1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Virus cripples CPU and redirects Ebay Login to phishing site

Discussion in 'Malware and Virus Removal Archive' started by macoons, 2010/04/03.

Page 1 of 3
  1. 2010/04/03
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    [Resolved] Virus cripples CPU and redirects Ebay Login to phishing site

    Good morning and thank you so much for the work you do here. I am new to this service so please forgive and feel free to correct my mistakes.

    The computer started being extrememly sluggish about a month ago. I am running McAfee. I ran Adaware, Spybot, PCtools Spyware Doctor, and Malwarebytes. Each of the programs found some problems and fixed them but performance was still degraded. In looking at the performance screen on Task Manager, the CPU is almost always maxxed out. Ulitmately I tried logging in to EBAY and got redirected to a very authentic looking phishing screen.

    I searched on Google for others with this problem and ultimately was directed here. Thanks in advance for your help. Logs follow:



    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Carolyn Coons at 10:42:01.87 on Sat 04/03/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1278.743 [GMT -7:00]

    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    SVCHOST.EXE
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    SVCHOST.EXE
    SVCHOST.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    SVCHOST.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Carolyn Coons\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
    EB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No File
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Typer%20Shark/Images/stg_drm.ocx
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
    DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
    Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Notify: igfxcui - igfxdev.dll
    Hosts: 127.0.0.1 www.spywareinfo.com

    ============= SERVICES / DRIVERS ===============

    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-3-28 217032]
    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-2-10 214664]
    R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-3 93320]
    R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-6-11 359952]
    R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-2-10 144704]
    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-2-10 606736]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-2-10 79816]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-2-10 35272]
    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-2-10 40552]
    RUnknown pavboot;pavboot; [x]
    S2 aixfvlciydkto;aixfvlciydkto;\??\c:\windows\system32\drivers\cdyapsuvowkc.sys --> c:\windows\system32\drivers\cdyapsuvowkc.sys [?]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-10 135664]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-2-10 34248]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-3-28 366840]
    S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-3-28 1142224]

    =============== Created Last 30 ================

    2010-03-31 04:30:00 0 d-----w- c:\program files\Panda Security
    2010-03-31 03:36:15 0 d-----w- c:\program files\Trend Micro
    2010-03-31 01:25:47 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
    2010-03-31 01:25:47 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
    2010-03-28 20:39:21 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat
    2010-03-28 20:39:21 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2010-03-28 20:39:13 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2010-03-28 20:39:13 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat
    2010-03-28 20:39:13 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat
    2010-03-28 20:39:13 217032 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2010-03-28 20:39:04 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat
    2010-03-28 20:39:04 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2010-03-28 20:38:56 0 d-----w- c:\program files\common files\PC Tools
    2010-03-28 20:38:56 0 d-----w- c:\docume~1\alluse~1\applic~1\PC Tools
    2010-03-28 20:03:02 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
    2010-03-28 20:03:02 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
    2010-03-28 20:03:02 42376 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
    2010-03-28 20:03:02 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
    2010-03-28 20:02:51 0 d-----w- c:\program files\Spyware Doctor
    2010-03-28 20:02:51 0 d-----w- c:\docume~1\caroly~1\applic~1\PC Tools
    2010-03-22 00:24:57 0 d-----w- c:\program files\common files\Wise Installation Wizard

    ==================== Find3M ====================

    2010-03-30 07:46:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-03-30 07:45:52 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-02-25 18:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll
    2010-02-24 09:54:25 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe
    2009-09-23 01:43:40 17307 ----a-w- c:\program files\common files\pyvafawyfy.lib
    2009-09-25 11:39:10 53248 --sha-w- c:\windows\system32\posodilo.exe
    2009-09-26 15:24:44 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009092620090927\index.dat

    ============= FINISH: 10:43:47.98 ===============







    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/18/2005 9:03:53 PM
    System Uptime: 4/3/2010 12:05:44 AM (10 hours ago)

    Motherboard: Dell Computer Corp. | | 0K8980
    Processor: Intel(R) Celeron(R) CPU 2.40GHz | Microprocessor | 2394/533mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 34 GiB total, 12.042 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP126: 2/14/2010 6:29:14 AM - System Checkpoint
    RP127: 2/15/2010 7:29:14 AM - System Checkpoint
    RP128: 2/16/2010 8:29:14 AM - System Checkpoint
    RP129: 2/17/2010 9:45:31 AM - System Checkpoint
    RP130: 2/18/2010 10:29:15 AM - System Checkpoint
    RP131: 2/19/2010 11:21:59 AM - System Checkpoint
    RP132: 2/20/2010 11:41:17 AM - System Checkpoint
    RP133: 2/21/2010 12:31:22 PM - System Checkpoint
    RP134: 2/22/2010 2:16:45 PM - System Checkpoint
    RP135: 2/23/2010 2:31:22 PM - System Checkpoint
    RP136: 2/24/2010 3:00:17 AM - Software Distribution Service 3.0
    RP137: 2/25/2010 3:31:23 AM - System Checkpoint
    RP138: 2/26/2010 3:51:08 AM - System Checkpoint
    RP139: 2/27/2010 4:51:06 AM - System Checkpoint
    RP140: 2/28/2010 5:05:41 AM - System Checkpoint
    RP141: 3/1/2010 5:41:17 AM - System Checkpoint
    RP142: 3/2/2010 6:41:16 AM - System Checkpoint
    RP143: 3/3/2010 7:42:22 AM - System Checkpoint
    RP144: 3/4/2010 8:42:21 AM - System Checkpoint
    RP145: 3/5/2010 9:42:22 AM - System Checkpoint
    RP146: 3/6/2010 11:02:42 AM - System Checkpoint
    RP147: 3/7/2010 11:21:41 AM - System Checkpoint
    RP148: 3/8/2010 12:21:40 PM - System Checkpoint
    RP149: 3/9/2010 1:21:40 PM - System Checkpoint
    RP150: 3/10/2010 1:35:10 PM - System Checkpoint
    RP151: 3/11/2010 3:00:18 AM - Software Distribution Service 3.0
    RP152: 3/12/2010 3:34:11 AM - System Checkpoint
    RP153: 3/13/2010 3:43:54 AM - System Checkpoint
    RP154: 3/14/2010 5:43:54 AM - System Checkpoint
    RP155: 3/15/2010 6:43:53 AM - System Checkpoint
    RP156: 3/16/2010 7:43:54 AM - System Checkpoint
    RP157: 3/17/2010 8:43:56 AM - System Checkpoint
    RP158: 3/18/2010 9:17:31 AM - System Checkpoint
    RP159: 3/19/2010 10:08:10 AM - System Checkpoint
    RP160: 3/20/2010 10:46:00 AM - System Checkpoint
    RP161: 3/21/2010 12:19:18 PM - System Checkpoint
    RP162: 3/21/2010 5:23:11 PM - Removed Ad-Aware 2007
    RP163: 3/21/2010 5:25:55 PM - Installed Ad-Aware
    RP164: 3/22/2010 6:12:37 PM - System Checkpoint
    RP165: 3/23/2010 7:12:36 PM - System Checkpoint
    RP166: 3/24/2010 8:12:36 PM - System Checkpoint
    RP167: 3/25/2010 9:38:36 PM - System Checkpoint
    RP168: 3/26/2010 10:10:39 PM - System Checkpoint
    RP169: 3/27/2010 10:48:37 PM - System Checkpoint
    RP170: 3/28/2010 11:48:41 PM - System Checkpoint
    RP171: 3/30/2010 12:48:39 AM - System Checkpoint
    RP172: 3/31/2010 1:02:14 AM - System Checkpoint
    RP173: 3/31/2010 3:00:21 AM - Software Distribution Service 3.0
    RP174: 4/1/2010 3:23:04 AM - System Checkpoint
    RP175: 4/2/2010 4:23:03 AM - System Checkpoint
    RP176: 4/3/2010 5:10:27 AM - System Checkpoint
    RP177: 4/3/2010 10:36:06 AM - Removed Banctec Service Agreement
    RP178: 4/3/2010 10:37:13 AM - Removed EarthLink setup files

