Okay, here is what I got.
ComboFix 08-06-11.7 - Nick 2008-06-13 15:11:15.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447 [GMT -4:00]
Running from: C:\Documents and Settings\Nick\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nick\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\6.tmp
C:\Documents and Settings\Dana\Application Data\ASEMBL~1
C:\Documents and Settings\Dana\Application Data\CROSOF~1
C:\Documents and Settings\Dana\Application Data\CROSOF~1.NET
C:\Documents and Settings\Dana\Application Data\CURITY~1
C:\Documents and Settings\Dana\Application Data\FNTS~1
C:\Documents and Settings\Dana\Application Data\FNTS~2
C:\Documents and Settings\Dana\Application Data\ICROSO~1.NET
C:\Documents and Settings\Dana\Application Data\macromedia\Flash Player\#SharedObjects\PQ3XYZFT\www.broadcaster.com
C:\Documents and Settings\Dana\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Dana\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Dana\Application Data\MANTEC~1
C:\Documents and Settings\Dana\Application Data\MCROSO~1.NET
C:\Documents and Settings\Dana\Application Data\RACLE~1
C:\Documents and Settings\Dana\Application Data\RACLE~2
C:\Documents and Settings\Dana\Application Data\SCURIT~1
C:\Documents and Settings\Dana\Application Data\SKS~1
C:\Documents and Settings\Dana\Application Data\SMANTE~1
C:\Documents and Settings\Dana\Application Data\SSEMBL~1
C:\Documents and Settings\Dana\Application Data\STEM~1
C:\Documents and Settings\Dana\Application Data\STEM32~1
C:\Documents and Settings\Dana\Application Data\TSKS~1
C:\Documents and Settings\Dana\Application Data\WNSXS~1
C:\Documents and Settings\Dana\Application Data\YMANTE~1
C:\Documents and Settings\Dana\Application Data\YSTEM~1
C:\Documents and Settings\Dana\My Documents\ASEMBL~1
C:\Documents and Settings\Dana\My Documents\ASKS~1
C:\Documents and Settings\Dana\My Documents\CROSOF~1
C:\Documents and Settings\Dana\My Documents\CROSOF~1.NET
C:\Documents and Settings\Dana\My Documents\CURITY~1
C:\Documents and Settings\Dana\My Documents\DOBE~1
C:\Documents and Settings\Dana\My Documents\FNTS~1
C:\Documents and Settings\Dana\My Documents\ICROSO~1
C:\Documents and Settings\Dana\My Documents\ICROSO~1.NET
C:\Documents and Settings\Dana\My Documents\ICROSO~2
C:\Documents and Settings\Dana\My Documents\MANTEC~1
C:\Documents and Settings\Dana\My Documents\MCROSO~1
C:\Documents and Settings\Dana\My Documents\MCROSO~1.NET
C:\Documents and Settings\Dana\My Documents\RACLE~1
C:\Documents and Settings\Dana\My Documents\SCURIT~1
C:\Documents and Settings\Dana\My Documents\SEMBLY~1
C:\Documents and Settings\Dana\My Documents\SMANTE~1
C:\Documents and Settings\Dana\My Documents\SSEMBL~1
C:\Documents and Settings\Dana\My Documents\SSTEM3~1
C:\Documents and Settings\Dana\My Documents\STEM32~1
C:\Documents and Settings\Dana\My Documents\WNSXS~1
C:\Documents and Settings\Dana\My Documents\YMANTE~1
C:\Documents and Settings\Dana\My Documents\YMBOLS~1
C:\Documents and Settings\Dana\My Documents\YSTEM~1
C:\Documents and Settings\Dana\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Dana\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Dana\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\appatc~1
C:\Program Files\asks~1
C:\Program Files\Common Files\asembl~1
C:\Program Files\Common Files\asks~1
C:\Program Files\Common Files\crosof~1
C:\Program Files\Common Files\crosof~1.net
C:\Program Files\Common Files\curity~1
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\dobe~1\DOBE~1\ctxad-526.0000
C:\Program Files\Common Files\dobe~1\DOBE~1\ctxad-526.0001
C:\Program Files\Common Files\dobe~1\DOBE~1\ctxad-526.0002
C:\Program Files\Common Files\dobe~1\DOBE~1\ctxad-526.0003
C:\Program Files\Common Files\dobe~1\DOBE~1\ctxad-526.0004
C:\Program Files\Common Files\dobe~1\fast.exe
C:\Program Files\Common Files\ecurit~1
C:\Program Files\Common Files\fnts~1
C:\Program Files\Common Files\fnts~2
C:\Program Files\Common Files\icroso~1
C:\Program Files\Common Files\mbols~1
C:\Program Files\Common Files\ppatch~1
C:\Program Files\Common Files\scurit~1
C:\Program Files\Common Files\sembly~1
C:\Program Files\Common Files\smante~1
C:\Program Files\Common Files\smbols~1
C:\Program Files\Common Files\ssembl~1
C:\Program Files\Common Files\sstem~1
C:\Program Files\Common Files\stem~1
