Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

can't get mbam to install Virus help, browser going screwy [Solved

Started by Araceli79 , Jan 20 2009 02:20 AM

  • This topic is locked This topic is locked

#1
Araceli79
Posted 20 January 2009 - 02:20 AM

Araceli79

    New Member

  • Member
  • Pip
  • 7 posts
My internet browser, Mozilla firefox, recently updated itself and i noticed that zfsearch is now appearing in my status bar. Since then when i open up sites that i have always opened before i get blank pages. For example google will come up blank and then i have to open it up repeatedly until it finally comes up. Pages i normally visit do not load correctly, my browser freezes and then shuts down. I tried the information on the "You Must Read This Before Posting A Hijackthis Log, Malware Cleaning Guide" and i could only so some of the things. When i tried to open up pages they came up blank. I was able to do the ATF cleaner, Erunt, and Hijack This. I could never get the Malwarebytes to run. I was able to install it under a different name but no matter what it would not run, it would appear in processes under my task manager but no luck running. Yesterday a virus (hacktool.rootkit) was detected by norton and I cleaned it up in safe mode and it doesn't appear to be back, YET. I am at a loss, please help. I researched zfsearch on 247fixes.com and came across gooredfix and tried it after writing this report and ran hijacjthis again. my newhjt log is at the bottom. I also noticed that when i turned on my computer again this morning the same thing happened, when i opened my browser, a pop up appeared stating that a 1 new add-on was downloaded, but i did not do that.

Here is my hjt log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:41:18 AM, on 1/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\NavNT\rtvscan.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [Cxilitifefeqacol] rundll32.exe "C:\WINDOWS\Jcewazetijo.dll",e
O4 - HKLM\..\Run: [Xcotef] rundll32.exe "C:\WINDOWS\uwajulowunika.dll",e
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.att.net
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/...UI.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {21BB8360-F943-447E-98F3-3C22345375A7} (CPlayFirstChocolatieControl Object) - http://zone.msn.com/...eb.1.0.0.15.cab
O16 - DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} (CPlayFirstmsiControl Object) - http://aolsvc.aol.co...Web.1.0.0.8.cab
O16 - DPF: {226ACC34-3194-70E2-5AE7-864FCFE9E80D} (CPlayFirstmsiControl Object) - http://zone.msn.com/...msi.1.0.0.9.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/...nx.1.0.0.87.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/...dy.cab55579.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} - http://zone.msn.com/...pandaonline.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/...bGameLoader.cab
O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} (CPlayFirstPiratePoppersControl Object) - http://zone.msn.com/...rs.1.0.0.39.cab
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/...pcaploader1.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/...at.cab55579.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://zone.msn.com/...h2.1.0.0.55.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1142043471687
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/...t/atomaders.cab
O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://aolsvc.aol.co...ash.1.0.0.6.cab
O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} (Abx(gh) Control) - http://aolsvc.aol.co...eball/abxgh.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://aolsvc.aol.co...houseplayer.cab
O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} (CPlayFirstdreamControl Object) - http://aolsvc.aol.co...web.1.0.0.9.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/...mjolauncher.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/...O1.cab60096.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn...gr.cab31267.cab
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.co...esPlayer_v4.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://aolsvc.aol.co...tg.1.0.0.33.cab
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} (BewitchedGameClass Control) - http://aolsvc.aol.co...itched/main.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.co...zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.co...eb.1.0.0.16.cab
O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/...ersion=1,0,0,10
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {D40F5876-A494-4124-8161-82625BB28C06} (CPlayFirstChocolatieControl Object) - http://aolsvc.aol.co...eb.1.0.0.14.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://media.grab.co...outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/.../default/ct.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/...xy.cab55579.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/...WebLauncher.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/...sh.1.0.0.89.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/...ploader_v10.cab
O16 - DPF: {E41BA393-9078-424E-9554-9DB5126F5F4C} (CPlayFirstDreamChronControl Object) - http://aolsvc.aol.co...eb.1.0.0.13.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {E9B80D94-D8BC-43DE-9138-75605A8D9666} (CPlayFirstWeddingDasControl Object) - http://zone.msn.com/...sh.1.0.0.50.cab
O16 - DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} (CPlayFirstSweetopiaControl Object) - http://zone.msn.com/...ia.1.0.0.46.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{98E93716-9893-40A2-9634-B054315665E3}: NameServer = 192.168.13.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7589C7C-107B-4A42-9103-3C9B6DF40B50}: NameServer = 192.168.13.1,207.69.188.185
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe

--
End of file - 15867 bytes


Here is my uninstall_list:

$100,000 Pyramid
A Series of Unfortunate Events (remove only)
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Photoshop 5.5
Adobe Reader 8.1.2
Adobe Shockwave Player 11
Agere Systems PCI Soft Modem
Air Utility
Alchemy and Bejeweled Pack
American Greetings® Art & More Store
ANIO Service
ANIWZCS Service
Apple Mobile Device Support
Apple Software Update
ArcSoft Panorama Maker 4
ATI Control Panel
ATI Display Driver
Audacity 1.2.4
Banctec Service Agreement
Beetle Bug 2 (remove only)
Big Fish Games Client
BitPim 0.9.09
BitTorrent 4.0.1
Bookworm Adventures Deluxe 1.0
Broadcom Advanced Control Suite 2
BroadJump Client Foundation
Carrie the Caregiver (remove only)
Chuzzle Deluxe 1.0
Ciao Bella (remove only)
Clue
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
Cradle of Rome (remove only)
Dell Driver Reset Tool
Dell Media Experience
Dell Photo Printer 720
Dell Support
Disney's Mahjongg
DivX
DivX Player
DLA
Dream Day Wedding
Dream Vacation Solitaire (remove only)
ERUNT 1.1j
Fairy Jewels (remove only)
Family Feud
Fantastic Flame Screensaver
File Uploader
FirstClass® Client
Flower Shop Big City Break
Frogger v3.0e
Frogger2
Google Photos Screensaver
Google Updater
Greetings Workshop
Hardwood Solitaire III Lite
Hidden Expedition Titanic (remove only)
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
hp dvd writer
HP Imaging Device Functions 6.0
HP Photosmart Cameras 6.0
HP Photosmart Essential
HP Software Update
HP Solution Center and Imaging Support Tools 6.0
igLoader
Insaniquarium Deluxe 1.0
Intel Application Accelerator
Internet Explorer Default Page
iTunes
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2_03
Java 2 Runtime Environment, SE v1.4.2_06
Learn2 Player (Uninstall Only)
LiveUpdate 1.6 (Symantec Corporation)
Logitech iTouch Software
Logitech MouseWare 9.79
Luxor Mahjong (remove only)
Macromedia Shockwave Player
Magic Academy (remove only)
Magic Ball 3 (remove only)
Mahjong Match (remove only)
Malwarebytes' Anti-Malware
Maui Wowee 1.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Disc 2
Microsoft Office FrontPage 2003
Microsoft Office XP Professional
Microsoft Pandora's Box
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.52
Mirror Magic Deluxe (remove only)
Moraff's Maximum MahJongg 1.0
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Musicmatch for Windows Media Player
Musicmatch® Jukebox
Mystery Case Files - Prime Suspects (remove only)
Mystery Case Files - Ravenhearst (remove only)
Mystery Case Files Huntsville
Mystery Solitaire - Secret Island (remove only)
Network Stumbler 0.4.0 (remove only)
Nikon Message Center
Nikon Transfer
Norton AntiVirus Corporate Edition
PC Inspector File Recovery
Peggle (remove only)
Photo Story 3 for Windows
Plantasia (remove only)
PopCap Browser Plugin
PowerDVD
PrintMaster 7.00
Puzz-3D Victorian Mansion
QuickTime
Rainbow Mystery
RealPlayer
RecordNow
Samsung ML-2010 Series
SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
Sandlot Games Client Services
Sandlot Games Client Services 1.2.2
Scratches
Secret Chamber
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Serif DrawPlus 3.0
Shockwave
Simple Backup
Slingo
Slot Words
SolSuite
SolSuite 2000 v4.0
SolSuite Graphics Pack
SoundMAX
Sprint media manager
Sprint PCS Connection Manager
Sproink (remove only)
Spybot - Search & Destroy
Spybot - Search & Destroy 1.3
SSH Secure Shell
Stand O`Food (remove only)
Super Granny 3 (remove only)
Sweetopia (remove only)
TBS WMP Plug-in
Tetris (remove only)
The Da Vinci Code (remove only)
The Game Of Life
The Next Tetris
The Rise of Atlantis (remove only)
Travelogue 360 Paris (remove only)
Tweakui Powertoy for Windows XP
Uno™ CD-Rom
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
VideoLAN VLC media player 0.8.5
Viewpoint Media Player
Wheel Of Fortune
WildTangent Web Driver
Winamp
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Service Pack 3
WinMX
WordPerfect Office 12
XviD MPEG-4 Video Codec
Yahoo! Install Manager
Yahoo! Messenger

