClamWin\bin\ClamTray.exe" [2008-04-19 16:35 77824]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 11:37 79224]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
D:\Documents and Settings\Eugene\Start Menu\Programs\Startup\
SpywareGuard.lnk - D:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= D:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike\\hl.exe"=
"D:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Warcraft III\\war3.exe"=
"D:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"D:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"D:\\Program Files\\SopCast\\sopvod.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"D:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"D:\\Program Files\\Warcraft III\\listchecker\\pickup.listchecker.exe"=
"D:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Warcraft Bnet
R0 SI3112;SiI-3512 SATALink Controller;D:\WINDOWS\system32\DRIVERS\SI3112.sys [2007-01-26 13:55]
R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;D:\WINDOWS\system32\drivers\Envy24HF.sys [2007-03-15 09:56]
S3 NPF;NetGroup Packet Filter Driver;D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 13:22]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-08 04:35:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-08 4:36:22
ComboFix-quarantined-files.txt 2008-05-08 11:36:17
ComboFix2.txt 2008-05-08 10:24:30
Pre-Run: 22,615,326,720 bytes free
Post-Run: 22,578,360,320 bytes free
115 --- E O F --- 2008-04-08 18:13:15
HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:49 AM, on 5/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ClamWin\bin\ClamTray.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\SpywareGuard\sgmain.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ClamWin] "D:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1008570530140
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
--
End of file - 5033 bytes
ComboFix 08-05-01.3 - Eugene 2008-05-08 4:34:19.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.644 [GMT -7:00]
Running from: D:\Documents and Settings\Eugene\Desktop\ComboFix.exe
Command switches used :: D:\Documents and Settings\Eugene\Desktop\cfscript.txt
* Created a new restore point
FILE ::
C:\Program Files\DAEMON Tools\SetupDTSB.exe
C:\Program Files\Shareaza\Downloads\east far lowridin movement (1).mp3
C:\Users\Gene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5L52J4DZ\sc[1].exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\DAEMON Tools\SetupDTSB.exe
C:\Users\Gene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5L52J4DZ\sc[1].exe
.
((((((((((((((((((((((((( Files Created from 2008-04-08 to 2008-05-08 )))))))))))))))))))))))))))))))
.
2008-05-08 03:20 . 2008-05-08 03:20 1,024 --ah----- D:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
2008-05-06 11:04 . 2008-05-06 11:04 <DIR> d----c--- D:\Documents and Settings\Administrator.GENE
2008-05-06 11:04 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator.GENE\NTUSER.DAT.LOG
2008-05-05 11:08 . 2008-05-05 11:08 <DIR> d----c--- D:\Deckard
2008-05-05 03:11 . 2008-05-05 03:11 <DIR> d----c--- D:\Program Files\Trend Micro
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Program Files\Malwarebytes' Anti-Malware
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\Eugene\Application Data\Malwarebytes
2008-05-04 00:15 . 2008-05-04 00:15 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\WINDOWS\system32\Kaspersky Lab
2008-05-03 19:29 . 2008-05-03 19:29 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-03 15:25 . 2008-05-03 15:25 <DIR> d----c--- D:\Documents and Settings\Administrator
2008-05-03 15:25 . 2008-05-08 03:20 1,024 --ah----- D:\Documents and Settings\Administrator\NTUSER.DAT.LOG
2008-05-03 03:17 . 2008-05-06 13:16 <DIR> d----c--- D:\Program Files\SpywareGuard
2008-05-03 03:13 . 2008-05-06 13:17 <DIR> d----c--- D:\Program Files\SpywareBlaster
2008-05-03 03:13 . 2008-05-03 03:13 <DIR> d----c--- D:\Documents and Settings\All Users\Application Data\TEMP
2008-05-03 03:13 . 2005-08-25 18:18 118,784 --a--c--- D:\WINDOWS\system32\MSSTDFMT.DLL
2008-05-03 03:13 . 2005-08-25 18:19 115,920 --a--c--- D:\WINDOWS\system32\MSINET.OCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 04:04 --------- dc----w D:\Program Files\SopCast
2008-05-08 04:04 --------- dc----w D:\Program Files\AutoHotkey
2008-05-07 23:42 --------- dc----w D:\Program Files\Warcraft III
2008-05-04 20:50 --------- dc----w D:\Program Files\Java
2008-05-03 09:57 --------- dc----w D:\Documents and Settings\Eugene\Application Data\uTorrent
2008-04-20 22:50 --------- dc----w D:\Program Files\ClamWin
2008-04-14 00:53 --------- dc----w D:\Program Files\Paint.NET
2008-04-08 05:56 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Joost
2008-03-30 02:46 --------- dc----w D:\Program Files\Joost