C:\Program Files\Common Files\tsks~1
C:\Program Files\Common Files\wnsxs~1
C:\Program Files\Common Files\ymante~1
C:\Program Files\Common Files\ymbols~1
C:\Program Files\Common Files\ystem3~1
C:\Program Files\crosof~1
C:\Program Files\crosof~1.net
C:\Program Files\curity~1
C:\Program Files\ecurit~1
C:\Program Files\fnts~1
C:\Program Files\icroso~1
C:\Program Files\mantec~1
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\pppatc~1
C:\Program Files\racle~1
C:\Program Files\racle~2
C:\Program Files\scurit~1
C:\Program Files\smante~1
C:\Program Files\ssembl~1
C:\Program Files\sstem~1
C:\Program Files\sstem3~1
C:\Program Files\stem~1
C:\Program Files\wnsxs~1
C:\Program Files\ymante~1
C:\Program Files\ystem~1
C:\Program Files\ystem3~1
C:\WINDOWS\appatc~1
C:\WINDOWS\asembl~1
C:\WINDOWS\BM2c413b37.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\dobe~1
C:\WINDOWS\ecurit~1
C:\WINDOWS\fnts~1
C:\WINDOWS\icroso~1
C:\WINDOWS\mantec~1
C:\WINDOWS\mbols~1
C:\WINDOWS\mcroso~1.net
C:\WINDOWS\pskt.ini
C:\WINDOWS\racle~1
C:\WINDOWS\racle~2
C:\WINDOWS\scurit~1
C:\WINDOWS\smante~1
C:\WINDOWS\sstem~1
C:\WINDOWS\sstem3~1
C:\WINDOWS\stem~1
C:\WINDOWS\system32\appatc~1
C:\WINDOWS\system32\asks~1
C:\WINDOWS\system32\awtrPiiI.dll
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\Cache\buts.bin
C:\WINDOWS\system32\Cache\chart 1.bmp
C:\WINDOWS\system32\Cache\comp40.bmp
C:\WINDOWS\system32\Cache\creditcard.bmp
C:\WINDOWS\system32\Cache\ding.bmp
C:\WINDOWS\system32\Cache\disk 1.bmp
C:\WINDOWS\system32\Cache\document.bmp
C:\WINDOWS\system32\Cache\mail unreaded.bmp
C:\WINDOWS\system32\Cache\msg.bin
C:\WINDOWS\system32\Cache\peoples 1.bmp
C:\WINDOWS\system32\Cache\search find 2.bmp
C:\WINDOWS\system32\Cache\showbtn.bmp
C:\WINDOWS\system32\Cache\showbtn1.bmp
C:\WINDOWS\system32\Cache\showbtn12.bmp
C:\WINDOWS\system32\Cache\showbtn123.bmp
C:\WINDOWS\system32\Cache\showbtn1234.bmp
C:\WINDOWS\system32\Cache\valentines copy.bmp
C:\WINDOWS\system32\Cache\web app.bmp
C:\WINDOWS\system32\Cache\web app1.bmp
C:\WINDOWS\system32\cdjsgkhq.dll
C:\WINDOWS\system32\commands.xml
C:\WINDOWS\system32\crosof~1
C:\WINDOWS\system32\curity~1
C:\WINDOWS\system32\dobe~1
C:\WINDOWS\system32\ecurit~1
C:\WINDOWS\system32\eoswuith.dll
C:\WINDOWS\system32\eyripkkd.ini
C:\WINDOWS\system32\fnts~1
C:\WINDOWS\system32\fvqjjomy.ini
C:\WINDOWS\system32\htiuwsoe.ini
C:\WINDOWS\system32\icroso~1
C:\WINDOWS\system32\litypbxf.ini
C:\WINDOWS\system32\ljJDTJBU.dll
C:\WINDOWS\system32\mbols~1
C:\WINDOWS\system32\mcroso~1
C:\WINDOWS\system32\minpflkr.ini
C:\WINDOWS\system32\mslink.dll
C:\WINDOWS\system32\muscira.dll
C:\WINDOWS\system32\netdde.dll
C:\WINDOWS\system32\njinvveq.dll
C:\WINDOWS\system32\ppatch~1
C:\WINDOWS\system32\pppatc~1
C:\WINDOWS\system32\qhkgsjdc.ini
C:\WINDOWS\system32\racle~1
C:\WINDOWS\system32\racle~2
C:\WINDOWS\system32\rklfpnim.dll
C:\WINDOWS\system32\rmxb.dll
C:\WINDOWS\system32\sembly~1
C:\WINDOWS\system32\smante~1
C:\WINDOWS\system32\smante~1\n?lookup.exe
C:\WINDOWS\system32\smbols~1
C:\WINDOWS\system32\ssembl~1
C:\WINDOWS\system32\sstem~1
C:\WINDOWS\system32\sstem3~1
C:\WINDOWS\system32\stem~1
C:\WINDOWS\system32\tjpprgrg.dll
C:\WINDOWS\system32\tqihvuat.dll
C:\WINDOWS\system32\UBJTDJjl.ini
C:\WINDOWS\system32\UBJTDJjl.ini2
C:\WINDOWS\system32\udqxhevs.ini
C:\WINDOWS\system32\urqQhEvT.dll
C:\WINDOWS\system32\vivoisog.dll
C:\WINDOWS\system32\wnsxs~1
C:\WINDOWS\system32\ymbols~1
C:\WINDOWS\system32\ymojjqvf.dll
C:\WINDOWS\tsks~1
C:\WINDOWS\wnsxs~1
C:\WINDOWS\ymbols~1
C:\WINDOWS\ystem~1
C:\WINDOWS\ystem3~1
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_RUNTIME
-------\Legacy_RUNTIME2
((((((((((((((((((((((((( Files Created from 2008-05-13 to 2008-06-13 )))))))))))))))))))))))))))))))
.
2008-06-13 09:15 . 2008-06-13 09:15 <DIR> d-------- C:\Documents and Settings\Tony\Application Data\Apple Computer
2008-06-12 20:13 . 2008-06-12 20:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-12 19:45 . 2008-06-12 19:46 <DIR> d-------- C:\WINDOWS\3DEBCFB2389E419C842E15501ACC8C93.TMP
2008-06-12 19:43 . 2008-06-12 19:43 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\Prevx
2008-06-12 19:42 . 2008-06-12 19:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-06-12 01:42 . 2008-06-12 01:42 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-06-11 11:53 . 2008-04-14 07:01 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-08 20:03 . 2008-06-08 20:03 <DIR> d-------- C:\Program Files\Microsoft Games