    ==== Installed Programs ======================

    Ad-Aware
    Adobe Flash Player 10 ActiveX
    Adobe Reader 7.1.0
    Adobe Shockwave Player 11
    AT&T Self Support Tool
    AT&T Yahoo! Applications
    Dell Digital Jukebox Driver
    Dell Driver Reset Tool
    Dell System Restore
    DellSupport
    FolderShare
    Google Toolbar for Internet Explorer
    Google Update Helper
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    HP Deskjet 3740
    HP Software Update
    Intel(R) Extreme Graphics 2 Driver
    Intel(R) PRO Network Adapters and Drivers
    Intel(R) PROSet for Wired Connections
    Internet Explorer Default Page
    Java(TM) 6 Update 16
    Learn2 Player (Uninstall Only)
    Macromedia Flash Player
    Malwarebytes' Anti-Malware
    McAfee SecurityCenter
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2000 Standard
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Works Setup Launcher
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    QuickTime
    RealPlayer Basic
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 7 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB883939)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB896688)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899588)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB903235)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB905915)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB908531)
    Security Update for Windows XP (KB911280)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911567)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912812)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917159)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB918899)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920214)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB921883)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922760)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928090)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB929969)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931768)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933566)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937143)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB939653)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB942615)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB948881)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958470)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978706)
    Sonic DLA
    Sonic RecordNow!
    Sonic Update Manager
    Spybot - Search & Destroy
    Spyware Doctor 7.0
    Super Text Twist®
    Typer Shark
    Update for Windows Internet Explorer 8 (KB973874)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB894391)
    Update for Windows XP (KB896727)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB929338)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB931836)
    Update for Windows XP (KB932823-v3)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB942840)
    Update for Windows XP (KB946627)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    WebFldrs XP
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Hotfix - KB834707
    Windows XP Hotfix - KB867282
    Windows XP Hotfix - KB873333
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB888310
    Windows XP Hotfix - KB890047
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB890923
    Windows XP Hotfix - KB891781
    Windows XP Hotfix - KB893066
    Windows XP Hotfix - KB893086
    Yahoo! Toolbar

    ==== Event Viewer Messages From Past Week ========

    4/3/2010 12:07:07 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
    4/3/2010 10:36:08 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
    4/2/2010 2:03:27 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
    4/2/2010 1:55:41 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired.
    4/2/2010 1:33:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    4/2/2010 1:33:34 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNASvc with arguments " " in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}
    4/2/2010 1:32:56 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk MPFP MRxSmb NetBIOS NetBT pavboot RasAcd Rdbss Tcpip
    4/2/2010 1:32:56 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    4/2/2010 1:32:56 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    4/2/2010 1:32:56 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    4/2/2010 1:32:25 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    4/2/2010 1:16:57 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 80566ca7, parameter3 aff3e61c, parameter4 00000000.
    4/2/2010 1:09:58 PM, error: Dhcp [1002] - The IP address lease 192.168.2.2 for the Network Card with network address 001111E9D551 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    4/1/2010 3:36:23 PM, error: Service Control Manager [7031] - The McAfee Services service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    3/30/2010 6:26:19 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Security Service service to connect.
    3/30/2010 6:26:19 PM, error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

    ==== End Of File ===========================
     
    macoons,
    #1
  2. 2010/04/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!


    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Installer under Version 2.0.2
    [DO NOT download version 2.0.3 (beta)]
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator
     
    broni,
    #2


  3. to hide this advert.

  4. 2010/04/03
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    Combofix :


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/18/2005 9:03:53 PM
    System Uptime: 4/3/2010 12:05:44 AM (10 hours ago)

    Motherboard: Dell Computer Corp. | | 0K8980
    Processor: Intel(R) Celeron(R) CPU 2.40GHz | Microprocessor | 2394/533mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 34 GiB total, 12.042 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP126: 2/14/2010 6:29:14 AM - System Checkpoint
    RP127: 2/15/2010 7:29:14 AM - System Checkpoint
    RP128: 2/16/2010 8:29:14 AM - System Checkpoint
    RP129: 2/17/2010 9:45:31 AM - System Checkpoint
    RP130: 2/18/2010 10:29:15 AM - System Checkpoint
    RP131: 2/19/2010 11:21:59 AM - System Checkpoint
    RP132: 2/20/2010 11:41:17 AM - System Checkpoint
    RP133: 2/21/2010 12:31:22 PM - System Checkpoint
    RP134: 2/22/2010 2:16:45 PM - System Checkpoint
    RP135: 2/23/2010 2:31:22 PM - System Checkpoint
    RP136: 2/24/2010 3:00:17 AM - Software Distribution Service 3.0
    RP137: 2/25/2010 3:31:23 AM - System Checkpoint
    RP138: 2/26/2010 3:51:08 AM - System Checkpoint
    RP139: 2/27/2010 4:51:06 AM - System Checkpoint
    RP140: 2/28/2010 5:05:41 AM - System Checkpoint
    RP141: 3/1/2010 5:41:17 AM - System Checkpoint
    RP142: 3/2/2010 6:41:16 AM - System Checkpoint
    RP143: 3/3/2010 7:42:22 AM - System Checkpoint
    RP144: 3/4/2010 8:42:21 AM - System Checkpoint
    RP145: 3/5/2010 9:42:22 AM - System Checkpoint
    RP146: 3/6/2010 11:02:42 AM - System Checkpoint
    RP147: 3/7/2010 11:21:41 AM - System Checkpoint
    RP148: 3/8/2010 12:21:40 PM - System Checkpoint
    RP149: 3/9/2010 1:21:40 PM - System Checkpoint
    RP150: 3/10/2010 1:35:10 PM - System Checkpoint
    RP151: 3/11/2010 3:00:18 AM - Software Distribution Service 3.0
    RP152: 3/12/2010 3:34:11 AM - System Checkpoint
    RP153: 3/13/2010 3:43:54 AM - System Checkpoint
    RP154: 3/14/2010 5:43:54 AM - System Checkpoint
    RP155: 3/15/2010 6:43:53 AM - System Checkpoint
    RP156: 3/16/2010 7:43:54 AM - System Checkpoint
    RP157: 3/17/2010 8:43:56 AM - System Checkpoint
    RP158: 3/18/2010 9:17:31 AM - System Checkpoint
    RP159: 3/19/2010 10:08:10 AM - System Checkpoint
    RP160: 3/20/2010 10:46:00 AM - System Checkpoint
    RP161: 3/21/2010 12:19:18 PM - System Checkpoint
    RP162: 3/21/2010 5:23:11 PM - Removed Ad-Aware 2007
    RP163: 3/21/2010 5:25:55 PM - Installed Ad-Aware
    RP164: 3/22/2010 6:12:37 PM - System Checkpoint
    RP165: 3/23/2010 7:12:36 PM - System Checkpoint
    RP166: 3/24/2010 8:12:36 PM - System Checkpoint
    RP167: 3/25/2010 9:38:36 PM - System Checkpoint
    RP168: 3/26/2010 10:10:39 PM - System Checkpoint
    RP169: 3/27/2010 10:48:37 PM - System Checkpoint
    RP170: 3/28/2010 11:48:41 PM - System Checkpoint
    RP171: 3/30/2010 12:48:39 AM - System Checkpoint
    RP172: 3/31/2010 1:02:14 AM - System Checkpoint
    RP173: 3/31/2010 3:00:21 AM - Software Distribution Service 3.0
    RP174: 4/1/2010 3:23:04 AM - System Checkpoint
    RP175: 4/2/2010 4:23:03 AM - System Checkpoint
    RP176: 4/3/2010 5:10:27 AM - System Checkpoint
    RP177: 4/3/2010 10:36:06 AM - Removed Banctec Service Agreement
    RP178: 4/3/2010 10:37:13 AM - Removed EarthLink setup files

