[Rorschach112]

hi

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

DirLook::
c:\windows\system32\SysWoW32

File::
c:\windows\system32\infocardapi32.dll
c:\windows\system32\dxva232.dll


Folder::

Registry::

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[Advertisements]

How do I disable Malware bytes?

[fern_06]

How do I disable Malware bytes?

[Rorschach112]

just right click on the icon in the bottom right should be enough

skip that if you cant do it

[fern_06]

OK - should this take a while as it's been running for about 20 mins and I have a bar on the middle of my desktop saying combofix with some green bars but it's not moving.

[Rorschach112]

run it once more

[fern_06]

Here is the log:

ComboFix 09-12-11.05 - fch543 12/12/2009 16:34:18.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.622 [GMT -5:00]
Running from: d:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: d:\documents and settings\Administrator\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\dxva232.dll"
"c:\windows\system32\infocardapi32.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dxva232.dll
c:\windows\system32\infocardapi32.dll

.
((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))
.

2009-12-06 23:50 . 2009-12-06 23:50 -------- d-----w- c:\program files\Windows Media Connect 2
2009-12-06 23:48 . 2009-12-09 02:52 -------- d-sh--w- c:\windows\system32\SysWoW32
2009-12-06 23:48 . 2009-12-06 23:49 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-12-06 23:48 . 2009-12-06 23:48 -------- d-----w- c:\windows\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-12 00:52 . 2009-01-07 03:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-12 00:49 . 2009-01-07 03:12 -------- d-----w- c:\program files\ERUNT
2009-12-12 00:25 . 2007-08-11 00:14 -------- d-----w- d:\documents and settings\All Users\Application Data\Google Updater
2009-12-07 00:14 . 2009-06-21 18:09 -------- d-----w- d:\documents and settings\Administrator\Application Data\LimeWire
2009-12-03 21:14 . 2009-01-07 03:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 21:13 . 2009-01-07 03:35 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-29 07:46 . 2004-12-07 22:37 832512 ------w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2005-04-14 19:20 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-05-23 23:50 17408 ------w- c:\windows\system32\corpol.dll
2009-10-27 01:55 . 2009-07-31 13:02 -------- d-----w- d:\documents and settings\Administrator\Application Data\Juniper Networks
2009-10-21 06:00 . 2005-04-14 19:20 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 06:00 . 2005-04-14 19:20 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 04:13 . 2004-09-13 17:43 41472 ----a-w- d:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 14:58 . 2005-04-14 19:20 263552 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:53 . 2004-05-23 23:50 266752 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:54 . 2004-05-23 23:50 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:54 . 2004-05-23 23:50 112128 ----a-w- c:\windows\system32\rastls.dll
2009-10-03 14:17 . 2009-10-03 14:17 8673792 ----a-w- d:\documents and settings\All Users\Application Data\atscie.msi
2006-12-16 18:26 . 2006-12-16 18:26 1458 ----a-w- c:\program files\DOWNLOAD_INSTALL.LOG
2009-08-12 13:44 . 2007-09-22 16:36 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-08-12 13:44 . 2007-09-22 16:36 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-08-12 13:44 . 2007-09-22 16:36 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-08-12 13:44 . 2007-09-22 16:36 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-12-10 02:06 . 2009-12-10 02:06 122880 ----a-w- c:\program files\mozilla firefox\components\wsff.dll
2009-08-12 13:44 . 2007-09-22 16:36 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\system32\SysWoW32 ----