2008-06-08 19:58 . 2008-06-08 19:59 <DIR> d-------- C:\Program Files\HeadGames
2008-06-06 23:45 . 2008-04-06 14:30 <DIR> d-------- C:\Program Files\Common Files\àppPatch
2008-06-03 21:08 . 2008-06-03 21:08 <DIR> d-------- C:\Logs
2008-06-03 14:30 . 2008-06-03 14:30 <DIR> d-------- C:\Program Files\World of Warcraft
2008-06-03 14:30 . 2008-06-03 14:30 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-05-29 16:11 . 2008-05-29 16:13 129 --a------ C:\WINDOWS\kaillera.ini
2008-05-13 19:02 . 2008-05-13 19:02 <DIR> d-------- C:\Documents and Settings\Dana\Application Data\Apple Computer
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 03:45 --------- d-----w C:\Program Files\Common Files\??pPatch
2008-05-13 00:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-13 00:51 --------- d-----w C:\Program Files\Apple Software Update
2008-05-13 00:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-12 23:43 --------- d-----w C:\Program Files\QuickTime
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-25 19:00 --------- d-----w C:\Program Files\C-Media
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-21 07:04 659,456 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2008-04-21 07:04 615,936 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-04-21 07:04 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2008-04-21 07:04 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-04-21 07:04 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-04-21 07:04 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-04-21 07:04 3,059,712 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-21 07:04 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2008-04-21 07:04 1,494,528 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-04-21 07:03 96,256 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2008-04-21 07:03 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2008-04-21 07:03 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-04-21 07:03 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2008-04-21 07:03 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-04-21 07:03 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2008-04-21 07:03 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-04-21 07:03 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll
2008-04-21 07:03 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2008-04-17 10:52 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2008-04-16 00:17 --------- d-----w C:\Documents and Settings\Dana\Application Data\My Games
2008-04-15 19:21 --------- d-----w C:\Documents and Settings\Nick\Application Data\My Games
2008-04-15 19:05 --------- d-----w C:\Program Files\Firaxis Games
2008-04-14 11:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-03-27 17:50 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2005-09-29 20:03 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2005-05-30 14:01 88,576 --sh--r C:\Documents and Settings\NetworkService\Application Data\ctan.exe
2005-05-09 15:51 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2005-04-21 20:00 280,064 ----a-w C:\Documents and Settings\Tony\Application Data\tizhook.bin
2005-04-21 20:00 152,804 ----a-w C:\Documents and Settings\Tony\Application Data\tizupd.bin
2005-04-20 19:26 280,064 ----a-w C:\Documents and Settings\Dana\Application Data\tizhook.bin
2005-04-20 19:26 152,804 ----a-w C:\Documents and Settings\Dana\Application Data\tizupd.bin
2005-04-20 17:14 280,064 ----a-w C:\Documents and Settings\Nick\Application Data\tizhook.bin
2005-04-20 17:14 152,804 ----a-w C:\Documents and Settings\Nick\Application Data\tizupd.bin
2004-08-30 04:41 456 ----a-w C:\Program Files\INSTALL.LOG
2004-03-21 00:04 40,960 --sha-w C:\WINDOWS\lbbho.dll
2005-05-25 13:17 430,080 --sh--r C:\WINDOWS\system32\w?nspool.exe
2006-04-13 22:12 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2006-04-13 22:12 56 --sh--r C:\WINDOWS\system32\AA808BCAAF.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CF9DDF1-6044-319F-6802-1EB329B854B6}]