    ==== Installed Programs ======================

    Ad-Aware
    Adobe Flash Player 10 ActiveX
    Adobe Reader 7.1.0
    Adobe Shockwave Player 11
    AT&T Self Support Tool
    AT&T Yahoo! Applications
    Dell Digital Jukebox Driver
    Dell Driver Reset Tool
    Dell System Restore
    DellSupport
    FolderShare
    Google Toolbar for Internet Explorer
    Google Update Helper
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    HP Deskjet 3740
    HP Software Update
    Intel(R) Extreme Graphics 2 Driver
    Intel(R) PRO Network Adapters and Drivers
    Intel(R) PROSet for Wired Connections
    Internet Explorer Default Page
    Java(TM) 6 Update 16
    Learn2 Player (Uninstall Only)
    Macromedia Flash Player
    Malwarebytes' Anti-Malware
    McAfee SecurityCenter
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2000 Standard
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Works Setup Launcher
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    QuickTime
    RealPlayer Basic
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 7 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB883939)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB896688)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899588)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB903235)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB905915)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB908531)
    Security Update for Windows XP (KB911280)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911567)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912812)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917159)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB918899)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920214)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB921883)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922760)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928090)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB929969)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931768)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933566)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937143)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB939653)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB942615)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB948881)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958470)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978706)
    Sonic DLA
    Sonic RecordNow!
    Sonic Update Manager
    Spybot - Search & Destroy
    Spyware Doctor 7.0
    Super Text Twist®
    Typer Shark
    Update for Windows Internet Explorer 8 (KB973874)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB894391)
    Update for Windows XP (KB896727)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB929338)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB931836)
    Update for Windows XP (KB932823-v3)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB942840)
    Update for Windows XP (KB946627)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    WebFldrs XP
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format Runtime
    Windows Media Player 10
    Windows XP Hotfix - KB834707
    Windows XP Hotfix - KB867282
    Windows XP Hotfix - KB873333
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB888310
    Windows XP Hotfix - KB890047
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB890923
    Windows XP Hotfix - KB891781
    Windows XP Hotfix - KB893066
    Windows XP Hotfix - KB893086
    Yahoo! Toolbar

    ==== Event Viewer Messages From Past Week ========

    4/3/2010 12:07:07 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
    4/3/2010 10:36:08 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
    4/2/2010 2:03:27 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
    4/2/2010 1:55:41 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired.
    4/2/2010 1:33:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    4/2/2010 1:33:34 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNASvc with arguments " " in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}
    4/2/2010 1:32:56 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk MPFP MRxSmb NetBIOS NetBT pavboot RasAcd Rdbss Tcpip
    4/2/2010 1:32:56 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    4/2/2010 1:32:56 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    4/2/2010 1:32:56 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    4/2/2010 1:32:25 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    4/2/2010 1:16:57 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 80566ca7, parameter3 aff3e61c, parameter4 00000000.
    4/2/2010 1:09:58 PM, error: Dhcp [1002] - The IP address lease 192.168.2.2 for the Network Card with network address 001111E9D551 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    4/1/2010 3:36:23 PM, error: Service Control Manager [7031] - The McAfee Services service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    3/30/2010 6:26:19 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Security Service service to connect.
    3/30/2010 6:26:19 PM, error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

    ==== End Of File ===========================
    ComboFix 10-04-03.01 - Carolyn Coons 04/03/2010 12:07:19.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1278.852 [GMT -7:00]
    Running from: c:\documents and settings\Carolyn Coons\Desktop\ComboFix.exe
    AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Carolyn Coons\Local Settings\Temporary Internet Files\44ET4n.jpg
    c:\documents and settings\Carolyn Coons\Local Settings\Temporary Internet Files\Ax60V.jpg
    c:\documents and settings\Carolyn Coons\Local Settings\Temporary Internet Files\lhtG4i5.jpg
    c:\documents and settings\Carolyn Coons\Local Settings\Temporary Internet Files\LR40q.jpg
    c:\documents and settings\Mark Coons\Cookies\fepazeja.sys
    c:\documents and settings\Mark Coons\Cookies\gefypuzid.lib
    c:\windows\system32\posodilo.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-03-03 to 2010-04-03 )))))))))))))))))))))))))))))))
    .