2009-12-06 23:49 . 2009-12-09 02:52 116 --sha-w- c:\windows\system32\SysWoW32\mi1986095021v7.kwd
2009-12-06 23:49 . 2009-12-09 02:52 3 --sha-w- c:\windows\system32\SysWoW32\mi1986095021v6.kwd
2009-12-06 23:49 . 2009-12-09 02:52 254 --sha-w- c:\windows\system32\SysWoW32\mi1986095021v5.kwd
2009-12-06 23:49 . 2009-12-09 02:52 135 --sha-w- c:\windows\system32\SysWoW32\mi1986095021v4.kwd
2009-12-06 23:49 . 2009-12-09 02:52 157 --sha-w- c:\windows\system32\SysWoW32\wu1986095021v3.kwd
2009-12-06 23:49 . 2009-12-09 02:52 200 --sha-w- c:\windows\system32\SysWoW32\wu1986095021v2.kwd
2009-12-06 23:49 . 2009-12-09 02:52 214 --sha-w- c:\windows\system32\SysWoW32\wu1986095021v1.kwd
2009-12-06 23:49 . 2009-12-09 02:52 86 --sha-w- c:\windows\system32\SysWoW32\wu1986095021v0.kwd
2009-12-06 23:49 . 2009-12-08 22:29 5101457 ----a-w- c:\windows\system32\SysWoW32\mi1986095021v7
2009-12-06 23:49 . 2009-11-28 14:05 5101457 ----a-w- c:\windows\system32\SysWoW32\_i1986095021v7
2009-12-06 23:49 . 2009-12-08 22:29 5846215 ----a-w- c:\windows\system32\SysWoW32\mi1986095021v6
2009-12-06 23:49 . 2009-11-28 14:04 5846215 ----a-w- c:\windows\system32\SysWoW32\_i1986095021v6
2009-12-06 23:49 . 2009-12-08 22:28 5545150 ----a-w- c:\windows\system32\SysWoW32\mi1986095021v5
2009-12-06 23:49 . 2009-11-28 14:04 5545150 ----a-w- c:\windows\system32\SysWoW32\_i1986095021v5
2009-12-06 23:49 . 2009-12-08 22:28 5159273 ----a-w- c:\windows\system32\SysWoW32\mi1986095021v4
2009-12-06 23:49 . 2009-11-28 14:03 5159273 ----a-w- c:\windows\system32\SysWoW32\_i1986095021v4
2009-12-06 23:49 . 2009-12-08 22:32 907299 ----a-w- c:\windows\system32\SysWoW32\wu1986095021v3
2009-12-06 23:49 . 2009-11-28 14:08 822814 ----a-w- c:\windows\system32\SysWoW32\_u1986095021v3
2009-12-06 23:49 . 2009-12-08 22:32 915078 ----a-w- c:\windows\system32\SysWoW32\wu1986095021v2
2009-12-06 23:49 . 2009-11-28 14:08 830447 ----a-w- c:\windows\system32\SysWoW32\_u1986095021v2
2009-12-06 23:48 . 2009-12-08 22:32 482317 ----a-w- c:\windows\system32\SysWoW32\wu1986095021v1
2009-12-06 23:48 . 2009-11-28 14:07 813555 ----a-w- c:\windows\system32\SysWoW32\_u1986095021v1
2009-12-06 23:48 . 2009-12-08 22:31 486254 ----a-w- c:\windows\system32\SysWoW32\wu1986095021v0
2009-12-06 23:48 . 2009-11-28 14:07 821239 ----a-w- c:\windows\system32\SysWoW32\_u1986095021v0


((((((((((((((((((((((((((((( SnapShot@2009-12-12_19.18.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-12 21:30 . 2009-12-12 21:30 16384 c:\windows\temp\Perflib_Perfdata_798.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealPlayer"="c:\program files\Real\RealPlayer\realplay.exe" [2006-08-14 1003520]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-14 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-04-08 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-04-08 512000]
"TpShocks"="TpShocks.exe" [2004-03-26 102400]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-03-10 94208]
"TPKBDLED"="c:\windows\System32\TpScrLk.exe" [2002-10-09 40960]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 88363]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-03-12 124128]
"sealmon"="c:\program files\SealedMedia\sealmon.exe" [2005-12-08 94208]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-09 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-12-14 467240]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuNetworkPlaces"= 1 (0x1)
"DisablePersonalDirChange"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2009-01-14 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-01-14 02:36 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
2004-05-19 08:21 94208 ----a-w- c:\windows\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"d:\\Documents and Settings\\Administrator\\Application Data\\Juniper Networks\\Juniper Terminal Services Client\\dsTermServ.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7000:UDP"= 7000:UDP:129.105.223.0/255.255.255.128:enabled:NUTV - Channel Guide
"7070:UDP"= 7070:UDP:129.105.223.0/255.255.255.128:Enabled:NUTV - Video Streams
"3389:TCP"= 3389:TCP:*:disabled:@xpsp2res.dll,-22009
"67:UDP"= 67:UDP:DHCP Discovery Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 NEOFLTR_650_14599;Juniper Networks TDI Filter Driver (NEOFLTR_650_14599);c:\windows\system32\drivers\NEOFLTR_650_14599.SYS [10/26/2009 8:56 PM 77608]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 1:53 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 12:39 PM 55024]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [5/26/2004 3:40 PM 15360]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 5:51 PM 4096]
S3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [5/28/2004 12:15 PM 12288]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [3/12/2004 3:18 PM 169192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = Microsoft Internet Explorer powered by RCN
mSearch Bar = hxxp://www.mirarsearch.com/?useie5=1&q=
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0w39mi1n.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 16:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-12-12 16:42:24
ComboFix-quarantined-files.txt 2009-12-12 21:42
ComboFix2.txt 2009-12-12 19:20

Pre-Run: 764,678,144 bytes free
Post-Run: 731,217,920 bytes free

- - End Of File - - 9E1291B9962E8DF808D7CE8EF4037200

[Rorschach112]

hi

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[fern_06]

I successfully ran TFC and Malaware bytes - the temp files are still on my desktop. Below is the log. For the kaspersky scan, I already have Symantec installed on my computer - do I have to uninstall that first as I don't want to get rid of it.