2005-04-21 10:42 163840 --a------ C:\WINDOWS\system32\udectbd.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 15:35 67112]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 20:04 5562368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"anvshell"="anvshell.exe" []
"zSPGuard"="c:\program files\pjw\spguard\spguard.exe" [ ]
"nwiz"="nwiz.exe" [2004-07-15 11:42 843776 C:\WINDOWS\system32\nwiz.exe]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2006-06-06 22:14 100056]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 21:02 180269]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-13 13:20 59040]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-15 11:42 4112384]
"C-Media Mixer"="Mixer.exe" [2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-12 19:43 413696]
"PrevxOne"="C:\Program Files\Prevx2\PXConsole.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"SSS6_Suite"="C:\Program Files\Steganos Security Suite 6\sss.exe" [ ]
"SSS6_SAFE"="C:\Program Files\Steganos Security Suite 6\safe.exe" [ ]
"SSS6_SPM"="C:\Program Files\Steganos Security Suite 6\spm.exe" [ ]
"Jfpocj"="C:\WINDOWS\system32\w?nspool.exe" [2001-09-26 04:30 2112]
"Euba"="C:\Program Files\sraa\ctan.exe" [ ]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 20:04 5562368]
C:\Documents and Settings\Dana\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2005-07-18 20:01:08 256000]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
CreataCard Gold 2 Forget Me Not Reminders.lnk - C:\Program Files\CreataCard\Gold\FMRMD32.EXE [2004-05-27 15:11:12 55296]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccaXPji]
fccaXPji.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= netdde.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I263"= i263_32.drv
"SENTINEL"= snti386.dll
"VIDC.CTRX"= ctrxvid.drv
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
--a------ 2006-08-01 15:35 67112 C:\Program Files\AIM\aim.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2006-11-07 11:29 50736 C:\Program Files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
--a------ 2006-04-13 13:20 59040 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
--a------ 2003-08-19 05:43 57344 C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]
--a------ 2006-09-07 21:02 208941 C:\Program Files\Real\RealPlayer\realplay.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-09-07 21:02 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2005-02-24 11:57 2506752 C:\Program Files\Yahoo!\Messenger\ypager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\WINDOWS\\System32\\lexpps.exe"=
"C:\\Program Files\\messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Mozilla Firefox\\FIREFOX.EXE"=
"C:\\Program Files\\Real\\RealPlayer\\trueplay.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"94:TCP"= 94:TCP:VRS Recording System Web Control Panel
"81:TCP"= 81:TCP:Axon Virtual PBX Web Server
R1 NPPTNT;NPPTNT;C:\WINDOWS\System32\npptNT.sys [2003-07-22 02:14]
S3 gAGP440p;gAGP440p;C:\DOCUME~1\Nick\LOCALS~1\Temp\gAGP440p.sys []
.
Contents of the 'Scheduled Tasks' folder
"2008-06-13 18:56:34 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
"2008-06-07 02:01:04 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Nick.job"
- C:\PROGRA~1\NORTON~1\Navw32.exeh/task:
"2008-06-10 21:37:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-06-13 15:18:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSSdk21]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\HNPsSdk.drv"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2008-06-13 15:21:07 - machine was rebooted [Nick]
ComboFix-quarantined-files.txt 2008-06-13 19:21:04
Pre-Run: 1,240,825,856 bytes free
Post-Run: 1,141,866,496 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
432 --- E O F --- 2008-06-12 05:42:16
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:48:11 PM, on 6/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://red.clientapp...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CF9DDF1-6044-319F-6802-1EB329B854B6} - C:\WINDOWS\system32\udectbd.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-19\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6\sss.exe" /booting (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [SSS6_SAFE] "C:\Program Files\Steganos Security Suite 6\safe.exe" /booting (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [SSS6_SPM] "C:\Program Files\Steganos Security Suite 6\spm.exe" /booting (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6\sss.exe" /booting (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6\sss.exe" /booting (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6\sss.exe" /booting (User 'Default user')