    2010-04-03 19:08 . 2010-04-03 19:08 -------- d-----w- c:\windows\system32\LogFiles
    2010-03-31 04:30 . 2010-04-03 17:29 -------- d-----w- c:\program files\Panda Security
    2010-03-31 03:36 . 2010-03-31 03:36 -------- d-----w- c:\program files\Trend Micro
    2010-03-31 01:25 . 2001-08-17 20:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
    2010-03-31 01:25 . 2001-08-17 20:48 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
    2010-03-31 01:24 . 2010-03-31 01:24 -------- d-sh--w- c:\documents and settings\Aspen Coons\IETldCache
    2010-03-28 20:44 . 2010-03-28 20:44 -------- d-----w- c:\documents and settings\Carolyn Coons\Local Settings\Application Data\Threat Expert
    2010-03-28 20:39 . 2010-02-05 16:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2010-03-28 20:39 . 2010-03-10 18:36 217032 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2010-03-28 20:39 . 2009-11-23 20:54 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2010-03-28 20:39 . 2010-02-05 16:25 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2010-03-28 20:38 . 2010-03-28 20:43 -------- d-----w- c:\program files\Common Files\PC Tools
    2010-03-28 20:38 . 2010-03-28 20:38 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
    2010-03-28 20:03 . 2008-02-01 19:55 42376 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
    2010-03-28 20:03 . 2007-12-10 21:53 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
    2010-03-28 20:03 . 2007-12-10 21:53 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
    2010-03-28 20:03 . 2007-12-10 21:53 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
    2010-03-28 20:02 . 2010-04-02 21:02 -------- d-----w- c:\program files\Spyware Doctor
    2010-03-28 20:02 . 2010-03-28 20:02 -------- d-----w- c:\documents and settings\Carolyn Coons\Application Data\PC Tools
    2010-03-23 00:24 . 2010-03-23 00:24 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-03-22 05:33 . 2010-03-22 05:33 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2010-03-22 00:24 . 2010-03-22 00:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
    2010-03-22 00:20 . 2010-03-22 00:20 6944624 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aaw2008_upd.exe
    2010-03-21 20:58 . 2010-03-21 20:58 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-04-03 17:36 . 2007-12-01 22:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-04-02 20:49 . 2009-09-23 02:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-03-30 07:46 . 2009-09-23 02:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-03-30 07:45 . 2009-09-23 02:07 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-03-27 20:42 . 2006-03-22 22:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-03-22 03:20 . 2006-03-22 22:43 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-03-22 00:25 . 2006-03-22 22:38 -------- d-----w- c:\program files\Lavasoft
    2010-03-22 00:20 . 2008-03-18 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
    2010-02-28 03:01 . 2008-02-10 22:02 -------- d-----w- c:\program files\McAfee
    2010-02-25 06:24 . 2004-08-04 11:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-02-10 15:38 . 2006-10-27 19:13 -------- d-----w- c:\program files\Google
    2009-09-23 01:43 . 2009-09-23 01:43 17307 ----a-w- c:\program files\Common Files\pyvafawyfy.lib
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=" "

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001
    "FirewallOverride "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)
    "DisableNotifications "= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
    "c:\\Program Files\\McAfee\\VirusScan\\mcvsmap.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "65533:TCP "= 65533:TCP:Services
    "52344:TCP "= 52344:TCP:Services
    "2479:TCP "= 2479:TCP:Services
    "6753:TCP "= 6753:TCP:Services
    "3389:TCP "= 3389:TCP:Remote Desktop
    "5688:TCP "= 5688:TCP:Services
    "9876:TCP "= 9876:TCP:Services

    R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [3/28/2010 1:39 PM 217032]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/3/2008 10:18 AM 93320]
    S2 aixfvlciydkto;aixfvlciydkto;\??\c:\windows\system32\drivers\cdyapsuvowkc.sys --> c:\windows\system32\drivers\cdyapsuvowkc.sys [?]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2010 8:38 AM 135664]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/28/2010 1:02 PM 366840]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 15:38]

    2010-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 15:38]

    2010-03-15 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-02-10 19:22]

    2010-04-01 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-02-10 19:22]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-04-03 12:25
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x89185858]<<
    kernel: MBR read successfully
    detected MBR rootkit hooks:
    \Driver\Disk -> CLASSPNP.SYS @ 0xf76cbfc3
    \Driver\ACPI -> ACPI.sys @ 0xf750ecb8
    \Driver\atapi -> atapi.sys @ 0xf748e7b4
    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
    NDIS: Intel(R) PRO/100 VE Network Connection -> SendCompleteHandler -> 0x88ee2330
    PacketIndicateHandler -> NDIS.sys @ 0xf7b47b21
    SendHandler -> NDIS.sys @ 0xf7b2587b
    user & kernel MBR OK

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(656)
    c:\windows\system32\igfxdev.dll
    .
    Completion time: 2010-04-03 12:29:52
    ComboFix-quarantined-files.txt 2010-04-03 19:29
    ComboFix2.txt 2009-10-14 01:19

    Pre-Run: 12,915,654,656 bytes free
    Post-Run: 13,377,327,104 bytes free

    - - End Of File - - D0B8F723D39D06FF6FE013A4D2224244



    HighjackThis Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:33:38 PM, on 4/3/2010
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Typer%20Shark/Images/stg_drm.ocx
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

    --
    End of file - 5877 bytes
     
    macoons,
    #3
  5. 2010/04/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\program files\Common Files\pyvafawyfy.lib
c:\windows\system32\drivers\cdyapsuvowkc.sys


Folder::

Driver::
aixfvlciydkto

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
 "AntiVirusOverride "=dword:00000000
 "FirewallOverride "=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
 "DisableMonitoring "=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
 "DisableMonitoring "=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List]
 "65533:TCP "=-
 "52344:TCP "=-
 "2479:TCP "=-
 "6753:TCP "=-
 "5688:TCP "=-
 "9876:TCP "=-


RegLockDel::

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.
     
    broni,
    #4
  6. 2010/04/03
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    Combo Fix log 2:

    ComboFix 10-04-03.01 - Carolyn Coons 04/03/2010 16:57:50.3.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1278.831 [GMT -7:00]
    Running from: c:\documents and settings\Carolyn Coons\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Carolyn Coons\Desktop\CFScript.txt
    AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    FILE ::
    "c:\program files\Common Files\pyvafawyfy.lib "
    "c:\windows\system32\drivers\cdyapsuvowkc.sys "
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    c:\program files\Common Files\pyvafawyfy.lib

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_AIXFVLCIYDKTO
    -------\Service_aixfvlciydkto


    ((((((((((((((((((((((((( Files Created from 2010-03-04 to 2010-04-04 )))))))))))))))))))))))))))))))
    .