New hjt log after gooredfix:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:54:22 AM, on 1/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\NavNT\rtvscan.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [Cxilitifefeqacol] rundll32.exe "C:\WINDOWS\Jcewazetijo.dll",e
O4 - HKLM\..\Run: [Xcotef] rundll32.exe "C:\WINDOWS\uwajulowunika.dll",e
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.att.net
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/...UI.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {21BB8360-F943-447E-98F3-3C22345375A7} (CPlayFirstChocolatieControl Object) - http://zone.msn.com/...eb.1.0.0.15.cab
O16 - DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} (CPlayFirstmsiControl Object) - http://aolsvc.aol.co...Web.1.0.0.8.cab
O16 - DPF: {226ACC34-3194-70E2-5AE7-864FCFE9E80D} (CPlayFirstmsiControl Object) - http://zone.msn.com/...msi.1.0.0.9.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/...nx.1.0.0.87.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/...dy.cab55579.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} - http://zone.msn.com/...pandaonline.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/...bGameLoader.cab
O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} (CPlayFirstPiratePoppersControl Object) - http://zone.msn.com/...rs.1.0.0.39.cab
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/...pcaploader1.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/...at.cab55579.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://zone.msn.com/...h2.1.0.0.55.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1142043471687
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/...t/atomaders.cab
O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://aolsvc.aol.co...ash.1.0.0.6.cab
O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} (Abx(gh) Control) - http://aolsvc.aol.co...eball/abxgh.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://aolsvc.aol.co...houseplayer.cab
O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} (CPlayFirstdreamControl Object) - http://aolsvc.aol.co...web.1.0.0.9.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/...mjolauncher.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/...O1.cab60096.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn...gr.cab31267.cab
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.co...esPlayer_v4.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://aolsvc.aol.co...tg.1.0.0.33.cab
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} (BewitchedGameClass Control) - http://aolsvc.aol.co...itched/main.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.co...zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.co...eb.1.0.0.16.cab
O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/...ersion=1,0,0,10
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {D40F5876-A494-4124-8161-82625BB28C06} (CPlayFirstChocolatieControl Object) - http://aolsvc.aol.co...eb.1.0.0.14.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://media.grab.co...outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/.../default/ct.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/...xy.cab55579.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/...WebLauncher.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/...sh.1.0.0.89.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/...ploader_v10.cab
O16 - DPF: {E41BA393-9078-424E-9554-9DB5126F5F4C} (CPlayFirstDreamChronControl Object) - http://aolsvc.aol.co...eb.1.0.0.13.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {E9B80D94-D8BC-43DE-9138-75605A8D9666} (CPlayFirstWeddingDasControl Object) - http://zone.msn.com/...sh.1.0.0.50.cab
O16 - DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} (CPlayFirstSweetopiaControl Object) - http://zone.msn.com/...ia.1.0.0.46.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{98E93716-9893-40A2-9634-B054315665E3}: NameServer = 192.168.13.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7589C7C-107B-4A42-9103-3C9B6DF40B50}: NameServer = 192.168.13.1,207.69.188.185
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe

--
End of file - 15778 bytes


Gooredlog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:54:22 AM, on 1/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\NavNT\rtvscan.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [Cxilitifefeqacol] rundll32.exe "C:\WINDOWS\Jcewazetijo.dll",e
O4 - HKLM\..\Run: [Xcotef] rundll32.exe "C:\WINDOWS\uwajulowunika.dll",e
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIC

Edited by Araceli79, 20 January 2009 - 06:20 AM.

  • 0

Advertisements

#2
kahdah
Posted 20 January 2009 - 07:00 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Hello Araceli79

Welcome to G2Go. :)
=====================
Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.
===========
Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
Post the contents of GMER.txt in your next reply.
  • 0

#3
Araceli79
Posted 20 January 2009 - 05:23 PM

Araceli79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
I had trouble opening the links i kept getting blank pages again but someone from live chat was able to send it to me. Also I had trouble running GMER. The same thing happened that happened yesterday when i tried to run malwarebytes, I would hit run and nothing would ever come up but i could see it under my task manager processes. I decided to give Malwarebytes another try, i renamed it and it finally was able to run and scan my computer, i scanned it twice. I've included the 2 logs for this at the end.