O4 - Global Startup: CreataCard Gold 2 Forget Me Not Reminders.lnk = C:\Program Files\CreataCard\Gold\FMRMD32.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O20 - AppInit_DLLs: netdde.dll
O20 - Winlogon Notify: fccaXPji - fccaXPji.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 7842 bytes
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, June 13, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, June 13, 2008 18:36:27
Records in database: 860715
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
A:\
C:\
D:\
Scan statistics
Files scanned 99220
Threat name 38
Infected objects 155
Suspicious objects 0
Duration of the scan 02:32:50
File name Threat name Threats count
C:\WINDOWS\system32\udectbd.dll/C:\WINDOWS\system32\udectbd.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1
C:\WINDOWS\system32\udectbd.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak 1
C:\WINDOWS\system32\wіnspool.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ca 1
C:\WINDOWS\system32\~.exe Infected: Trojan-Downloader.Win32.Agent.bga 1
C:\WINDOWS\lbbho.dll Infected: not-a-virus:AdWare.Win32.RelatedLinks.d 1
C:\Documents and Settings\NetworkService\Application Data\ctan.exe Infected: Trojan-Downloader.Win32.PurityScan.bc 1
C:\Documents and Settings\Nick\Application Data\tizupd.bin Infected: not-a-virus:AdWare.Win32.PurityScan.w 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv325.jar-16755cfa-47a7aa44.zip Infected: Trojan-Downloader.Java.OpenStream.c 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-35d226fb-1d509d96.zip Infected: Trojan.Java.ClassLoader.k 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive1213.jar-366118ff-36795e9e.zip Infected: Trojan.Java.ClassLoader.ak 2
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive1213.jar-366118ff-36795e9e.zip Infected: Trojan-Downloader.Java.OpenConnection.ah 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ie0601a.jar-523da84a-48ec748c.zip Infected: Trojan.Java.ClassLoader.aq 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ie0601a.jar-523da84a-48ec748c.zip Infected: Trojan-Downloader.Java.OpenStream.z 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-445c4b18-4ace2ada.zip Infected: Trojan.Java.ClassLoader.ao 3
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ie0601a.jar-686cd5c0-1abddba6.zip Infected: Trojan.Java.ClassLoader.aq 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ie0601a.jar-686cd5c0-1abddba6.zip Infected: Trojan-Downloader.Java.OpenStream.z 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-79d29352.zip Infected: Trojan.Java.ClassLoader.ao 3
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-4293731d.zip Infected: Trojan.Java.ClassLoader.i 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-4293731d.zip Infected: Trojan.Java.ClassLoader.k 2
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\1\7f5fb3c1-6ebf8e88 Infected: Trojan-Downloader.Java.OpenStream.c 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\1\7f5fb3c1-6ebf8e88 Infected: Trojan.Java.ClassLoader.h 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\1\7f5fb3c1-6ebf8e88 Infected: Trojan.Java.ClassLoader.d 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\3\3b5b3043-29d3ed1b Infected: Trojan.Java.ClassLoader.ak 2
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\3\3b5b3043-29d3ed1b Infected: Trojan-Downloader.Java.OpenConnection.ah 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\14\444964e-30bda59f Infected: Trojan.Java.ClassLoader.k 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\15\a91cf4f-7d9f9b51 Infected: Trojan.Java.ClassLoader.aq 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\15\a91cf4f-7d9f9b51 Infected: Trojan-Downloader.Java.OpenStream.z 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\20\7328ad54-71c49067 Infected: Trojan.Java.ClassLoader.ao 3
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\23\1d19b497-73b38265 Infected: Trojan.Java.ClassLoader.ao 3