2008-03-28 20:41 --------- dc----w D:\Program Files\Winamp
2008-03-28 20:40 --------- dc----w D:\Documents and Settings\Eugene\Application Data\Winamp
2008-03-24 23:07 --------- dc----w D:\Program Files\Microsoft Bootvis
2008-03-19 09:47 1,845,248 -c--a-w D:\WINDOWS\system32\win32k.sys
2008-03-08 19:52 --------- dc----w D:\Documents and Settings\Eugene\Application Data\dvdcss
2008-03-01 13:06 826,368 -c--a-w D:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 -c--a-w D:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 -c--a-w D:\WINDOWS\system32\dnsrslvr.dll
2008-02-10 00:34 691,545 -c--a-w D:\WINDOWS\unins000.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="D:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
"ClamWin"="D:\Program Files\ClamWin\bin\ClamTray.exe" [2008-04-19 16:35 77824]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 11:37 79224]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
D:\Documents and Settings\Eugene\Start Menu\Programs\Startup\
SpywareGuard.lnk - D:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= D:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike\\hl.exe"=
"D:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Warcraft III\\war3.exe"=
"D:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"D:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"D:\\Program Files\\SopCast\\sopvod.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"D:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"D:\\Program Files\\Warcraft III\\listchecker\\pickup.listchecker.exe"=
"D:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:Warcraft Bnet
R0 SI3112;SiI-3512 SATALink Controller;D:\WINDOWS\system32\DRIVERS\SI3112.sys [2007-01-26 13:55]
R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;D:\WINDOWS\system32\drivers\Envy24HF.sys [2007-03-15 09:56]
S3 NPF;NetGroup Packet Filter Driver;D:\WINDOWS\system32\drivers\npf.sys [2007-11-06 13:22]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-08 04:35:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-08 4:36:22
ComboFix-quarantined-files.txt 2008-05-08 11:36:17
ComboFix2.txt 2008-05-08 10:24:30
Pre-Run: 22,615,326,720 bytes free
Post-Run: 22,578,360,320 bytes free
115 --- E O F --- 2008-04-08 18:13:15
HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:49 AM, on 5/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ClamWin\bin\ClamTray.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\SpywareGuard\sgmain.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ClamWin] "D:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1008570530140
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
--
End of file - 5033 bytes
#27
Posted 08 May 2008 - 05:50 AM
RatHat
-
- Expert
-
- 7,829 posts
Ex Malware Expert
Kaspersky only found three files, and we have just got rid of them, so you should be in the clear.
Now lets uninstall Combofix:
Regards,
RatHat
Now lets uninstall Combofix:
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the X and the /u, it needs to be there.
- Go to http://support.f-sec.../home/ols.shtml
- Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
- Allow the Active X control to be installed on your computer, then click the Accept button
- Click Full System Scan and allow the components to download and the scan to complete.
- If malware is found, check Submit samples to F-Secure then select Automatic cleaning
- When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
- Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
- When the cleaning option is presented, Uncheck Submit samples to F-Secure
- Click Automatic cleaning
- When cleaning has finished, click Show report (this will open an Internet Explorer window containing the report)
- Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
- This scan will only work with Internet Explorer
- You must have administrator rights to run this scan
- This scan can take a while, so please be patient
Regards,
RatHat
#28
Posted 08 May 2008 - 06:11 AM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
I guess the kapersky report seemed worse then it was. I uninstalled combofix and am scanning with F-Secure now. I'm starting to sound like a broken record, but I cant thank you enough for all the help, thanks so much 
#29
Posted 08 May 2008 - 08:30 AM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
scan's almost done. looks pretty clean. when i turned spybot resident back on, i got some wierd alerts. i denied them just incase.
5/8/2008 7:09:02 AM Denied (based on user decision) value "" (new data: "") deleted in System Startup user entry!
5/8/2008 7:09:31 AM Denied (based on user decision) value "KernelFaultCheck" (new data: "") deleted in System Startup global entry!
5/8/2008 7:09:37 AM Denied (based on user decision) value "AutoRun" (new data: "") deleted in Command processor!