    2010-04-03 19:08 . 2010-04-03 19:08 -------- d-----w- c:\windows\system32\LogFiles
    2010-03-31 04:30 . 2010-04-03 17:29 -------- d-----w- c:\program files\Panda Security
    2010-03-31 03:36 . 2010-03-31 03:36 -------- d-----w- c:\program files\Trend Micro
    2010-03-31 01:25 . 2001-08-17 20:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
    2010-03-31 01:25 . 2001-08-17 20:48 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
    2010-03-31 01:24 . 2010-03-31 01:24 -------- d-sh--w- c:\documents and settings\Aspen Coons\IETldCache
    2010-03-28 20:44 . 2010-03-28 20:44 -------- d-----w- c:\documents and settings\Carolyn Coons\Local Settings\Application Data\Threat Expert
    2010-03-28 20:39 . 2010-02-05 16:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2010-03-28 20:39 . 2010-03-10 18:36 217032 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2010-03-28 20:39 . 2009-11-23 20:54 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2010-03-28 20:39 . 2010-02-05 16:25 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2010-03-28 20:38 . 2010-03-28 20:43 -------- d-----w- c:\program files\Common Files\PC Tools
    2010-03-28 20:38 . 2010-03-28 20:38 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
    2010-03-28 20:03 . 2008-02-01 19:55 42376 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
    2010-03-28 20:03 . 2007-12-10 21:53 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
    2010-03-28 20:03 . 2007-12-10 21:53 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
    2010-03-28 20:03 . 2007-12-10 21:53 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
    2010-03-28 20:02 . 2010-04-03 23:35 -------- d-----w- c:\program files\Spyware Doctor
    2010-03-28 20:02 . 2010-03-28 20:02 -------- d-----w- c:\documents and settings\Carolyn Coons\Application Data\PC Tools
    2010-03-23 00:24 . 2010-03-23 00:24 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-03-22 05:33 . 2010-03-22 05:33 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2010-03-22 00:24 . 2010-03-22 00:24 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
    2010-03-22 00:20 . 2010-03-22 00:20 6944624 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aaw2008_upd.exe
    2010-03-21 20:58 . 2010-03-21 20:58 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-04-03 17:36 . 2007-12-01 22:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-04-02 20:49 . 2009-09-23 02:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-03-30 07:46 . 2009-09-23 02:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-03-30 07:45 . 2009-09-23 02:07 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-03-27 20:42 . 2006-03-22 22:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-03-22 03:20 . 2006-03-22 22:43 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-03-22 00:25 . 2006-03-22 22:38 -------- d-----w- c:\program files\Lavasoft
    2010-03-22 00:20 . 2008-03-18 22:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
    2010-02-28 03:01 . 2008-02-10 22:02 -------- d-----w- c:\program files\McAfee
    2010-02-25 06:24 . 2004-08-04 11:00 916480 ------w- c:\windows\system32\wininet.dll
    2010-02-10 15:38 . 2006-10-27 19:13 -------- d-----w- c:\program files\Google
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-04-03_19.25.56 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-04-03 23:35 . 2010-04-03 23:35 16384 c:\windows\Temp\Perflib_Perfdata_f0.dat
    + 2005-03-19 03:58 . 2010-04-03 20:33 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2005-03-19 03:58 . 2010-04-03 16:12 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2010-03-22 05:33 . 2010-04-03 20:33 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\IETldCache\index.dat
    - 2010-03-22 05:33 . 2010-04-03 16:12 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\IETldCache\index.dat
    + 2010-04-03 20:33 . 2010-04-03 20:33 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    @=" "

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)
    "DisableNotifications "= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
    "c:\\Program Files\\McAfee\\VirusScan\\mcvsmap.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "65533:TCP "= 65533:TCP:Services
    "52344:TCP "= 52344:TCP:Services
    "2479:TCP "= 2479:TCP:Services
    "6753:TCP "= 6753:TCP:Services
    "3389:TCP "= 3389:TCP:Remote Desktop
    "5688:TCP "= 5688:TCP:Services
    "9876:TCP "= 9876:TCP:Services
    "6599:TCP "= 6599:TCP:Services
    "6600:TCP "= 6600:TCP:Services

    R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [3/28/2010 1:39 PM 217032]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/3/2008 10:18 AM 93320]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2010 8:38 AM 135664]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [3/28/2010 1:02 PM 366840]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 15:38]

    2010-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 15:38]

    2010-03-15 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-02-10 19:22]

    2010-04-01 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-02-10 19:22]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-04-03 17:08
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x896088A0]<<
    kernel: MBR read successfully
    detected MBR rootkit hooks:
    \Driver\Disk -> CLASSPNP.SYS @ 0xf76bbfc3
    \Driver\ACPI -> ACPI.sys @ 0xf75aecb8
    \Driver\atapi -> atapi.sys @ 0xf748e7b4
    IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
    \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0084
    NDIS: Intel(R) PRO/100 VE Network Connection -> SendCompleteHandler -> 0x88ed7330
    PacketIndicateHandler -> NDIS.sys @ 0xf7b47b21
    SendHandler -> NDIS.sys @ 0xf7b2587b
    user & kernel MBR OK

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2120)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    .
    Completion time: 2010-04-03 17:13:11
    ComboFix-quarantined-files.txt 2010-04-04 00:13
    ComboFix2.txt 2010-04-03 19:29
    ComboFix3.txt 2009-10-14 01:19

    Pre-Run: 13,331,382,272 bytes free
    Post-Run: 13,287,776,256 bytes free

    - - End Of File - - F31DF26BCE839456EB813BB397998749



    Highjack This Log 2:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:23:08 PM, on 4/3/2010
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\WINDOWS\system32\svchost.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Typer%20Shark/Images/stg_drm.ocx
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

    --
    End of file - 5946 bytes
     
    macoons,
    #5
  7. 2010/04/04
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    Did my last post go through (about three hours ago)?
     
    macoons,
    #6
  8. 2010/04/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download TDSSKiller and save it to your Desktop.
    Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
    Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

    If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
    When it is done, a log file should be created on your C: drive called TDSSKiller.txt please copy and paste the contents of that file here.

    ==============================================================

    Please download Profiles by noahdfear.

    * Save it to your desktop.
    * Double-click profiles.exe and post its log when you reply.
     
    broni,
    #7
  9. 2010/04/04
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    TDS Killer Log:

    22:35:08:015 3912 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
    22:35:08:015 3912 ================================================================================
    22:35:08:015 3912 SystemInfo:

    22:35:08:015 3912 OS Version: 5.1.2600 ServicePack: 2.0
    22:35:08:015 3912 Product type: Workstation
    22:35:08:015 3912 ComputerName: MOMSDELL
    22:35:08:015 3912 UserName: Carolyn Coons
    22:35:08:015 3912 Windows directory: C:\WINDOWS
    22:35:08:015 3912 Processor architecture: Intel x86
    22:35:08:015 3912 Number of processors: 1
    22:35:08:015 3912 Page size: 0x1000
    22:35:08:015 3912 Boot type: Normal boot
    22:35:08:015 3912 ================================================================================
    22:35:08:015 3912 UnloadDriverW: NtUnloadDriver error 2
    22:35:08:015 3912 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
    22:35:08:046 3912 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
    22:35:08:046 3912 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
    22:35:08:046 3912 wfopen_ex: Trying to KLMD file open
    22:35:08:046 3912 wfopen_ex: File opened ok (Flags 2)
    22:35:08:046 3912 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
    22:35:08:046 3912 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
    22:35:08:046 3912 wfopen_ex: Trying to KLMD file open
    22:35:08:046 3912 wfopen_ex: File opened ok (Flags 2)
    22:35:08:046 3912 Initialize success
    22:35:08:046 3912
    22:35:08:046 3912 Scanning Services ...
    22:35:08:500 3912 Raw services enum returned 328 services
    22:35:08:531 3912
    22:35:08:531 3912 Scanning Kernel memory ...
    22:35:08:531 3912 Devices to scan: 4
    22:35:08:531 3912
    22:35:08:531 3912 Driver Name: Disk
    22:35:08:531 3912 IRP_MJ_CREATE : F76BDC30
    22:35:08:531 3912 IRP_MJ_CREATE_NAMED_PIPE : 804FB8EE
    22:35:08:531 3912 IRP_MJ_CLOSE : F76BDC30
    22:35:08:531 3912 IRP_MJ_READ : F76B7D9B
    22:35:08:531 3912 IRP_MJ_WRITE : F76B7D9B
    22:35:08:531 3912 IRP_MJ_QUERY_INFORMATION : 804FB8EE
    22:35:08:531 3912 IRP_MJ_SET_INFORMATION : 804FB8EE
    22:35:08:531 3912 IRP_MJ_QUERY_EA : 804FB8EE
    22:35:08:531 3912 IRP_MJ_SET_EA : 804FB8EE
    22:35:08:531 3912 IRP_MJ_FLUSH_BUFFERS : F76B8366
    22:35:08:531 3912 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FB8EE
    22:35:08:531 3912 IRP_MJ_SET_VOLUME_INFORMATION : 804FB8EE
    22:35:08:531 3912 IRP_MJ_DIRECTORY_CONTROL : 804FB8EE
    22:35:08:531 3912 IRP_MJ_FILE_SYSTEM_CONTROL : 804FB8EE
    22:35:08:531 3912 IRP_MJ_DEVICE_CONTROL : F76B844D
    22:35:08:531 3912 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76BBFC3
    22:35:08:531 3912 IRP_MJ_SHUTDOWN : F76B8366
    22:35:08:531 3912 IRP_MJ_LOCK_CONTROL : 804FB8EE
    22:35:08:531 3912 IRP_MJ_CLEANUP : 804FB8EE
    22:35:08:531 3912 IRP_MJ_CREATE_MAILSLOT : 804FB8EE
    22:35:08:531 3912 IRP_MJ_QUERY_SECURITY : 804FB8EE
    22:35:08:531 3912 IRP_MJ_SET_SECURITY : 804FB8EE
    22:35:08:531 3912 IRP_MJ_POWER : F76B9EF3
    22:35:08:531 3912 IRP_MJ_SYSTEM_CONTROL : F76BEA24
    22:35:08:531 3912 IRP_MJ_DEVICE_CHANGE : 804FB8EE
    22:35:08:531 3912 IRP_MJ_QUERY_QUOTA : 804FB8EE
    22:35:08:531 3912 IRP_MJ_SET_QUOTA : 804FB8EE
    22:35:08:562 3912 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
    22:35:08:562 3912
    22:35:08:562 3912 Driver Name: Disk
    22:35:08:562 3912 IRP_MJ_CREATE : F76BDC30
    22:35:08:562 3912 IRP_MJ_CREATE_NAMED_PIPE : 804FB8EE
    22:35:08:562 3912 IRP_MJ_CLOSE : F76BDC30
    22:35:08:562 3912 IRP_MJ_READ : F76B7D9B
    22:35:08:562 3912 IRP_MJ_WRITE : F76B7D9B
    22:35:08:562 3912 IRP_MJ_QUERY_INFORMATION : 804FB8EE
    22:35:08:562 3912 IRP_MJ_SET_INFORMATION : 804FB8EE
    22:35:08:562 3912 IRP_MJ_QUERY_EA : 804FB8EE
    22:35:08:562 3912 IRP_MJ_SET_EA : 804FB8EE
    22:35:08:562 3912 IRP_MJ_FLUSH_BUFFERS : F76B8366
    22:35:08:562 3912 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FB8EE
    22:35:08:562 3912 IRP_MJ_SET_VOLUME_INFORMATION : 804FB8EE
    22:35:08:562 3912 IRP_MJ_DIRECTORY_CONTROL : 804FB8EE
    22:35:08:562 3912 IRP_MJ_FILE_SYSTEM_CONTROL : 804FB8EE
    22:35:08:562 3912 IRP_MJ_DEVICE_CONTROL : F76B844D
    22:35:08:562 3912 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76BBFC3
    22:35:08:562 3912 IRP_MJ_SHUTDOWN : F76B8366
    22:35:08:562 3912 IRP_MJ_LOCK_CONTROL : 804FB8EE
    22:35:08:562 3912 IRP_MJ_CLEANUP : 804FB8EE
    22:35:08:562 3912 IRP_MJ_CREATE_MAILSLOT : 804FB8EE
    22:35:08:562 3912 IRP_MJ_QUERY_SECURITY : 804FB8EE
    22:35:08:562 3912 IRP_MJ_SET_SECURITY : 804FB8EE
    22:35:08:562 3912 IRP_MJ_POWER : F76B9EF3
    22:35:08:562 3912 IRP_MJ_SYSTEM_CONTROL : F76BEA24
    22:35:08:562 3912 IRP_MJ_DEVICE_CHANGE : 804FB8EE
    22:35:08:562 3912 IRP_MJ_QUERY_QUOTA : 804FB8EE
    22:35:08:562 3912 IRP_MJ_SET_QUOTA : 804FB8EE
    22:35:08:578 3912 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
    22:35:08:578 3912
    22:35:08:578 3912 Driver Name: Disk
    22:35:08:578 3912 IRP_MJ_CREATE : F76BDC30
    22:35:08:578 3912 IRP_MJ_CREATE_NAMED_PIPE : 804FB8EE
    22:35:08:578 3912 IRP_MJ_CLOSE : F76BDC30
    22:35:08:578 3912 IRP_MJ_READ : F76B7D9B
    22:35:08:578 3912 IRP_MJ_WRITE : F76B7D9B
    22:35:08:578 3912 IRP_MJ_QUERY_INFORMATION : 804FB8EE
    22:35:08:578 3912 IRP_MJ_SET_INFORMATION : 804FB8EE
    22:35:08:578 3912 IRP_MJ_QUERY_EA : 804FB8EE
    22:35:08:578 3912 IRP_MJ_SET_EA : 804FB8EE
    22:35:08:578 3912 IRP_MJ_FLUSH_BUFFERS : F76B8366
    22:35:08:578 3912 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FB8EE
    22:35:08:578 3912 IRP_MJ_SET_VOLUME_INFORMATION : 804FB8EE
    22:35:08:578 3912 IRP_MJ_DIRECTORY_CONTROL : 804FB8EE
    22:35:08:578 3912 IRP_MJ_FILE_SYSTEM_CONTROL : 804FB8EE
    22:35:08:578 3912 IRP_MJ_DEVICE_CONTROL : F76B844D
    22:35:08:578 3912 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76BBFC3
    22:35:08:578 3912 IRP_MJ_SHUTDOWN : F76B8366
    22:35:08:578 3912 IRP_MJ_LOCK_CONTROL : 804FB8EE
    22:35:08:578 3912 IRP_MJ_CLEANUP : 804FB8EE
    22:35:08:578 3912 IRP_MJ_CREATE_MAILSLOT : 804FB8EE
    22:35:08:578 3912 IRP_MJ_QUERY_SECURITY : 804FB8EE
    22:35:08:578 3912 IRP_MJ_SET_SECURITY : 804FB8EE
    22:35:08:578 3912 IRP_MJ_POWER : F76B9EF3
    22:35:08:578 3912 IRP_MJ_SYSTEM_CONTROL : F76BEA24
    22:35:08:578 3912 IRP_MJ_DEVICE_CHANGE : 804FB8EE
    22:35:08:578 3912 IRP_MJ_QUERY_QUOTA : 804FB8EE
    22:35:08:578 3912 IRP_MJ_SET_QUOTA : 804FB8EE
    22:35:08:593 3912 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
    22:35:08:593 3912
    22:35:08:593 3912 Driver Name: atapi
    22:35:08:593 3912 IRP_MJ_CREATE : F7492572
    22:35:08:593 3912 IRP_MJ_CREATE_NAMED_PIPE : 804FB8EE
    22:35:08:593 3912 IRP_MJ_CLOSE : F7492572
    22:35:08:593 3912 IRP_MJ_READ : 804FB8EE
    22:35:08:593 3912 IRP_MJ_WRITE : 804FB8EE
    22:35:08:593 3912 IRP_MJ_QUERY_INFORMATION : 804FB8EE
    22:35:08:593 3912 IRP_MJ_SET_INFORMATION : 804FB8EE
    22:35:08:593 3912 IRP_MJ_QUERY_EA : 804FB8EE
    22:35:08:593 3912 IRP_MJ_SET_EA : 804FB8EE
    22:35:08:593 3912 IRP_MJ_FLUSH_BUFFERS : 804FB8EE
    22:35:08:593 3912 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FB8EE
    22:35:08:593 3912 IRP_MJ_SET_VOLUME_INFORMATION : 804FB8EE
    22:35:08:593 3912 IRP_MJ_DIRECTORY_CONTROL : 804FB8EE
    22:35:08:593 3912 IRP_MJ_FILE_SYSTEM_CONTROL : 804FB8EE
    22:35:08:593 3912 IRP_MJ_DEVICE_CONTROL : F7492592
    22:35:08:593 3912 IRP_MJ_INTERNAL_DEVICE_CONTROL : F748E7B4
    22:35:08:593 3912 IRP_MJ_SHUTDOWN : 804FB8EE
    22:35:08:593 3912 IRP_MJ_LOCK_CONTROL : 804FB8EE
    22:35:08:593 3912 IRP_MJ_CLEANUP : 804FB8EE
    22:35:08:593 3912 IRP_MJ_CREATE_MAILSLOT : 804FB8EE
    22:35:08:593 3912 IRP_MJ_QUERY_SECURITY : 804FB8EE
    22:35:08:593 3912 IRP_MJ_SET_SECURITY : 804FB8EE
    22:35:08:593 3912 IRP_MJ_POWER : F74925BC
    22:35:08:593 3912 IRP_MJ_SYSTEM_CONTROL : F7499164
    22:35:08:593 3912 IRP_MJ_DEVICE_CHANGE : 804FB8EE
    22:35:08:593 3912 IRP_MJ_QUERY_QUOTA : 804FB8EE
    22:35:08:593 3912 IRP_MJ_SET_QUOTA : 804FB8EE
    22:35:08:609 3912 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
    22:35:08:609 3912
    22:35:08:609 3912 Completed
    22:35:08:609 3912
    22:35:08:609 3912 Results:
    22:35:08:609 3912 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
    22:35:08:609 3912 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
    22:35:08:609 3912 File objects infected / cured / cured on reboot: 0 / 0 / 0
    22:35:08:609 3912
    22:35:08:609 3912 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
    22:35:08:609 3912 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
    22:35:08:609 3912 KLMD(ARK) unloaded successfully