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-4065b8fd Infected: Trojan.Java.ClassLoader.i 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\24\3e021ed8-4065b8fd Infected: Trojan.Java.ClassLoader.k 2
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\25\2365d359-415d4f05 Infected: Trojan.Java.ClassLoader.as 3
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\37\19b63ba5-1658c87f Infected: Trojan.Java.ClassLoader.ao 3
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\44\65cf59ac-253ed0fa Infected: Trojan-Downloader.Java.OpenConnection.aj 2
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\44\65cf59ac-253ed0fa Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\49\4db115b1-34562f79 Infected: Trojan.Java.ClassLoader.aq 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\49\4db115b1-34562f79 Infected: Trojan-Downloader.Java.OpenStream.z 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\61\452ed83d-56edb193 Infected: Trojan-Downloader.Java.OpenStream.c 1
C:\Documents and Settings\Tony\Application Data\Sun\Java\Deployment\cache\6.0\62\70a93cfe-721e9a32 Infected: Exploit.Java.Gimsh.a 1
C:\Documents and Settings\Tony\Application Data\tizupd.bin Infected: not-a-virus:AdWare.Win32.PurityScan.w 1
C:\Documents and Settings\Dana\My Documents\LimeWire\Saved\breathe me sia.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Dana\Desktop\Piano Music and Other Music\Limewire Music\breathe me sia.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-516ac74a-2d7ba12b.zip Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-516ac74a-2d7ba12b.zip Infected: Trojan-Downloader.Java.OpenConnection.aa 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-160dd9ae-103b68b7.zip Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-160dd9ae-103b68b7.zip Infected: Trojan-Downloader.Java.OpenConnection.aa 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-25df0b80-36196719.zip Infected: Trojan.Java.Femad 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-25df0b80-36196719.zip Infected: Trojan-Downloader.Win32.Small.dmj 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\6.0\20\7c7c4754-56479d7a Infected: Trojan.Java.Femad 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\6.0\20\7c7c4754-56479d7a Infected: Trojan-Downloader.Win32.Small.dmj 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\6.0\34\61118e2-3e85bb8e Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\6.0\34\61118e2-3e85bb8e Infected: Trojan-Downloader.Java.OpenConnection.aa 1
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\6.0\41\200ae869-5fd21d64 Infected: Exploit.Java.ByteVerify 2
C:\Documents and Settings\Dana\Application Data\Sun\Java\Deployment\cache\6.0\41\200ae869-5fd21d64 Infected: Trojan-Downloader.Java.OpenConnection.aa 1
C:\Documents and Settings\Dana\Application Data\tizupd.bin Infected: not-a-virus:AdWare.Win32.PurityScan.w 1
C:\Program Files\Norton AntiVirus\Quarantine\72C2280C.cla Infected: Exploit.Java.ByteVerify 1
C:\Program Files\Norton AntiVirus\Quarantine\72C65208.cla Infected: Exploit.Java.ByteVerify 1
C:\Program Files\Norton AntiVirus\Quarantine\21153AE1.cla Infected: Trojan.Java.Femad 1
C:\Program Files\Norton AntiVirus\Quarantine\2A572B29.tmp Infected: Exploit.Java.ByteVerify 1
C:\Program Files\Norton AntiVirus\Quarantine\5BC527E5.tmp Infected: Exploit.Java.ByteVerify 1
C:\Program Files\Norton AntiVirus\Quarantine\04195E72.tmp Infected: Trojan.Java.Femad 1
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1590\A0353096.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1589\A0353032.dll Infected: not-a-virus:AdWare.Win32.PurityScan.if 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1589\A0353033.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1589\A0353035.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1591\A0354082.dll Infected: not-a-virus:AdWare.Win32.PurityScan.if 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1553\A0348190.dll Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1553\A0348191.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1553\A0348191.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bu 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1553\A0349182.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1595\A0354304.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1595\A0354305.