Malwarebytes' Anti-Malware 1.42
Database version: 3289
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

12/13/2009 11:41:57 PM
mbam-log-2009-12-13 (23-41-57).txt

Scan type: Quick Scan
Objects scanned: 110709
Time elapsed: 6 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Rorschach112]

no you can keep that, wont mess with kaspersky

[fern_06]

Here's the Kaspersky scan results:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, December 14, 2009
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, December 15, 2009 00:55:18
Records in database: 3372651
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 75143
Threats found: 59
Infected objects found: 168
Suspicious objects found: 0
Scan duration: 02:20:58


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\c3IWK.vbs.vir Infected: Backdoor.Win32.Agent.amjd 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\Dxfk7.vbs.vir Infected: Backdoor.Win32.Agent.amjd 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\IMDls.vbs.vir Infected: Backdoor.Win32.Agent.amjd 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\r2Bsq6W.vbs.vir Infected: Backdoor.Win32.Agent.amjd 1
C:\System Volume Information\_restore{77028B57-E57D-44D7-A599-6D75DE183486}\RP975\A0588355.vbs Infected: Backdoor.Win32.Agent.amjd 1
C:\System Volume Information\_restore{77028B57-E57D-44D7-A599-6D75DE183486}\RP975\A0588358.vbs Infected: Backdoor.Win32.Agent.amjd 1
C:\System Volume Information\_restore{77028B57-E57D-44D7-A599-6D75DE183486}\RP975\A0588359.vbs Infected: Backdoor.Win32.Agent.amjd 1
C:\System Volume Information\_restore{77028B57-E57D-44D7-A599-6D75DE183486}\RP975\A0588360.vbs Infected: Backdoor.Win32.Agent.amjd 1
C:\WINDOWS\system32\SysWoW32\mi1986095021v4 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\mi1986095021v5 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\mi1986095021v6 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\mi1986095021v7 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\wu1986095021v0 Infected: Trojan-Downloader.Win32.Agent.cwtl 1
C:\WINDOWS\system32\SysWoW32\wu1986095021v1 Infected: Backdoor.Win32.Agent.anho 1
C:\WINDOWS\system32\SysWoW32\wu1986095021v3 Infected: Trojan-Downloader.Win32.Agent.cwzh 2
C:\WINDOWS\system32\SysWoW32\_i1986095021v4 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\_i1986095021v5 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\_i1986095021v6 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\_i1986095021v7 Infected: Trojan-Downloader.WMA.GetCodec.s 1
C:\WINDOWS\system32\SysWoW32\_u1986095021v0 Infected: Trojan-Downloader.Win32.Agent.cwtl 2
C:\WINDOWS\system32\SysWoW32\_u1986095021v1 Infected: Backdoor.Win32.Agent.anho 2
C:\WINDOWS\system32\SysWoW32\_u1986095021v3 Infected: Trojan-Downloader.Win32.Agent.cwzh 2
D:\Documents and Settings\Administrator\My Documents\LimeWire\Incomplete\T-5186099-yeh hum nahin new remix.au Infected: Trojan-Downloader.WMA.GetCodec.s 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Incomplete\T-5872823-jason derulo.au Infected: Trojan-Downloader.WMA.GetCodec.s 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\dil bole haddipa.wma Infected: Trojan-Downloader.WMA.Wimad.y 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\dooriyan most popular hit.au Infected: Trojan-Downloader.WMA.GetCodec.s 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\empire state of mind new cover version.mp3 Infected: Trojan-Downloader.WMA.GetCodec.s 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\Lazy Lazy Lamhe.wma Infected: Trojan.Win32.StartPage.ehg 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\new york.au Infected: Trojan-Downloader.WMA.GetCodec.s 1
D:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\ye doorian.au Infected: Trojan-Downloader.WMA.GetCodec.s 1
D:\Documents and Settings\Administrator\My Documents\Outlook\Outlook backup.pst Infected: Trojan.Win32.Small.kn 1
D:\Documents and Settings\Administrator\My Documents\Outlook\Outlook.pst Infected: Trojan.Win32.Small.kn 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01980000.VBN Infected: Trojan-Downloader.Win32.Homles.z 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01B00000.VBN Infected: Trojan-Downloader.HTML.Small.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01B00001.VBN Infected: Packed.JS.Agent.a 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01EC0000.VBN Infected: Exploit.Java.ByteVerify 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02700000.VBN Infected: Exploit.JS.CVE-2006-1359.c 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02700001.VBN Infected: Exploit.JS.CVE-2006-1359.c 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\02700002.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\051C0000.VBN Infected: Trojan-Downloader.Win32.Homles.bu 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06740000.VBN Infected: Trojan-Downloader.Win32.Small.akz 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08D40000.VBN Infected: Exploit.HTML.Iframe.FileDownload.bd 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08D40001.VBN Infected: Exploit.HTML.Iframe.FileDownload.bd 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08E40000.VBN Infected: Trojan-Downloader.Win32.Homles.bu 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08E40001.VBN Infected: not-a-virus:AdWare.Win32.PurityScan.if 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08E40002.VBN Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08E40003.VBN Infected: Trojan-Downloader.Win32.Homles.bu 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09180000.VBN Infected: Trojan-Downloader.HTML.IFrame.ds 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09180001.VBN Infected: Trojan-Downloader.VBS.Psyme.gf 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09980000.VBN Infected: Trojan.Java.ClassLoader.ao 3
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09AC0000.VBN Infected: not-a-virus:AdWare.Win32.PurityScan.fn 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80001.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80002.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80003.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80004.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80005.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80006.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80007.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80008.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F80009.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F8000A.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F8000B.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F8000C.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F8000D.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09F8000E.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A3C0000.VBN Infected: Trojan-Downloader.Win32.Small.eqn 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80001.VBN Infected: Trojan-Downloader.Win32.VB.eyc 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80002.VBN Infected: Trojan-Downloader.Win32.VB.eyc 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80003.VBN Infected: Trojan.Win32.Monderc.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80004.VBN Infected: Trojan.Win32.Monderc.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80005.VBN Infected: Trojan-Downloader.Win32.Homles.br 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80006.VBN Infected: Trojan-Downloader.Win32.Homles.br 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80007.VBN Infected: Trojan-Downloader.Win32.Homles.br 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80008.VBN Infected: Trojan-Downloader.Win32.Homles.br 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE80009.VBN Infected: not-a-virus:AdWare.Win32.PurityScan.if 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE8000A.VBN Infected: Trojan.Win32.Monderc.