5/8/2008 7:09:38 AM Denied (based on user decision) value "load" (new data: "") deleted in NT startup!
5/8/2008 7:10:05 AM Denied (based on user decision) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
5/8/2008 7:09:02 AM Denied (based on user decision) value "" (new data: "") deleted in System Startup user entry!
5/8/2008 7:09:31 AM Denied (based on user decision) value "KernelFaultCheck" (new data: "") deleted in System Startup global entry!
5/8/2008 7:09:37 AM Denied (based on user decision) value "AutoRun" (new data: "") deleted in Command processor!
5/8/2008 7:09:38 AM Denied (based on user decision) value "load" (new data: "") deleted in NT startup!
5/8/2008 7:10:05 AM Denied (based on user decision) value "scrnsave.exe" (new data: "") deleted in Desktop settings!
#30
Posted 08 May 2008 - 08:54 AM
Gene323
- Topic Starter
-
- Member
-
- 24 posts
Member
Scanning Report
Thursday, May 08, 2008 04:58:29 - 07:53:44
Computer name: GENE
Scanning type: Scan system for malware, rootkits
Target: C:\ D:\
Result: 2 malware found
Client-IRC.Win32.mIRC (spyware)
* System
Tracking Cookie (spyware)
* System
Statistics
Scanned:
* Files: 101676
* System: 3354
* Not scanned: 345
Actions:
* Disinfected: 0
* Renamed: 0
* Deleted: 0
* None: 2
* Submitted: 0
Files not scanned:
* x�4� SERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\512926BC680B39CF194330DA062309E5_D196ED06-FF3A-4385-9901-7100026AFAF8 C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\77BE4BFC42A85228263075EF47D88062_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\93F0827F9F6B5192572AB3550DF0C341_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A787203265698A42A3688549A8CBAC21_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BD85D2C293BF26FA00BFADDD9B1FBE28_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C760A837B6C6A184DE4B248FF27D5E1E_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D1C7971E6FBF6054EBCAA3764C9D113D_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EA37C00FB3B3363484778754A6B72BE9_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\RECYCLER\NPROTECT\00090244.EXE
* C:\RECYCLER\NPROTECT\00090246.EXE
* C:\RECYCLER\NPROTECT\00090247.ZIP
* C:\RECYCLER\NPROTECT\00090248.ZIP
* C:\RECYCLER\NPROTECT\00090250.EXE
* C:\RECYCLER\NPROTECT\00090251.ZIP
* C:\RECYCLER\NPROTECT\00090252.ZIP
* C:\RECYCLER\NPROTECT\00090253.EXE
* C:\RECYCLER\NPROTECT\00090254.ZIP
* C:\RECYCLER\NPROTECT\00090255.EXE
* C:\RECYCLER\NPROTECT\00090256.EXE
* C:\RECYCLER\NPROTECT\00090257.EXE
* C:\RECYCLER\NPROTECT\00090258.EXE
* C:\RECYCLER\NPROTECT\00090259.EXE
* C:\RECYCLER\NPROTECT\00090260.EXE
* C:\RECYCLER\NPROTECT\00090261.EXE
* C:\RECYCLER\NPROTECT\00090264.DLL
* C:\RECYCLER\NPROTECT\00090265.DLL
* C:\RECYCLER\NPROTECT\00090266.DLL
* C:\RECYCLER\NPROTECT\00090268.DLL
* C:\RECYCLER\NPROTECT\00090269.DLL
* C:\RECYCLER\NPROTECT\00090270.DLL
* C:\RECYCLER\NPROTECT\00090272.DLL
* C:\RECYCLER\NPROTECT\00090273.DLL
* C:\RECYCLER\NPROTECT\00090274.HTM
* C:\RECYCLER\NPROTECT\00090275.EXE