    Profiles Log:


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    DefaultUserProfile REG_SZ Default User
    AllUsersProfile REG_SZ All Users

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
    ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\LocalService

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\NetworkService

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1005
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\HelpAssistant

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1006
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Carolyn Coons

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1007
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Mark Coons

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1008
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Aspen Coons

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1009
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Jonathan Coons

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-501
    ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Guest

    SystemRoot REG_SZ C:\WINDOWS
     
    macoons,
    #8
  10. 2010/04/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download and save HelpAsst_mebroot_fix.exe to your desktop.
    • Close all open programs.
    • Double click HelpAsst_mebroot_fix.exe to run it.
    • Pay attention to the running tool.
    • If the tool detects mbr infection, please allow it to run mbr -f and shutdown your computer. To do so, type Y and press Enter.
    • After restart, wait 5 minutes, then go Start>Run, copy and paste the following command in the run box then hit Enter:

      • helpasst -mbrt
    • When it completes, a log will open.
    • Please post the contents of that log.

    IMPORTANT!
    If the tool does NOT detect any mbr infection and completes, proceed with the following...

    • Click Start>Run and copy and paste the following command, then hit Enter:

      • mbr -f
    • Repeat the above step one more time
    • Now shut down the computer (do not restart, but shut it down), wait 5 minutes then start it back up.
    • Wait another 5 minutes, then click Start>Run and copy and paste the following command, then hit Enter.

      • helpasst -mbrt
    • When it completes, a log will open.
    • Please post the contents of that log.

    **Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).
     
    broni,
    #9
  11. 2010/04/04
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    C:\Documents and Settings\Carolyn Coons\Desktop\HelpAsst_mebroot_fix.exe
    Sat 04/03/2010 at 22:52:58.48

    HelpAssistant account was found to be Inactive


    ~~ Checking for termsrv32.dll ~~

    termsrv32.dll not found

    ~~ Checking firewall ports ~~

    HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list

    HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list


    HelpAssistant profile not found in registry

    ~~ Checking mbr ~~

    user & kernel MBR OK

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Status check on Sat 04/03/2010 at 23:09:59.32

    Full Name Remote Desktop Help Assistant Account
    Account active Yes
    Local Group Memberships *Administrators

    ~~ Checking mbr ~~

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8940C750]<<
    kernel: MBR read successfully
    user & kernel MBR OK

    ~~ Checking for termsrv32.dll ~~

    termsrv32.dll not found


    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
    ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

    ~~ Checking profile list ~~

    S-1-5-21-4033994130-1639493683-3125362582-1005
    %SystemDrive%\Documents and Settings\HelpAssistant.MOMSDELL

    ~~ Checking for HelpAssistant directories ~~

    HelpAssistant
    HelpAssistant.MOMSDELL

    ~~ Checking firewall ports ~~

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]
    "65533:TCP "=65533:TCP:*:Enabled:Services
    "52344:TCP "=52344:TCP:*:Enabled:Services
    "4943:TCP "=4943:TCP:*:Enabled:Services
    "8386:TCP "=8386:TCP:*:Enabled:Services

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "65533:TCP "=65533:TCP:*:Enabled:Services
    "52344:TCP "=52344:TCP:*:Enabled:Services
    "4943:TCP "=4943:TCP:*:Enabled:Services
    "8386:TCP "=8386:TCP:*:Enabled:Services


    ~~ EOF ~~
     
    macoons,
    #10
  12. 2010/04/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download SystemScan and save it to your desktop.