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE8000B.VBN Infected: Trojan-Downloader.Win32.Homles.br 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE8000C.VBN Infected: Trojan-Downloader.Win32.Homles.br 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AE8000D.VBN Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0BB40000.VBN Infected: Backdoor.Win32.Agent.dbm 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0BB40001.VBN Infected: Trojan.Win32.Monder.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C140000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.bif 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C140001.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.bif 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C280000.VBN Infected: Trojan-Downloader.JS.Agent.hv 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C280001.VBN Infected: Trojan-Downloader.JS.Agent.hv 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C3C0000.VBN Infected: Virus.MSWord.Thus.ew 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C780000.VBN Infected: Trojan-Downloader.Win32.Homles.bu 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0000.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0001.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0002.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0003.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0004.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0005.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0006.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0007.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0008.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC0009.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC000A.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CBC000B.VBN Infected: Backdoor.Win32.Haxdoor.hx 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CDC0000.VBN Infected: Trojan-Downloader.Win32.Homles.bu 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CDC0002.VBN Infected: Trojan.Win32.Monder.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CDC0004.VBN Infected: Trojan-Downloader.Win32.Small.vrq 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CDC0006.VBN Infected: Trojan-Downloader.Win32.Agent.brq 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D480002.VBN Infected: Trojan.Win32.FraudPack.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D800000.VBN Infected: Trojan.Win32.LowZones.cu 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D880000.VBN Infected: Packed.Win32.PolyCrypt.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D880002.VBN Infected: Packed.Win32.PolyCrypt.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D880003.VBN Infected: Packed.Win32.PolyCrypt.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D880005.VBN Infected: Backdoor.Win32.Frauder.aie 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D880007.VBN Infected: Trojan.Win32.Agent.bcbh 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D880009.VBN Infected: Trojan.Win32.Pakes.mmg 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D88000B.VBN Infected: Trojan.Win32.Agent.bcbh 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D88000D.VBN Infected: Trojan.Win32.Midgare.tjc 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB00000.VBN Infected: Trojan.Java.ClassLoader.ao 3
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40000.VBN Infected: Trojan-Downloader.Win32.Agent.iab 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40001.VBN Infected: Trojan-Downloader.Win32.Agent.iab 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40002.VBN Infected: Trojan-Downloader.Win32.VB.cge 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40003.VBN Infected: Trojan-Downloader.Win32.VB.cge 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40004.VBN Infected: Trojan-Downloader.Win32.VB.cge 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40005.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40006.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40007.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40008.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40009.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB4000A.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB4000B.VBN Infected: not-a-virus:AdWare.Win32.PurityScan.gt 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB4000C.VBN Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB4000D.VBN Infected: Trojan-Downloader.Win32.VB.cge 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB4000E.VBN Infected: Trojan-Downloader.Win32.VB.cge 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB4000F.VBN Infected: not-a-virus:Downloader.Win32.WinFixer.dz 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40010.VBN Infected: not-a-virus:Downloader.Win32.WinFixer.dz 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40011.VBN Infected: not-a-virus:Downloader.Win32.WinFixer.au 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40012.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40013.VBN Infected: Trojan-Downloader.Win32.Homles.x 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40014.VBN Infected: Trojan.Win32.Monder.gen 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB40015.VBN Infected: Trojan-Downloader.Win32.Agent.gwe 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DB80000.VBN Infected: Trojan-Downloader.Win32.Ieser.a 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DD00000.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DD00001.VBN Infected: Trojan-Downloader.Win32.VB.epp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DD00002.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DD00003.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DD00004.VBN Infected: Trojan-Downloader.Win32.ConHook.aek 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DFC0000.VBN Infected: Packed.Win32.PolyCrypt.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E580000.VBN Infected: Trojan.Win32.BHO.bkm 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E580001.VBN Infected: not-a-virus:AdWare.Win32.Rond.g 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E580002.VBN Infected: Trojan-Downloader.Win32.Agent.jih 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E580003.VBN Infected: Trojan-Downloader.Win32.Agent.ezc 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E580004.VBN Infected: not-a-virus:AdWare.Win32.Rond.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00000.VBN Infected: Packed.Win32.PolyCrypt.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00001.VBN Infected: Packed.Win32.PolyCrypt.d 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00002.VBN Infected: Trojan.Win32.Midgare.tjc 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00003.VBN Infected: Trojan.Win32.Midgare.tjc 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F040000.VBN Infected: Trojan-Downloader.Win32.Homles.z 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F040001.VBN Infected: not-a-virus:AdWare.Win32.PurityScan.fn 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FB40000.VBN Infected: Trojan-Downloader.Win32.Agent.dxj 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FB40001.VBN Infected: Trojan-Downloader.Win32.Agent.dxj 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FB40002.VBN Infected: Trojan-Downloader.Win32.VB.bsp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FB40003.VBN Infected: Trojan-Downloader.Win32.VB.bsp 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FB40004.VBN Infected: Trojan-Downloader.Win32.Small.gll 1
D:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0FB40005.VBN Infected: Trojan-Downloader.Win32.Small.gll 1