DDS.txt:

DDS (Ver_09-01-18.01) - NTFSx86
Run by Celi at 16:36:12.93 on Tue 01/20/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.142 [GMT -6:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
C:\WINDOWS\system32\rundll32.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe
C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Celi\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://yahoo.sbc.com/dsl
uDefault_Page_URL = hxxp://www.dell4me.com/mywaybiz
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [jsf8uiw3jnjgffght] c:\docume~1\celi\locals~1\temp\winlogin.exe
uRun: [tezrtsjhfr84iusjfo84f] c:\docume~1\celi\locals~1\temp\csrssc.exe
uRun: [ttool] c:\windows\9129837.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [IAAnotif] c:\program files\intel\intel application accelerator\iaanotif.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [vptray] c:\program files\navnt\vptray.exe
mRun: [zBrowser Launcher] c:\program files\logitech\itouch\iTouch.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [WildTangent CDA] "c:\program files\wildtangent\apps\cda\gamedrvr.exe" /startup "c:\program files\wildtangent\apps\cda\cdaEngine0500.dll"
mRun: [DVDBitSet] "c:\program files\hp cd-dvd\umbrella\DVDBitSet.exe" /NOUI
mRun: [DVDTray] "c:\program files\hp cd-dvd\umbrella\DVDTray.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Samsung Common SM] "c:\windows\samsung\comsmmgr\ssmmgr.exe" /autorun
mRun: [D-Link Air Utility] c:\program files\d-link\air utility\AirCFG.exe
mRun: [ANIWZCSService] c:\program files\alpha networks\aniwzcs service\WZCSLDR.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Nikon Transfer Monitor] c:\program files\common files\nikon\monitor\NkMonitor.exe
mRun: [jsf8uiw3jnjgffght] c:\docume~1\celi\locals~1\temp\winlogin.exe
mRun: [Cxilitifefeqacol] rundll32.exe "c:\windows\Jcewazetijo.dll",e
mRun: [Xcotef] rundll32.exe "c:\windows\uwajulowunika.dll",e
StartupFolder: c:\docume~1\celi\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\celi\startm~1\programs\startup\sprint~1.lnk - c:\windows\RM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nikonm~1.lnk - c:\program files\common files\nikon\monitor\NkMonitor.exe
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
Trusted Zone: att.net
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com\clientapps
TCP: {98E93716-9893-40A2-9634-B054315665E3} = 192.168.13.1
TCP: {A7589C7C-107B-4A42-9103-3C9B6DF40B50} = 192.168.13.1,207.69.188.185
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\celi\applic~1\mozilla\firefox\profiles\l4bjtn7d.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\celi\application data\mozilla\firefox\profiles\l4bjtn7d.default\extensions\[email protected]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npigl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {949D951B-35C2-487D-9E91-DCB0C74B68CB} - c:\documents and settings\celi\local settings\application data\{949D951B-35C2-487D-9E91-DCB0C74B68CB}

============= SERVICES / DRIVERS ===============

R3 NAVAP;NAVAP;c:\program files\navnt\navap.sys [2001-9-24 176208]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090114.017\NAVENG.sys [2009-1-15 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090114.017\NAVEX15.sys [2009-1-15 876112]
R3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;c:\windows\system32\drivers\NETR33X.sys [2003-11-11 183680]
R4 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2001-9-24 9232]
R4 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2001-9-24 454656]
S1 494b57d3;494b57d3;c:\windows\system32\drivers\494b57d3.sys [2009-1-18 0]
S3 new_drv;!!!!;\??\c:\windows\new_drv.sys --> c:\windows\new_drv.sys [?]
S3 SM_ml1600_FUService;ML-2010 Status Monitor Service;"c:\program files\samsung ml-2010 series\commonsm\ssmsrvc /service --> c:\program files\samsung ml-2010 series\commonsm\ssmsrvc [?]
S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [2005-2-5 72576]

=============== Created Last 30 ================

2009-01-20 01:26 2,737,540 a------- C:\skittles.exe
2009-01-20 01:22 1,924,249 a------- C:\mbam-rules.exe
2009-01-20 01:15 <DIR> --d----- c:\program files\Trend Micro
2009-01-19 23:36 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-19 23:36 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-19 23:36 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-19 23:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-01-19 18:17 664 a------- c:\windows\system32\d3d9caps.dat
2009-01-18 22:43 133,120 a------- c:\windows\uwajulowunika.dll
2009-01-18 22:30 41,984 a------- c:\windows\Jcewazetijo.dll
2009-01-18 22:30 705 a------- C:\dmlt.exe
2009-01-18 22:30 0 a------- c:\windows\system32\drivers\494b57d3.sys
2009-01-18 22:30 41,984 a------- C:\tvtuvy.exe
2009-01-18 22:30 2 a------- C:\2020383686
2009-01-18 22:30 15,000 a------- c:\windows\system32\hgfdge4unjdfdg.dll

==================== Find3M ====================

2009-01-08 16:52 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLdu.DAT
2008-12-13 00:40 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 04:57 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-12-11 04:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-10-24 05:21 455,296 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 06:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-23 06:36 286,720 -------- c:\windows\system32\dllcache\gdi32.dll
2008-09-30 17:35 114,344 a------- c:\docume~1\celi\applic~1\GDIPFONTCACHEV1.DAT
2005-06-24 20:38 774,144 a------- c:\program files\RngInterstitial.dll
2008-08-22 20:48 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082220080823\index.dat

============= FINISH: 16:37:45.57 ===============


Attach.txt:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-01-18.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 12/23/2004 5:06:04 PM
System Uptime: 1/20/2009 4:05:26 PM (0 hours ago)

Motherboard: Dell Inc. | | 0J3492
Processor: Intel® Pentium® 4 CPU 3.40GHz | Microprocessor | 3391/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 72 GiB total, 41.941 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