* C:\RECYCLER\NPROTECT\00090285.EXE
* C:\RECYCLER\NPROTECT\00090286.INI
* C:\RECYCLER\NPROTECT\00090320.BIN
* C:\RECYCLER\NPROTECT\00090406.HTM
* C:\RECYCLER\NPROTECT\00090408.MAP
* C:\RECYCLER\NPROTECT\00090409.MAP
* C:\RECYCLER\NPROTECT\00090414
* C:\RECYCLER\NPROTECT\00090467.HTM
* C:\RECYCLER\NPROTECT\00090476.WSF
* C:\RECYCLER\NPROTECT\00090481.HTM
* C:\RECYCLER\NPROTECT\00090552.HTM
* C:\RECYCLER\NPROTECT\00090561.HTM
* C:\RECYCLER\NPROTECT\00090562.HTM
* C:\RECYCLER\NPROTECT\00090563.HTM
* C:\RECYCLER\NPROTECT\00090712
* C:\RECYCLER\NPROTECT\00090736.XML
* C:\RECYCLER\NPROTECT\00090738.XML
* C:\RECYCLER\NPROTECT\00090800.HTM
* C:\RECYCLER\NPROTECT\00090801.HTM
* C:\RECYCLER\NPROTECT\00090826.XML
* C:\RECYCLER\NPROTECT\00090828.XML
* C:\RECYCLER\NPROTECT\00090829.INI
* C:\RECYCLER\NPROTECT\00090830.INI
* C:\RECYCLER\NPROTECT\00090832.XML
* C:\RECYCLER\NPROTECT\00090833.INI
* C:\RECYCLER\NPROTECT\00090835.INI
* C:\RECYCLER\NPROTECT\00090836.INI
* C:\RECYCLER\NPROTECT\00090837.INI
* C:\RECYCLER\NPROTECT\00090838.INI
* C:\RECYCLER\NPROTECT\00090883.HTM
* C:\RECYCLER\NPROTECT\00090946.HTM
* C:\RECYCLER\NPROTECT\00091006.HTM
* C:\RECYCLER\NPROTECT\00091012.HTM
* C:\RECYCLER\NPROTECT\00091071.HTM
* C:\RECYCLER\NPROTECT\00091075.HTM
* C:\RECYCLER\NPROTECT\00091076.HTM
* C:\RECYCLER\NPROTECT\00091077.HTM
* C:\RECYCLER\NPROTECT\00091135.WSF
* C:\RECYCLER\NPROTECT\00091143.HTM
* C:\RECYCLER\NPROTECT\00091156
* C:\RECYCLER\NPROTECT\00091170.HTM
* C:\RECYCLER\NPROTECT\00091202.XML
* C:\RECYCLER\NPROTECT\00091205.XML
* C:\RECYCLER\NPROTECT\00091207V �Y
Options
Scanning engines:
* F-Secure USS: 2.30.0
* F-Secure Blacklight: 1.0.68
* F-Secure Hydra: 2.8.8110, 2008-05-08
* F-Secure Pegasus: 1.20.0, 2008-02-28
* F-Secure AVP: 7.0.171, 2008-05-08
Scanning options:
* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
* Use Advanced heuristics
Copyright © 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
Thursday, May 08, 2008 04:58:29 - 07:53:44
Computer name: GENE
Scanning type: Scan system for malware, rootkits
Target: C:\ D:\
Result: 2 malware found
Client-IRC.Win32.mIRC (spyware)
* System
Tracking Cookie (spyware)
* System
Statistics
Scanned:
* Files: 101676
* System: 3354
* Not scanned: 345
Actions:
* Disinfected: 0
* Renamed: 0
* Deleted: 0
* None: 2
* Submitted: 0
Files not scanned:
* x�4� SERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\512926BC680B39CF194330DA062309E5_D196ED06-FF3A-4385-9901-7100026AFAF8 C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\77BE4BFC42A85228263075EF47D88062_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\93F0827F9F6B5192572AB3550DF0C341_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A787203265698A42A3688549A8CBAC21_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BD85D2C293BF26FA00BFADDD9B1FBE28_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C760A837B6C6A184DE4B248FF27D5E1E_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D1C7971E6FBF6054EBCAA3764C9D113D_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\USERS\ALL USERS.WINDOWSX\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\EA37C00FB3B3363484778754A6B72BE9_D196ED06-FF3A-4385-9901-7100026AFAF8