Selected area has been scanned.

[Rorschach112]

hi

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  
  :Services
  
  :Reg
  
  :Files
  c:\windows\system32\SysWoW32
  D:\Documents and Settings\Administrator\My Documents\LimeWire
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[fern_06]

Here's the OTL log:

OTL logfile created on: 12/15/2009 10:35:56 PM - Run 2
OTL by OldTimer - Version 3.1.11.9 Folder = F:\
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.92 Mb Total Physical Memory | 577.63 Mb Available Physical Memory | 56.47% Memory free
2.40 Gb Paging File | 2.08 Gb Available in Paging File | 86.68% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 15.14 Gb Total Space | 0.75 Gb Free Space | 4.96% Space Free | Partition Type: NTFS
Drive D: | 22.11 Gb Total Space | 10.94 Gb Free Space | 49.47% Space Free | Partition Type: NTFS
Drive E: | 702.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 963.70 Mb Total Space | 655.41 Mb Free Space | 68.01% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FCH543-T41
Current User Name: fch543
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/12/09 09:44:52 | 00,536,576 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
PRC - [2009/06/05 12:39:22 | 00,292,136 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/06/05 12:39:14 | 00,541,992 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/05/26 16:18:30 | 00,413,696 | ---- | M] (Apple Inc.) -- C:\Program Files\QuickTime\QTTask.exe
PRC - [2009/03/23 22:33:00 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
PRC - [2009/01/13 21:37:00 | 01,830,128 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2009/01/09 18:01:47 | 00,136,600 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/01/09 18:01:46 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2008/12/14 08:29:00 | 00,467,240 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Pure Networks\Network Magic\nmapp.exe
PRC - [2008/12/12 17:06:40 | 00,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2008/12/12 17:06:40 | 00,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/06/12 02:38:00 | 00,034,672 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
PRC - [2007/08/30 16:43:18 | 00,103,664 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
PRC - [2007/06/13 05:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/12/08 18:35:54 | 00,094,208 | ---- | M] (SealedMedia) -- C:\Program Files\SealedMedia\sealmon.exe
PRC - [2004/05/19 03:21:00 | 00,073,728 | ---- | M] (IBM Corp.) -- C:\WINDOWS\system32\QCONSVC.EXE
PRC - [2004/05/13 21:36:34 | 00,397,312 | ---- | M] () -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2004/04/08 18:12:06 | 00,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2004/04/08 18:11:26 | 00,512,000 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PRC - [2004/04/07 06:21:50 | 00,303,171 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\S24EvMon.exe
PRC - [2004/04/07 06:20:40 | 00,122,880 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\RegSrvc.exe
PRC - [2004/03/26 18:16:30 | 00,102,400 | ---- | M] (IBM Corp.) -- C:\WINDOWS\system32\TpShocks.exe
PRC - [2004/03/12 15:18:32 | 00,124,128 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe
PRC - [2004/03/12 15:17:10 | 00,029,928 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe
PRC - [2004/03/10 10:10:44 | 00,077,824 | ---- | M] () -- C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
PRC - [2004/03/10 10:10:40 | 00,094,208 | ---- | M] () -- C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
PRC - [2004/02/29 16:44:54 | 00,242,808 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
PRC - [2004/02/29 16:44:46 | 00,066,680 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2004/02/26 01:26:00 | 00,057,344 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe
PRC - [2003/06/27 08:53:32 | 00,088,363 | ---- | M] (Agere Systems) -- C:\WINDOWS\AGRSMMSG.exe
PRC - [2002/10/08 22:28:42 | 00,040,960 | ---- | M] () -- C:\WINDOWS\system32\TpScrLk.exe
PRC - [2002/01/10 15:01:34 | 00,065,536 | ---- | M] (IBM Corporation) -- C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe


========== Modules (SafeList) ==========

MOD - [2009/12/09 09:44:52 | 00,536,576 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
MOD - [2006/08/25 10:45:55 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
MOD - [2004/04/08 18:11:54 | 00,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/06/05 12:39:14 | 00,541,992 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/03/23 22:33:00 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/03/18 01:04:42 | 01,685,024 | ---- | M] (NanJing Nagasoft Co, LTD.) -- C:\WINDOWS\system32\Nagasoft\vjocx.dll -- (vvdsvc)
SRV - [2009/01/09 18:01:46 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2008/12/12 17:06:40 | 00,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2004/08/04 00:56:44 | 00,027,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\irmon.dll -- (Irmon)
SRV - [2004/05/26 10:33:18 | 00,068,096 | ---- | M] () -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2004/05/19 03:21:00 | 00,073,728 | ---- | M] (IBM Corp.) -- C:\WINDOWS\system32\QCONSVC.EXE -- (QCONSVC)
SRV - [2004/05/13 21:36:34 | 00,397,312 | ---- | M] () -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2004/04/07 06:21:50 | 00,303,171 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\S24EvMon.exe -- (S24EventMonitor)
SRV - [2004/04/07 06:20:40 | 00,122,880 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\RegSrvc.exe -- (RegSrvc)
SRV - [2004/03/12 15:18:06 | 00,169,192 | ---- | M] (symantec) -- C:\Program Files\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2004/03/12 15:17:46 | 01,221,864 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2004/03/12 15:17:10 | 00,029,928 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2004/03/11 14:58:32 | 00,193,760 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2004/02/29 16:44:54 | 00,242,808 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2004/02/29 16:44:52 | 00,087,160 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe -- (ccPwdSvc)
SRV - [2004/02/29 16:44:48 | 00,255,096 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2004/02/26 01:26:00 | 00,057,344 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC)
SRV - [2003/07/28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E2 DD E0 01 F2 92 7C 42 9F FC E8 D7 65 12 81 CA [binary data]
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\students, = http://www.kellogg.n...edu/students/%s
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\students, = +
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\students,# = %23
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\students,% = %25
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\students,& = %26
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\students,+ = %2B
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo....r=ytff-msgr&p="
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..keyword.URL: "http://search.yahoo....r=ytff-msgr&p="

FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/09 21:06:53 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/10/11 16:20:12 | 00,000,000 | ---D | M]

[2009/06/21 13:09:38 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/06/21 13:09:38 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[email protected]
[2009/10/10 16:07:57 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0w39mi1n.default\extensions
[2008/03/08 18:26:43 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0w39mi1n.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/12/09 00:14:58 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0w39mi1n.default\extensions\{8a8f8ea7-b43a-447a-82a0-90098d3703eb}
[2009/10/10 16:07:54 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0w39mi1n.default\extensions\[email protected]
[2009/10/10 16:07:57 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0w39mi1n.default\extensions\staged-xpis
[2009/12/06 19:18:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/12/06 19:18:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{4E551550-1870-479D-BF66-DF77900E100E}
[2009/08/12 08:45:02 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2009/08/12 08:44:29 | 00,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll
[2009/08/12 08:44:30 | 00,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2009/08/12 08:44:30 | 00,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll
[2009/08/12 08:44:33 | 00,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2009/12/09 21:06:49 | 00,122,880 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\wsff.dll
[2009/08/12 08:44:33 | 00,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll

O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! ¤u¨ã¦C) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! ¤u¨ã¦C) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe (SealedMedia)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
O4 - HKLM..\Run: [TPKBDLED] C:\WINDOWS\system32\TpScrLk.exe ()
O4 - HKLM..\Run: [TpShocks] C:\WINDOWS\System32\TpShocks.exe (IBM Corp.)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [RealPlayer] C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuNetworkPlaces = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft....k/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.micr...78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} https://lnmail4.disc...om/iNotes6W.cab (iNotes6 Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://go.divx.com/p...owserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupd...AB?38132.640625 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://portico.disc...perSetupSP1.cab (JuniperSetupControlXP Class)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/...SetupClient.cab (JuniperSetupClientControl Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.29.103.15 24.29.103.16
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\System32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O20 - Winlogon\Notify\QConGina: DllName - QConGina.dll - C:\WINDOWS\System32\QConGina.dll (IBM Corp.)
O24 - Desktop Components:0 () - http://us.f3.yahoofs...hJL4PDBIyPUMhcZ
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/05/23 17:12:12 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2009/12/13 23:30:56 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/12/13 23:30:21 | 00,343,040 | ---- | C] (OldTimer Tools) -- D:\Documents and Settings\Administrator\Desktop\TFC.exe
[2009/12/12 14:11:36 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2009/12/12 14:11:35 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2009/12/12 14:11:35 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2009/12/12 14:11:35 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2009/12/12 14:11:13 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/12/06 18:50:09 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2009/12/06 18:48:51 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Application Data\WinRAR
[2009/12/06 18:48:21 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2009/12/06 18:48:21 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[52 D:\Documents and Settings\Administrator\Desktop\*.tmp files -> D:\Documents and Settings\Administrator\Desktop\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2009/12/15 22:35:14 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/12/15 22:35:11 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2009/12/15 22:34:30 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/12/15 22:34:24 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/12/15 22:34:20 | 10,726,80960 | -HS- | M] () -- C:\hiberfil.sys
[2009/12/15 22:33:06 | 05,242,880 | -H-- | M] () -- D:\Documents and Settings\Administrator\NTUSER.DAT
[2009/12/15 22:33:06 | 00,000,278 | -HS- | M] () -- D:\Documents and Settings\Administrator\ntuser.ini
[2009/12/13 23:30:24 | 00,343,040 | ---- | M] (OldTimer Tools) -- D:\Documents and Settings\Administrator\Desktop\TFC.exe
[2009/12/12 16:40:30 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/12/12 14:07:30 | 03,850,336 | R--- | M] () -- D:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2009/12/11 19:49:35 | 00,000,533 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2009/12/11 19:49:35 | 00,000,520 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2009/12/10 19:57:17 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/12/09 22:54:07 | 00,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2009/12/09 21:53:22 | 00,000,181 | ---- | M] () -- C:\WINDOWS\hpbafd.ini
[2009/12/09 21:08:20 | 00,000,930 | ---- | M] () -- D:\Documents and Settings\Administrator\Desktop\Privacy-Components.lnk
[2009/12/09 21:07:52 | 00,000,817 | ---- | M] () -- C:\WINDOWS\System32\742079991
[2009/12/09 21:06:25 | 00,001,250 | -HS- | M] () -- C:\WINDOWS\System32\2087415207
[2009/12/09 01:12:39 | 04,842,520 | -H-- | M] () -- D:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2009/12/06 18:56:04 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009/12/06 18:56:04 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009/12/06 18:51:50 | 00,444,596 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009/12/06 18:51:50 | 00,072,306 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009/12/06 18:51:49 | 00,525,770 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/06 18:50:17 | 00,000,613 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/12/06 18:49:21 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009/12/06 18:48:25 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/12/03 16:14:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[52 D:\Documents and Settings\Administrator\Desktop\*.tmp files -> D:\Documents and Settings\Administrator\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/12/12 14:11:36 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2009/12/12 14:11:35 | 00,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2009/12/12 14:11:35 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2009/12/12 14:11:35 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2009/12/12 14:11:35 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2009/12/12 14:07:21 | 03,850,336 | R--- | C] () -- D:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2009/12/09 21:08:20 | 00,000,930 | ---- | C] () -- D:\Documents and Settings\Administrator\Desktop\Privacy-Components.lnk
[2009/12/06 18:50:31 | 00,764,868 | ---- | C] () -- C:\WINDOWS\System32\dllcache\apph_sp.sdb
[2009/12/06 18:50:31 | 00,217,118 | ---- | C] () -- C:\WINDOWS\System32\dllcache\apphelp.sdb
[2009/12/06 18:49:23 | 00,001,250 | -HS- | C] () -- C:\WINDOWS\System32\2087415207