$100,000 Pyramid
A Series of Unfortunate Events (remove only)
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Photoshop 5.5
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player 11
Agere Systems PCI Soft Modem
Air Utility
Alchemy and Bejeweled Pack
American Greetings® Art & More Store
ANIO Service
ANIWZCS Service
Apple Mobile Device Support
Apple Software Update
ArcSoft Panorama Maker 4
ATI Control Panel
ATI Display Driver
Audacity 1.2.4
AutoUpdate
Banctec Service Agreement
Beetle Bug 2 (remove only)
Big Fish Games Client
BitPim 0.9.09
BitTorrent 4.0.1
Bookworm Adventures Deluxe 1.0
Broadcom Advanced Control Suite 2
BroadJump Client Foundation
BufferChm
Cake Mania Deluxe
CameraDrivers
CameraUserGuides
Carrie the Caregiver (remove only)
Chuzzle Deluxe 1.0
Ciao Bella (remove only)
Clue
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
Cradle of Rome (remove only)
Dell Driver Reset Tool
Dell Media Experience
Dell Networking Guide
Dell Photo Printer 720
Dell Support
Dell System Restore
Destinations
DeviceManagementQFolder
Disney's Mahjongg
DivX
DivX Player
DLA
Dream Day Wedding
Dream Vacation Solitaire (remove only)
ERUNT 1.1j
eSupportQFolder
Fairy Jewels (remove only)
Family Feud
Fantastic Flame Screensaver
File Uploader
FirstClass® Client
Flower Shop Big City Break
Frogger v3.0e
Frogger2
Google Photos Screensaver
Google Updater
Greetings Workshop
Hardwood Solitaire III Lite
Hidden Expedition Titanic (remove only)
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
hp dvd writer
HP Imaging Device Functions 6.0
HP Photosmart Cameras 6.0
HP Photosmart Essential
HP Software Update
HP Solution Center and Imaging Support Tools 6.0
hpiCamDrvQFolder
HPProductAssistant
igLoader
Insaniquarium Deluxe 1.0
Intel Application Accelerator
Internet Explorer Default Page
iTunes
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2_03
Java 2 Runtime Environment, SE v1.4.2_06
Learn2 Player (Uninstall Only)
LiveUpdate 1.6 (Symantec Corporation)
Logitech iTouch Software
Logitech MouseWare 9.79
Luxor Mahjong (remove only)
Macromedia Shockwave Player
Magic Academy (remove only)
Magic Ball 3 (remove only)
Mahjong Match (remove only)
Malwarebytes' Anti-Malware
Maui Wowee 1.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Disc 2
Microsoft Office FrontPage 2003
Microsoft Office XP Professional
Microsoft Pandora's Box
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.52
Mirror Magic Deluxe (remove only)
Moraff's Maximum MahJongg 1.0
Move Networks Media Player for Internet Explorer
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Musicmatch for Windows Media Player
Musicmatch® Jukebox
Mystery Case Files - Prime Suspects (remove only)
Mystery Case Files - Ravenhearst (remove only)
Mystery Case Files Huntsville
Mystery Solitaire - Secret Island (remove only)
Network Stumbler 0.4.0 (remove only)
Nikon Message Center
Nikon Transfer
Norton AntiVirus Corporate Edition
PC Inspector File Recovery
Peggle (remove only)
Photo Story 3 for Windows
Plantasia (remove only)
PopCap Browser Plugin
PowerDVD
PrintMaster 7.00
Puzz-3D Victorian Mansion
QuickTime
Rainbow Mystery
RealPlayer
RecordNow
Samsung ML-2010 Series
SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
Sandlot Games Client Services
Sandlot Games Client Services 1.2.2
Scratches
Secret Chamber
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Serif DrawPlus 3.0
Shockwave
Simple Backup
Slingo
Slot Words
SolSuite
SolSuite 2000 v4.0
SolSuite Graphics Pack
SolutionCenter
SoundMAX
Sprint media manager
Sprint PCS Connection Manager
Sproink (remove only)
Spybot - Search & Destroy
Spybot - Search & Destroy 1.3
SSH Secure Shell
Stand O`Food (remove only)
Status
Super Granny 3 (remove only)
Sweetopia (remove only)
TBS WMP Plug-in
Tetris (remove only)
The Da Vinci Code (remove only)
The Game Of Life
The Next Tetris
The Rise of Atlantis (remove only)
Travelogue 360 Paris (remove only)
TrayApp
Tweakui Powertoy for Windows XP
Unload
Uno™ CD-Rom
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
VideoLAN VLC media player 0.8.5
Viewpoint Media Player
WebFldrs XP
WebReg
Wheel Of Fortune
WildTangent Web Driver
Winamp
Windows Genuine Advantage Validation Tool
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Service Pack 3
WinMX
WordPerfect Office 12
XviD MPEG-4 Video Codec
Yahoo! Install Manager
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

1/19/2009 5:34:02 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
1/19/2009 5:34:08 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
1/19/2009 5:34:36 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
1/19/2009 5:34:36 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/19/2009 5:34:36 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
1/19/2009 5:34:36 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/19/2009 5:34:36 PM, error: Service Control Manager [7001] - The Fax service depends on the Print Spooler service which failed to start because of the following error: The dependency service or group failed to start.
1/19/2009 5:34:36 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/19/2009 5:34:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
1/19/2009 5:38:25 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
1/19/2009 5:53:20 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
1/19/2009 7:32:30 PM, error: System Error [1003] - Error code 100000d1, parameter1 e2009000, parameter2 00000002, parameter3 00000000, parameter4 b01f8cf6.

==== End Of File ===========================


Gmer.txt:
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-20 17:14:56
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

Code 824EB2A0 ZwEnumerateKey
Code 82559410 ZwFlushInstructionCache
Code B2BBD470 pIofCallDriver

---- Kernel code sections - GMER 1.0.14 ----

PAGE ntoskrnl.exe!ZwEnumerateKey 80578E14 5 Bytes JMP 824EB2A4
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80587BFB 5 Bytes JMP 82559414