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1595\A0354306.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1595\A0354307.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1595\A0354308.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1595\A0355460.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1571\A0349885.dll Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1571\A0349886.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1571\A0349890.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1572\A0349925.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1572\A0349929.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1572\A0349951.dll Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1578\A0350167.DLL Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1578\A0350168.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1578\A0350172.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1582\A0350310.DLL Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1582\A0350313.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355640.exe Infected: Trojan-Downloader.Win32.PurityScan.ek 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355641.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hh 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355644.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355645.exe Infected: not-a-virus:AdWare.Win32.PurityScan.id 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355646.dll Infected: Trojan-Downloader.Win32.Agent.bga 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355647.DLL Infected: not-a-virus:AdWare.Win32.PurityScan.en 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355650.DLL Infected: Trojan-Clicker.Win32.Agent.kl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355651.DLL Infected: not-a-virus:AdWare.Win32.PurityScan.if 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355652.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355653.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355654.DLL Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355655.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355656.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355657.DLL Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355658.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355659.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355660.DLL Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1598\A0355661.dll Infected: Trojan.Win32.Monder.gen 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1558\A0349516.DLL Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1558\A0349520.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1558\A0349547.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1559\A0349560.dll Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1562\A0349670.DLL Infected: not-a-virus:AdWare.Win32.PurityScan.hk 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1562\A0349671.exe Infected: not-a-virus:AdWare.Win32.PurityScan.hl 1
C:\System Volume Information\_restore{D689DE2D-9230-4244-870D-AE9ECC6AE91F}\RP1562\A0349675.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\QooBox\Quarantine\C\Program Files\Common Files\DOBE~1\fast.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ek 1
C:\QooBox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.hh 1
C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
C:\QooBox\Quarantine\C\WINDOWS\system32\SMANTE~1\nѕlookup.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.id 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mslink.dll.vir Infected: Trojan-Downloader.Win32.Agent.bga 1
C:\QooBox\Quarantine\C\WINDOWS\system32\netdde.dll.vir Infected: not-a-virus:AdWare.Win32.PurityScan.en 1
C:\QooBox\Quarantine\C\WINDOWS\system32\muscira.dll.vir Infected: Trojan-Clicker.Win32.Agent.kl 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rmxb.dll.vir Infected: not-a-virus:AdWare.Win32.PurityScan.if 1
C:\QooBox\Quarantine\C\WINDOWS\system32\awtrPiiI.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cdjsgkhq.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\eoswuith.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\njinvveq.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rklfpnim.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\