[2009/12/06 18:49:22 | 00,000,817 | ---- | C] () -- C:\WINDOWS\System32\742079991
[2009/12/06 18:48:25 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/10/03 09:17:41 | 08,673,792 | ---- | C] () -- D:\Documents and Settings\All Users\Application Data\atscie.msi
[2008/03/04 17:52:34 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2007/10/31 08:39:54 | 00,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007/05/17 12:58:10 | 00,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2006/12/16 13:26:56 | 00,001,458 | ---- | C] () -- C:\Program Files\DOWNLOAD_INSTALL.LOG
[2006/09/16 12:16:28 | 00,004,217 | ---- | C] () -- D:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/02/27 16:51:53 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2006/02/27 16:51:53 | 00,000,339 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2006/02/27 01:46:41 | 00,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2006/02/27 01:46:41 | 00,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2006/01/25 19:16:20 | 00,017,016 | ---- | C] () -- C:\WINDOWS\System32\SS32DVR.DLL
[2005/09/14 11:55:01 | 00,000,037 | ---- | C] () -- C:\WINDOWS\ipixActivex.ini
[2005/05/11 13:10:08 | 00,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2005/04/04 12:01:13 | 00,000,181 | ---- | C] () -- C:\WINDOWS\hpbafd.ini
[2005/04/01 14:09:08 | 00,003,852 | ---- | C] () -- C:\WINDOWS\avvrh.dll
[2004/08/25 19:26:18 | 00,004,608 | ---- | C] () -- D:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/07/07 10:22:05 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/07/06 13:41:21 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2004/06/09 14:56:53 | 00,000,852 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/06/03 14:13:48 | 00,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI
[2004/05/28 12:15:46 | 00,002,295 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.SYS
[2004/05/26 17:07:40 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/05/26 17:07:40 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/05/26 17:07:40 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/05/26 17:07:40 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/05/26 17:07:39 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/05/26 17:07:39 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/05/26 15:53:38 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/05/26 15:53:23 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/05/26 15:53:23 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
[2004/05/26 15:41:03 | 00,008,831 | ---- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2004/05/26 15:40:49 | 00,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS
[2004/05/26 15:40:24 | 00,049,152 | ---- | C] () -- C:\WINDOWS\System32\Sensor.dll
[2004/05/26 15:39:23 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2004/05/23 18:53:39 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\ADsSecurity.dll
[2004/05/23 18:51:18 | 00,122,880 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004/05/23 18:51:18 | 00,049,152 | ---- | C] () -- C:\WINDOWS\System32\tpinspm.dll
[2004/05/23 17:12:25 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/04/07 06:21:16 | 00,212,992 | ---- | C] () -- C:\WINDOWS\System32\C1XStngs.dll
[2004/03/18 12:55:48 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/10/08 13:34:26 | 00,121,440 | ---- | C] () -- C:\WINDOWS\System32\MSDRMCtrl.dll
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2006/02/07 01:05:09 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Aim
[2006/07/22 20:27:24 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\BitTorrent
[2005/05/12 01:45:50 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\IBM
[2004/07/29 20:46:10 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\InterVideo
[2009/10/26 20:55:42 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Juniper Networks
[2009/12/06 19:14:24 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\LimeWire
[2004/06/01 12:31:25 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Qualcomm
[2007/07/25 21:46:21 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Application Data\Viewpoint
[2005/03/31 11:32:06 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\AdDestroyer
[2004/06/09 16:40:09 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\IBM
[2009/07/31 08:02:42 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\Juniper Networks
[2005/02/14 02:09:10 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\MSN Messenger 6.2.0205
[2005/03/31 16:27:00 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\VBouncer
[2009/01/09 18:07:32 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\Viewpoint
[2004/09/11 17:14:03 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\Visual Networks
[2009/06/21 12:56:08 | 00,000,000 | ---D | M] -- D:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2004/05/26 15:40:32 | 00,000,314 | ---- | M] () -- C:\WINDOWS\Tasks\BMMTask.job

========== Purity Check ==========


< End of report >

[Rorschach112]

hi

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  [2009/12/09 21:07:52 | 00,000,817 | ---- | M] () -- C:\WINDOWS\System32\742079991
  [2009/12/09 21:06:25 | 00,001,250 | -HS- | M] () -- C:\WINDOWS\System32\2087415207
  [2009/12/06 18:49:21 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
  
  :Services
  
  :Reg
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Your logs are clean


Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

• Download OTC to your desktop and run it
• Click Yes to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com.../readstep2.html


Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  
• Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
  secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
  blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
  Here
  
  
  If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  
  
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
  
  
• Please read my guide on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.