---- User code sections - GMER 1.0.14 ----

.text C:\WINDOWS\system32\MsgSys.EXE[336] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 011C000A
.text C:\WINDOWS\system32\MsgSys.EXE[336] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 011D000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[544] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0070000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[544] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0071000A
.text C:\Program Files\NavNT\defwatch.exe[564] ntdll.dll!LdrLoadDll 7C9163A3 3 Bytes JMP 0092000A
.text C:\Program Files\NavNT\defwatch.exe[564] ntdll.dll!LdrLoadDll + 4 7C9163A7 1 Byte [ 84 ]
.text C:\Program Files\NavNT\defwatch.exe[564] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0093000A
.text C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe[604] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0080000A
.text C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe[604] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0081000A
.text C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe[624] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 006B000A
.text C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe[624] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 006C000A
.text C:\PROGRA~1\Iomega\System32\AppServices.exe[668] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 006B000A
.text C:\PROGRA~1\Iomega\System32\AppServices.exe[668] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 006C000A
.text C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe[692] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 009A000A
.text C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe[692] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 009B000A
.text C:\WINDOWS\system32\winlogon.exe[816] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0068000A
.text C:\WINDOWS\system32\winlogon.exe[816] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0069000A
.text C:\WINDOWS\system32\services.exe[864] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\services.exe[864] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\lsass.exe[876] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0072000A
.text C:\WINDOWS\system32\lsass.exe[876] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0075000A
.text C:\WINDOWS\system32\Ati2evxx.exe[1076] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\Ati2evxx.exe[1076] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0099000A
.text C:\Program Files\NavNT\rtvscan.exe[1260] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0140000A
.text C:\Program Files\NavNT\rtvscan.exe[1260] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0141000A
.text C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe[1304] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0072000A
.text C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe[1304] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0073000A
.text C:\WINDOWS\system32\LEXBCES.EXE[1980] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\LEXBCES.EXE[1980] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\spoolsv.exe[2024] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\spoolsv.exe[2024] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\LEXPPS.EXE[2032] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 009A000A
.text C:\WINDOWS\system32\LEXPPS.EXE[2032] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 009B000A
.text C:\WINDOWS\Explorer.EXE[2404] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[2404] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00C1000A
.text C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe[2656] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00B3000A
.text C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe[2656] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00B4000A
.text C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe[2664] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0098000A
.text C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe[2664] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0099000A
.text C:\WINDOWS\AGRSMMSG.exe[2680] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 009F000A
.text C:\WINDOWS\AGRSMMSG.exe[2680] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00A0000A
.text C:\Program Files\NavNT\vptray.exe[2688] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0097000A
.text C:\Program Files\NavNT\vptray.exe[2688] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0098000A
.text C:\Program Files\Logitech\iTouch\iTouch.exe[2696] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00AD000A
.text C:\Program Files\Logitech\iTouch\iTouch.exe[2696] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00AE000A
.text C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe[2760] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0096000A
.text C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe[2760] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0097000A
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2780] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0096000A
.text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2780] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0097000A
.text C:\Documents and Settings\Celi\Desktop\skittles\skittles.exe[2796] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 009E000A
.text C:\Documents and Settings\Celi\Desktop\skittles\skittles.exe[2796] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 009F000A
.text C:\Program Files\D-Link\Air Utility\AirCFG.exe[2816] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00C9000A
.text C:\Program Files\D-Link\Air Utility\AirCFG.exe[2816] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00CA000A
.text C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe[2824] ntdll.dll!LdrLoadDll 7C9163A3 3 Bytes JMP 0092000A
.text C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe[2824] ntdll.dll!LdrLoadDll + 4 7C9163A7 1 Byte [ 84 ]
.text C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe[2824] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0093000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2832] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00BA000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2832] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00BB000A
.text C:\Program Files\BroadJump\Client Foundation\CFD.exe[2916] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0097000A
.text C:\Program Files\BroadJump\Client Foundation\CFD.exe[2916] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0098000A
.text C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2948] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00A8000A
.text C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2948] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00A9000A
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe[2964] ntdll.dll!LdrLoadDll 7C9163A3 3 Bytes JMP 0092000A
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe[2964] ntdll.dll!LdrLoadDll + 4 7C9163A7 1 Byte [ 84 ]
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe[2964] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0093000A
.text C:\WINDOWS\system32\rundll32.exe[2976] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00A7000A
.text C:\WINDOWS\system32\rundll32.exe[2976] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00A8000A
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe[3020] ntdll.dll!LdrLoadDll 7C9163A3 3 Bytes JMP 0092000A
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe[3020] ntdll.dll!LdrLoadDll + 4 7C9163A7 1 Byte [ 84 ]
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe[3020] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0093000A
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe[3040] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0094000A
.text C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe[3040] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0095000A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3048] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00A1000A
.text C:\Program Files\Logitech\MouseWare\system\em_exec.exe[3048] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00A2000A
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3372] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0098000A
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3372] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0099000A
.text C:\Program Files\iPod\bin\iPodService.exe[3716] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 0072000A
.text C:\Program Files\iPod\bin\iPodService.exe[3716] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 0073000A

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device \FileSystem\Fastfat \FatCdrom tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Fastfat \Fat tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Direct Access Component/VERITAS Software, Inc.)

---- Modules - GMER 1.0.14 ----

Module \systemroot\system32\drivers\UACflnsrumq.sys (*** hidden *** ) B2BBB000-B2BCE000 (77824 bytes)
---- Processes - GMER 1.0.14 ----

Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\MsgSys.EXE [336] 0x011E0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [544] 0x00720000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\NavNT\defwatch.exe [564] 0x00940000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [604] 0x00820000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe [624] 0x006D0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\PROGRA~1\Iomega\System32\AppServices.exe [668] 0x006D0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [692] 0x009C0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [816] 0x006A0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [864] 0x00660000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [876] 0x00760000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [1076] 0x009A0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1196] 0x00700000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\NavNT\rtvscan.exe [1260] 0x01420000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe [1304] 0x00740000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1344] 0x00700000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1460] 0x00700000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1488] 0x00700000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1576] 0x00700000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\LEXBCES.EXE [1980] 0x00990000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [2024] 0x00990000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\LEXPPS.EXE [2032] 0x009C0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [2404] 0x00C20000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2656] 0x00B50000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe [2664] 0x009A0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\AGRSMMSG.exe [2680] 0x00A10000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\NavNT\vptray.exe [2688] 0x00990000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Logitech\iTouch\iTouch.exe [2696] 0x00AF0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe [2760] 0x00980000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2780] 0x00980000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Documents and Settings\Celi\Desktop\skittles\skittles.exe [2796] 0x00A00000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\D-Link\Air Utility\AirCFG.exe [2816] 0x00CB0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe [2824] 0x00940000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\iTunes\iTunesHelper.exe [2832] 0x00BC0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\BroadJump\Client Foundation\CFD.exe [2916] 0x00990000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe [2948] 0x00AA0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe [2964] 0x00940000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\WINDOWS\system32\rundll32.exe [2976] 0x00A90000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\DOCUME~1\Celi\LOCALS~1\Temp\winlogin.exe [3020] 0x00940000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\DOCUME~1\Celi\LOCALS~1\Temp\csrssc.exe [3040] 0x00960000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\Logitech\MouseWare\system\em_exec.exe [3048] 0x00A30000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [3372] 0x009A0000
Library \\?\globalroot\systemroot\system32\UAClwgqlbhw.dll (*** hidden *** ) @ C:\Program Files\iPod\bin\iPodService.exe [3716] 0x00740000

---- Services - GMER 1.0.14 ----

Service C:\WINDOWS\system32\drivers\UACflnsrumq.sys (*** hidden *** ) [SYSTEM] uacd.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\uacd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\uacd.sys@start 1
Reg HKLM\

Edited by Araceli79, 20 January 2009 - 05:53 PM.

  • 0

#4
kahdah
Posted 21 January 2009 - 06:34 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

Posted Image


Posted Image
--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

  • 0

#5
Araceli79
Posted 21 January 2009 - 07:03 PM

Araceli79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
I have noticed that my internet browser is moving a it's normal speed. The links or pages I open up are no longer coming up blank. Whatever your doing it's working, Thank u Thank u Thank u!

Combofix log:

ComboFix 09-01-21.02 - Celi 2009-01-21 18:45:27.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.175 [GMT -6:00]
Running from: c:\documents and settings\Celi\Desktop\Combo-Fix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\DinerDash.1.0.0.89
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\customer_cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\heart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\menu_down.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\menu_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\plates.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\ticket.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\tray.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\music\mainmenumusic.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_bring_check_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_diner.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_food_ready_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_gain_heart_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_pencil_write_2.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_rollover_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_seat_people_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\choosedifficulty.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\credits.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\flo_lose.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\flo_win.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\help1.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\help2.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\highscores.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelintro.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelintro_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelover.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelover_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\mainmenu.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\popup.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\popup_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upgradegrid.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upgradetitle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upsell.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowleft_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowleft_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowright_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowright_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\back_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\back_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backchalk.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backchalkup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backtomenu_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backtomenu_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\cancel.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\cancelup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\career_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\close.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\closeup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\continue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\continueover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\credits_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\credits_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\download_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\download_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\easy.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\easy_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\endlessshift.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\endlessshift_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\hard.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\hard_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\help.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\help_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\highscores.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\highscores_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\instructions_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\instructions_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\letsplay.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\letsplayover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\medium.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\medium_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\moreinfo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\moreinfoup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\off_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\on_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\pause.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\pauseover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitgame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitgameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\resumegame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\resumegameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\submit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\submitup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\tryagain.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\tryagainover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\upgrade_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\upgrade_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewglobal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewglobalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewhighscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewhighscoreon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewlocal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewlocalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\comics\webcomic.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\career.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\customer.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\endless.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\global.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\powerups.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\cook.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\cook.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\stove.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\arrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\click.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\click2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\grab.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\open.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\idle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\idle.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\lower.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\lower.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\upper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\upper.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\fonts\arial.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\fonts\komikaaxis.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\chair.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\chair.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dirt2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dirt4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dishcart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dishcart.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_on1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_on2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\ticketstation.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\ticketstation.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowdown.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowdownon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowleft.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowlefton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowright.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowrighton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowupon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\p1icon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\textedit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\title.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\fifth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\first_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\fourth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\second_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\playfirst_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\background.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food1.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food2.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food3.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food3.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\frames\upgrade_0001.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\2top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\4top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\upgrades.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\tableshadow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\choosedifficulty.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\chooseplayer.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\chooserestaurant.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\credits.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\game.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\gothighscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\help.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\help2.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscoreinfo.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscoresubmit.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\levelintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\levelover.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\loading.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\mainloop.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\mainmenu.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\ok.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\pause.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\style.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\tutorialintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\upgrade.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\upsell.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\webcomic.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\yesno.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\aol_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\gamelabsplash.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\playfirst_logo.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\strings.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\angersmoke.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\angersmoke.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\chairflags.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\chairflags.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\check.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\checkmark.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\clock.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\closed.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\closingtime.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\coinflip.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\coinflip.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\dollar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\coffee.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\tables.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\wallpaper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\expert.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\expertscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\foodpoof.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\foodpoof.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\fork_timer.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\goalcompleted.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\heartgrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\heartgrow.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\jar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\jar.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\level.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\level_career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\score.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\sound.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\staroff.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\staron.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tablenumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tablenumberup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\traynumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorial_character.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorialarrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorialbox.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgradeanim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgradeanim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\drinks.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\maitred.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\oven.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\select.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\shoes.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\stereo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\table.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\dinerdash.exe
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\dirty_dishes.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\foodtray.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\heart1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\heart2.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\heart3.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\menu_down.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\menu_up.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\mop_prop.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\accessories\ticket.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\music\cafe\cafe_music_a1.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\music\cafe\cafe_music_a2.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\music\cafe\cafe_music_a3.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\music\cafe\cafe_music_a4.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\music\mainmenumusic.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\baby_cry.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\chef_cook1.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\closing_time.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\customer_ditch.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\dialog_down.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\dialog_up.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\drink_table.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\expert.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\highchair_deliver.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\highchair_pickup.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\keystroke2.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\level_lose.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\level_win.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\menu_click.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\menu_rollover.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\mop_pickup.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\mop_spill.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_bring_check_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_dropoff_drinks_1.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_food_ready_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_gain_heart_1.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_menu_down.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_pencil_write_2.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\sfx_seat_people_snd.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\spill.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\table_drink.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\audio\sfx\tip_2.ogg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\flo_lose.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\flo_win.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\fullscreendialog.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\high_score_menu_bg.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\levelintro.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\levelintro.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\levelover.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\longdialog.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\longdialog.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\mainmenu.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\mainmenu_logo.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\popup.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\popup.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\textfield.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\backgrounds\upgrade_lines.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\arrowdown_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\arrowdown_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\arrowdown_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\arrowup_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\arrowup_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\arrowup_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\checkbox_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\checkbox_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\checkbox_rotated_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\checkbox_rotated_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\decor_highlight.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\decor_normal.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\decor_selected.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a_large_1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a_large_2.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a_large_3.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a_small_1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a_small_2.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a_small_3.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a2.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\dialog_button_a3.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\left_arrow_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\left_arrow_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\left_arrow_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button1_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button1_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button1_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button1_mask.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button2_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button2_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button2_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\main_menu_button2_mask.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\map_button_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\map_button_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\map_button_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\right_arrow_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\right_arrow_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\right_arrow_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\upgrade_down.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\upgrade_over.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\upgrade_up.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\buttons\welcome_player.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\config\actionpoints.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\config\career.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\config\customer.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\config\endless.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\config\global.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\config\powerups.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\cook\stove.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\cursor\arrow.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\cursor\click.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\cursor\click2.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\cursor\grab.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\cursor\open.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\anim.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\anim.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\blue.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\blue_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\legs.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\red.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\dad_male\red_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\anim.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\anim.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\blue.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\blue_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\legs.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\red.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\kid_male\red_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\anim.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\anim.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\baby.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\baby.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\blue.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\blue_baby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\blue_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\legs.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\red.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\red_baby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\mom_female\red_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\anim.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\anim.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\blue.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\blue_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\legs.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\red.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\customers\young_female\red_legs.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\flo\idle.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\flo\idle.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\flo\lower.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\flo\lower.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\flo\upper.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\flo\upper.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\fonts\mercurius.mvec
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\bench.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\bench.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\blue_highchairbaby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\chair.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\chair.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\dirt2top.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\dirt4top.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\dishcart.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\dishcart.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\green_highchairbaby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\highchair_prop_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\highchair_prop_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\highchairbaby.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\highchairbaby.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\luxury_bench.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\luxury_bench.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\mop_station_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\mop_station_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\mop_station_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\podium.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\podium_heart.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\podium_heart.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\purple_highchairbaby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\radio.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\red_highchairbaby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\spill.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\spill.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\stereo.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\ticketstation.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\ticketstation.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\furniture\yellow_highchairbaby.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\family.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help_dividerline.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help1_colormatch1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help1_colormatch2.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help1_noise.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help1_score.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help2_cleardishes.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help2_givecheck.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help2_pickupfood.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help2_servefood.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\help\help2_takeorder.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\hiscore\local-hs-bb.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\hiscore\p1icon.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\career_1_1.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\career_1_2.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\career_1_3.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\career_1_4.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\career_1_5.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\career_1_6.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\endless_1_1.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\endless_1_1_a.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\endless_1_1_b.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\layouts\endless_1_1_c.bin
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\playfirstlogo.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\background.jpg
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\chairs\blue.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\chairs\green.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\chairs\green.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\chairs\grey.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\chairs\red.pal
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\food\cup1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\food\food.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\food\food.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\frames\2_0.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\frames\2_1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\furniture\drinkstation1_a.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\furniture\drinkstation1_b.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\furniture\drinkstation1_c.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\people\cook.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\people\cook.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\props\cup_prop1.png
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\tables\2top.anm
c:\windows\Downloaded Program Files\DinerDash2.1.0.0.55\assets\restaurants\cafe\tables\2top.png
c:\windows\Downloaded Program
  • 0