    • Be aware that the file name will be randomly generated (i.e. sys95769.exe) to deceive malware which may attempt to disabled it.
    • If any installed security tools (anti-virus) detects the file as malware or suspicious while downloading or attempting to run, ignore the alert and allow the download.
    • Double-click on sys*****.exe to start the tool.
    • A read before proceeding disclaimer will appear.
    • Uncheck <- Unflag the checkbox to disable updates! next to the version number at the top.
    • After reading, check the box I have read and agree. Please let me...proceed!, then click the Proceed button.
    • When SystemScan opens, click the "Unselect all" button.
    • Important: Under "Make your choice and than click... ", check the boxes next to:
      • PC accounts
    • Everything else should be unchecked.
    • Click "Scan Now ".
    • Another warning box will appear. Please follow the instructions and click OK.
    • Please be patient while the scan is in progress.
    • Systemscan will scan your computer and create a folder named Suspectfile on the Desktop to save its report.
    • When the scan is complete, Notepad will automatically open a log file named report.txt with the results.
    • Copy and paste the contents of report.txt in your next reply.
     
    broni,
    #11
  13. 2010/04/04
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    "XP Defender" and "Windows Security Alert" have popped up and are blocking me navigating to most any website. What's the best way to eliminate them or do you want me to downlaod systemscan on another computer and copy onto a thumb drive then to the infected computer?
     
    macoons,
    #12
  14. 2010/04/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.pif
    * Rkill.exe

    * Double-click on the Rkill desktop icon to run the tool.
    * If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    * A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    * If not, delete the file, then download and use the one provided in Link 2.
    * If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    * Do not reboot until instructed.
    * If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run then try to immediately run the following.

    Now download and run exeHelper.

    * Please download exeHelper from Raktor to your desktop.
    * Double-click on exeHelper.com to run the fix.
    * A black window should pop up, press any key to close once the fix is completed.
    * A log file named log.txt will be created in the directory where you ran exeHelper.com
    * Attach the log.txt file to your next message.[/LIST]

    Note: If the window shows a message that says "Error deleting file ", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

    ================================================================

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***


    STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform Quick Scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 2.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #13
  15. 2010/04/05
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    exeHelper by Raktor
    Build 20100329
    Run at 22:37:03 on 04/04/10
    Now searching...
    Checking for numerical processes...
    Checking for sysguard processes...
    Checking for bad processes...
    Checking for bad files...
    Deleting file C:\Documents and Settings\Carolyn Coons\Local Settings\Application Data\ave.exe
    Checking for bad registry entries...
    Resetting filetype association for .exe
    Removing HKCR\secfile
    Resetting filetype association for .com
    Removing HKCR\secfile
    Resetting userinit and shell values...
    Resetting policies...
    --Finished--


    Malwarebytes' Anti-Malware 1.45
    www.malwarebytes.org

    Database version: 3955

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    4/4/2010 11:16:49 PM
    mbam-log-2010-04-04 (23-16-49).txt

    Scan type: Quick scan
    Objects scanned: 193806
    Time elapsed: 32 minute(s), 27 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 4
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ( "C:\Documents and Settings\Carolyn Coons\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\IEXPLORE.EXE ") Good: (iexplore.exe) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:21:10 PM, on 4/4/2010
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Typer%20Shark/Images/stg_drm.ocx
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

    --
    End of file - 5931 bytes
     
    macoons,
    #14
  16. 2010/04/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download OTM

    • Save it to your desktop.
    • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    Code:
    :Processes

:Services

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1005]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]
 "65533:TCP "=-
 "52344:TCP "=-
 "4943:TCP "=-
 "8386:TCP "=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
 "65533:TCP "=-
 "52344:TCP "=-
 "4943:TCP "=-
 "8386:TCP "=-

:Files
c:\documents and settings\HelpAssistant
c:\documents and settings\HelpAssistant.MOMSDELL
      
:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot]
    • Return to OTM, right click in the Paste Instructions for Items to be Movedwindow (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTM and reboot your PC.

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
     
    broni,
    #15
  17. 2010/04/05
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    All processes killed
    ========== PROCESSES ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4033994130-1639493683-3125362582-1005\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List not found.
    Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List not found.
    ========== FILES ==========
     
    macoons,
    #16
  18. 2010/04/05
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    FYI. After posting the last post and closing Internet Explorer, OTM would not close and the computer was locked up (5+minutes). I did a hard reboot (press and hold power button). It did reboot and the log below popped up (1/2 in this post 1/2 in the next due to length. Also when I went to open Internet Explorer, the first tab flashed to XP Defender before ultimately going to my home page (Google). Tanks again for your help.



    Files moved on Reboot...
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6 scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]] scheduled to be moved on reboot.
     
    macoons,
    #17
  19. 2010/04/05
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6 scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6 scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.mtv.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui\FFMod.swf scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices\media scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com\mtvnservices scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui\com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player\gui scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps\player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global\apps scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com\global scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]]\media.mtvnservices.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com\[[IMPORT]] scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6\www.cmt.com scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\WBS7BYC6 scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player scheduled to be moved on reboot.
    Folder move failed. c:\documents and settings\HelpAssistant\Application Data\Macromedia scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
     
    macoons,
    #18
  20. 2010/04/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Delete your copy of HelpAsst_mebroot_fix.exe

    Download and save HelpAsst_mebroot_fix.exe to your desktop.
    • Close all open programs.
    • Double click HelpAsst_mebroot_fix.exe to run it.
    • Pay attention to the running tool.
    • If the tool detects mbr infection, please allow it to run mbr -f and shutdown your computer. To do so, type Y and press Enter.
    • After restart, wait 5 minutes, then go Start>Run, copy and paste the following command in the run box then hit Enter:

      • helpasst -mbrt
    • When it completes, a log will open.
    • Please post the contents of that log.

    IMPORTANT!
    If the tool does NOT detect any mbr infection and completes, proceed with the following...

    • Click Start>Run and copy and paste the following command, then hit Enter:

      • mbr -f
    • Repeat the above step one more time
    • Now shut down the computer (do not restart, but shut it down), wait 5 minutes then start it back up.
    • Wait another 5 minutes, then click Start>Run and copy and paste the following command, then hit Enter.

      • helpasst -mbrt
    • When it completes, a log will open.
    • Please post the contents of that log.

    **Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).
     
    broni,
    #19
  21. 2010/04/06
    macoons

    macoons Inactive Thread Starter

    Joined:
    2010/03/31
    Messages:
    44
    Likes Received:
    0
    Ran successfully with no mbr infection found. After running mbr -f twice then shutting down (wait 5) then power up (wait 5) and running helpasst -mbrt, log opened. I did a Ctrl-A to select all and a Crtl-C to copy. Computer locked up and gave me the blue screen of death. I rebooted and tried again. I got a little further, but tried to post a reply here and it locked again giving me a slightly different blue screen of death.
     
    macoons,
    #20
Page 1 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...