* C:\RECYCLER\NPROTECT\00090244.EXE
* C:\RECYCLER\NPROTECT\00090246.EXE
* C:\RECYCLER\NPROTECT\00090247.ZIP
* C:\RECYCLER\NPROTECT\00090248.ZIP
* C:\RECYCLER\NPROTECT\00090250.EXE
* C:\RECYCLER\NPROTECT\00090251.ZIP
* C:\RECYCLER\NPROTECT\00090252.ZIP
* C:\RECYCLER\NPROTECT\00090253.EXE
* C:\RECYCLER\NPROTECT\00090254.ZIP
* C:\RECYCLER\NPROTECT\00090255.EXE
* C:\RECYCLER\NPROTECT\00090256.EXE
* C:\RECYCLER\NPROTECT\00090257.EXE
* C:\RECYCLER\NPROTECT\00090258.EXE
* C:\RECYCLER\NPROTECT\00090259.EXE
* C:\RECYCLER\NPROTECT\00090260.EXE
* C:\RECYCLER\NPROTECT\00090261.EXE
* C:\RECYCLER\NPROTECT\00090264.DLL
* C:\RECYCLER\NPROTECT\00090265.DLL
* C:\RECYCLER\NPROTECT\00090266.DLL
* C:\RECYCLER\NPROTECT\00090268.DLL
* C:\RECYCLER\NPROTECT\00090269.DLL
* C:\RECYCLER\NPROTECT\00090270.DLL
* C:\RECYCLER\NPROTECT\00090272.DLL
* C:\RECYCLER\NPROTECT\00090273.DLL
* C:\RECYCLER\NPROTECT\00090274.HTM
* C:\RECYCLER\NPROTECT\00090275.EXE
* C:\RECYCLER\NPROTECT\00090285.EXE
* C:\RECYCLER\NPROTECT\00090286.INI
* C:\RECYCLER\NPROTECT\00090320.BIN
* C:\RECYCLER\NPROTECT\00090406.HTM
* C:\RECYCLER\NPROTECT\00090408.MAP
* C:\RECYCLER\NPROTECT\00090409.MAP
* C:\RECYCLER\NPROTECT\00090414
* C:\RECYCLER\NPROTECT\00090467.HTM
* C:\RECYCLER\NPROTECT\00090476.WSF
* C:\RECYCLER\NPROTECT\00090481.HTM
* C:\RECYCLER\NPROTECT\00090552.HTM
* C:\RECYCLER\NPROTECT\00090561.HTM
* C:\RECYCLER\NPROTECT\00090562.HTM
* C:\RECYCLER\NPROTECT\00090563.HTM
* C:\RECYCLER\NPROTECT\00090712
* C:\RECYCLER\NPROTECT\00090736.XML
* C:\RECYCLER\NPROTECT\00090738.XML
* C:\RECYCLER\NPROTECT\00090800.HTM
* C:\RECYCLER\NPROTECT\00090801.HTM
* C:\RECYCLER\NPROTECT\00090826.XML
* C:\RECYCLER\NPROTECT\00090828.XML
* C:\RECYCLER\NPROTECT\00090829.INI
* C:\RECYCLER\NPROTECT\00090830.INI
* C:\RECYCLER\NPROTECT\00090832.XML
* C:\RECYCLER\NPROTECT\00090833.INI
* C:\RECYCLER\NPROTECT\00090835.INI
* C:\RECYCLER\NPROTECT\00090836.INI
* C:\RECYCLER\NPROTECT\00090837.INI
* C:\RECYCLER\NPROTECT\00090838.INI
* C:\RECYCLER\NPROTECT\00090883.HTM
* C:\RECYCLER\NPROTECT\00090946.HTM
* C:\RECYCLER\NPROTECT\00091006.HTM
* C:\RECYCLER\NPROTECT\00091012.HTM
* C:\RECYCLER\NPROTECT\00091071.HTM
* C:\RECYCLER\NPROTECT\00091075.HTM
* C:\RECYCLER\NPROTECT\00091076.HTM
* C:\RECYCLER\NPROTECT\00091077.HTM
* C:\RECYCLER\NPROTECT\00091135.WSF
* C:\RECYCLER\NPROTECT\00091143.HTM
* C:\RECYCLER\NPROTECT\00091156
* C:\RECYCLER\NPROTECT\00091170.HTM
* C:\RECYCLER\NPROTECT\00091202.XML
* C:\RECYCLER\NPROTECT\00091205.XML
* C:\RECYCLER\NPROTECT\00091207V �Y
Options
Scanning engines:
* F-Secure USS: 2.30.0
* F-Secure Blacklight: 1.0.68
* F-Secure Hydra: 2.8.8110, 2008-05-08
* F-Secure Pegasus: 1.20.0, 2008-02-28
* F-Secure AVP: 7.0.171, 2008-05-08
Scanning options:
* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
* Use Advanced heuristics
Copyright © 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