#6
kahdah
Posted 21 January 2009 - 07:26 PM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Hi can you upload the Combofix log file for me Here.
Thank you.
  • 0

#7
Araceli79
Posted 21 January 2009 - 07:37 PM

Araceli79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
I have submitted the file.
  • 0

#8
kahdah
Posted 22 January 2009 - 07:58 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
1. Please open Notepad
  • Click Start , then Run
  • type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Driver::
494b57d3

File::
c:\windows\SYSTEM32\DRIVERS\494b57d3.sys

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
uDefault_Page_URL = hxxp://www.dell4me.com/mywaybiz

FireFox::
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FOlder::
c:\program files\Viewpoint


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

  • 0

#9
Araceli79
Posted 22 January 2009 - 06:23 PM

Araceli79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Combo fix log:

ComboFix 09-01-21.04 - Celi 2009-01-22 18:11:19.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.137 [GMT -6:00]
Running from: c:\documents and settings\Celi\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Celi\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\SYSTEM32\DRIVERS\494b57d3.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Viewpoint
c:\program files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini
c:\program files\Viewpoint\Viewpoint Experience Technology\ComponentMgr.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo2.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
c:\program files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt
c:\windows\SYSTEM32\DRIVERS\494b57d3.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_494b57d3


((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

2009-01-20 17:28 . 2009-01-20 17:28 <DIR> d-------- c:\documents and settings\Celi\Application Data\Malwarebytes
2009-01-20 01:26 . 2009-01-19 23:18 2,737,540 --a------ C:\skittles.exe
2009-01-20 01:22 . 2009-01-20 00:24 1,924,249 --a------ C:\mbam-rules.exe
2009-01-20 01:15 . 2009-01-20 01:15 <DIR> d-------- c:\program files\Trend Micro
2009-01-19 23:36 . 2009-01-20 17:28 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-19 23:36 . 2009-01-19 23:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-19 23:36 . 2009-01-14 16:11 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2009-01-19 23:36 . 2009-01-14 16:11 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys
2009-01-19 22:52 . 2009-01-19 22:52 <DIR> d-------- c:\program files\ERUNT
2009-01-19 18:17 . 2009-01-19 19:02 664 --a------ c:\windows\SYSTEM32\d3d9caps.dat
2009-01-19 17:33 . 2004-12-18 23:29 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-01-19 17:33 . 2009-01-19 17:33 <DIR> d-------- c:\documents and settings\Administrator
2009-01-18 22:30 . 2009-01-18 22:30 2 --a------ C:\2020383686

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 00:05 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-22 00:33 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-19 23:27 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-19 22:40 --------- d-----w c:\program files\Hasbro Interactive
2009-01-12 03:31 --------- d--h--w c:\documents and settings\Celi\Application Data\Move Networks
2009-01-08 22:54 --------- d-----w c:\program files\Common Files\Nikon
2009-01-08 22:52 20 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-01-06 07:13 --------- d-----w c:\program files\Sprint Instinct Applications
2008-12-13 06:40 3,593,216 ------w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-11-27 00:28 --------- d-----w c:\program files\Mystery Case Files Huntsville
2008-11-26 05:58 --------- d-----w c:\documents and settings\Celi\Application Data\Image Zone Express
2008-10-24 11:21 455,296 ------w c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\SYSTEM32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\SYSTEM32\DLLCACHE\gdi32.dll
2008-09-30 23:35 114,344 ----a-w c:\documents and settings\Celi\Application Data\GDIPFONTCACHEV1.DAT
2005-06-25 02:38 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-08-23 02:48 32,768 --sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008082220080823\index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_18.56.55.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\1-22-2009\ERDNT.EXE
+ 2009-01-22 23:53:02 9,539,584 ----a-w c:\windows\ERDNT\AutoBackup\1-22-2009\Users\00000001\NTUSER.DAT
+ 2009-01-22 23:53:02 188,416 ----a-w c:\windows\ERDNT\AutoBackup\1-22-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 18:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2009-01-22\ERDNT.EXE
+ 2009-01-23 00:16:40 9,539,584 ----a-w c:\windows\ERDNT\AutoBackup\2009-01-22\Users\00000001\NTUSER.DAT
+ 2009-01-23 00:16:40 188,416 ----a-w c:\windows\ERDNT\AutoBackup\2009-01-22\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"tezrtsjhfr84iusjfo84f"="c:\docume~1\Celi\LOCALS~1\Temp\csrssc.exe" [BU]
"ttool"="c:\windows\9129837.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 1388544]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"vptray"="c:\program files\NavNT\vptray.exe" [2001-09-24 73728]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2003-12-01 892928]
"WildTangent CDA"="c:\program files\WildTangent\Apps\CDA\GameDrvr.exe" [2005-03-28 28616]
"DVDBitSet"="c:\program files\HP CD-DVD\Umbrella\DVDBitSet.exe" [2003-02-20 188416]
"DVDTray"="c:\program files\HP CD-DVD\Umbrella\DVDTray.exe" [2003-02-20 53248]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-23 49152]
"Samsung Common SM"="c:\windows\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 372736]
"D-Link Air Utility"="c:\program files\D-Link\Air Utility\AirCFG.exe" [2003-11-04 2502656]
"ANIWZCSService"="c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" [2003-08-21 32768]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-05 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 368706]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-09-30 485208]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 c:\windows\AGRSMMSG.exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 c:\windows\LOGI_MWX.EXE]

c:\documents and settings\Celi\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Sprint media monitor.lnk - c:\windows\RM.exe [2008-08-30 222552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-23 282624]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-09-30 485208]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\WinMX\\WinMX.exe"=
"c:\\Program Files\\BitTorrent\\btdownloadgui.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Photo Story 3 for Windows\\PhotoStory3.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6881:TCP"= 6881:TCP:BT

R3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;c:\windows\SYSTEM32\DRIVERS\NETR33X.sys [2003-11-11 183680]
S3 SM_ml1600_FUService;ML-2010 Status Monitor Service;"c:\program files\Samsung ML-2010 Series\CommonSM\ssmsrvc /Service --> c:\program files\Samsung ML-2010 Series\CommonSM\ssmsrvc [?]
S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\SYSTEM32\DRIVERS\netusbxp.sys [2005-02-05 72576]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://yahoo.sbc.com/dsl
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Trusted Zone: att.net
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com\clientapps
TCP: {98E93716-9893-40A2-9634-B054315665E3} = 192.168.13.1
TCP: {A7589C7C-107B-4A42-9103-3C9B6DF40B50} = 192.168.13.1,207.69.188.185
DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} - hxxp://aolsvc.aol.com/onlinegames/free-trial-mystery-of-shark-island/MysteryOfSharkIslandWeb.1.0.0.8.cab
DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1}
DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://aolsvc.aol.com/onlinegames/free-trial-doggie-dash/DoggieDash.1.0.0.6.cab
DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} - hxxp://aolsvc.aol.com/onlinegames/ghadventureball/abxgh.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://aolsvc.aol.com/onlinegames/free-trial-big-island-blends/gamehouseplayer.cab
DPF: {775879E2-7309-4619-BB02-AADE41F4B690} - hxxp://aolsvc.aol.com/onlinegames/free-trial-dream-chronicles/dreamweb.1.0.0.9.cab
DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} - hxxp://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} - hxxp://aolsvc.aol.com/onlinegames/sonybewitched/main.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab
DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} - hxxp://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
DPF: {D40F5876-A494-4124-8161-82625BB28C06} - hxxp://aolsvc.aol.com/onlinegames/free-trial-chocolatier-2-secret-ingredients/Chocolatier2Web.1.0.0.14.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
DPF: {E41BA393-9078-424E-9554-9DB5126F5F4C} - hxxp://aolsvc.aol.com/onlinegames/free-trial-dream-chronicles-2/dream2web.1.0.0.13.cab
FF - ProfilePath - c:\documents and settings\Celi\Application Data\Mozilla\Firefox\Profiles\l4bjtn7d.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\Celi\Application Data\Mozilla\Firefox\Profiles\l4bjtn7d.default\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 18:16:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SM_ml1600_FUService]
"ImagePath"="\"c:\program files\Samsung ML-2010 Series\CommonSM\ssmsrvc /Service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(816)
c:\windows\system32\NavLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\LEXBCES.EXE
c:\windows\SYSTEM32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\NavNT\defwatch.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\NavNT\rtvscan.exe
c:\program files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
c:\windows\SYSTEM32\MSGSYS.EXE
c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Sprint Instinct Applications\MEMonitor.exe
.
**************************************************************************
.
Completion time: 2009-01-22 18:20:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-23 00:20:01
ComboFix2.txt 2009-01-22 00:58:17

Pre-Run: 44,669,747,200 bytes free
Post-Run: 44,595,392,512 bytes free

239 --- E O F --- 2009-01-16 05:37:43


Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:59 PM, on 1/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Sprint\Sprint PCS Connection Manager\CMSPCSUtilSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe
C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sprint Instinct Applications\MEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.att.net
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/...UI.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {21BB8360-F943-447E-98F3-3C22345375A7} (CPlayFirstChocolatieControl Object) - http://zone.msn.com/...eb.1.0.0.15.cab
O16 - DPF: {226ACC34-3194-40E2-9AE8-834FCFE9E80D} (CPlayFirstmsiControl Object) - http://aolsvc.aol.co...Web.1.0.0.8.cab
O16 - DPF: {226ACC34-3194-70E2-5AE7-864FCFE9E80D} (CPlayFirstmsiControl Object) - http://zone.msn.com/...msi.1.0.0.9.cab
O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/...nx.1.0.0.87.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/...dy.cab55579.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} - http://zone.msn.com/...pandaonline.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/...bGameLoader.cab
O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} -
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/...pcaploader1.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/...at.cab55579.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://zone.msn.com/...h2.1.0.0.55.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1142043471687
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/...t/atomaders.cab
O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://aolsvc.aol.co...ash.1.0.0.6.cab
O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} (Abx(gh) Control) - http://aolsvc.aol.co...eball/abxgh.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://aolsvc.aol.co...houseplayer.cab
O16 - DPF: {775879E2-7309-4619-BB02-AADE41F4B690} (CPlayFirstdreamControl Object) - http://aolsvc.aol.co...web.1.0.0.9.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/...mjolauncher.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/...O1.cab60096.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn...gr.cab31267.cab
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.co...esPlayer_v4.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://aolsvc.aol.co...tg.1.0.0.33.cab
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} (BewitchedGameClass Control) - http://aolsvc.aol.co...itched/main.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.co...zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.co...eb.1.0.0.16.cab
O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/...ersion=1,0,0,10
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {D40F5876-A494-4124-8161-82625BB28C06} (CPlayFirstChocolatieControl Object) - http://aolsvc.aol.co...eb.1.0.0.14.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://media.grab.co...outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/.../default/ct.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/...xy.cab55579.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/...WebLauncher.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/...sh.1.0.0.89.cab
O16 - DPF: {E41BA393-9078-424E-9554-9DB5126F5F4C} (CPlayFirstDreamChronControl Object) - http://aolsvc.aol.co...eb.1.0.0.13.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {E9B80D94-D8BC-43DE-9138-75605A8D9666} (CPlayFirstWeddingDasControl Object) - http://zone.msn.com/...sh.1.0.0.50.cab
O16 - DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} (CPlayFirstSweetopiaControl Object) - http://zone.msn.com/...ia.1.0.0.46.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{98E93716-9893-40A2-9634-B054315665E3}: NameServer = 192.168.13.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7589C7C-107B-4A42-9103-3C9B6DF40B50}: NameServer = 192.168.13.1,207.69.188.185
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe

--
End of file - 14957 bytes
  • 0

#10
kahdah
Posted 23 January 2009 - 07:30 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Looks good how are things running, back to normal?
  • 0

#11
Araceli79
Posted 23 January 2009 - 04:22 PM

Araceli79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Yes everything is working pretty good, I don't know what you did but ur amazing! I have some things in quarantine in Malwarebytes should i delete those? Also i have norton and it runs every Sunday, should I also scan with Malwarebytes from now on?
  • 0

#12
kahdah
Posted 23 January 2009 - 11:33 PM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Yes I would always run Malwarebytes with Norton.
Yes delete the items in the MalwareBytes quarantine.
==========================
Cleanup:

Please download OT CLeanit from Here save it to your desktop.
Double click on OT Clean it to run it.
Then click on Clean up.
Restart your computer when prompted.
This will remove what tools we used.
===============
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 11...allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u10-windows-i586-p.exe to install the newest version.
======================
Delete\uninstall anything else that we have used.

Including this folder C:\Rsit

System Restore
Then I will need you to reset your System Restore points.
The link below shows how to create a clean restore point.
How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us

If you are using Vista then see this link > http://www.bleepingc...143.html#manual
=====================================
After that your log is clean. :)

The following is a list of tools and utilities that I like to suggest to people.
You do not have to have all or any of them they are only suggestions.
This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

Spybot Search & Destroy-Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

Spyware Blaster - Great prevention tool to keep nasties from installing on your system.

Spywareguard-Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.

If your computer is slow Is a tutorial on what you can do if your computer is slow.
  • 0

#13
Araceli79
Posted 25 January 2009 - 05:06 AM

Araceli79

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Thank you :)
  • 0

#14
kahdah
Posted 25 January 2009 - 08:19 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
You are welcome :)


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
  • 0

#15
kahdah
Posted 25 January 2009 - 08:19 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP