Solved more Virtumonde trouble

Blitzkrieg · 2008/10/10

[Resolved] more Virtumonde trouble

Hello again Geri! Thank you for the help last time in thread:
http://www.windowsbbs.com/malware-virus-removal/75344-virtumonde-trouble.html
It was for that reason that I have comeback again with another problem!

That reason I never followed up on your previous post last time is because I was never able to get either of the online scanners to work, and tried them both now and again for weeks and both kept crashing and what not on me.

Anyway, as of today it seems the Virtumonde has come back. Not as malicious as last time, but I have been getting some annoying popups and such today. I have run both Spyware Doctor and Ad-Aware and both deleted a lot of ****, but Spyware Doctor detected some Virtumonde files that it was unable to fix/delete. Can you help me with this?

Here is the DSS main file:

_______________________

Deckard's System Scanner v20071014.68
Run by Jordan on 2008-10-10 16:40:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 79% (more than 75%).

-- HijackThis (run as Jordan.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:41:20 PM, on 10/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\csrcs.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\DOCUME~1\Jordan\LOCALS~1\Temp\clclean.0001
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\PROGRA~1\DELLSU~1\DSAgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Jordan\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Jordan.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\cmd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0FC9802E-98C9-4248-9DFD-3E0E8BB3767B} - C:\WINDOWS\system32\ssqPjjKB.dll
O2 - BHO: {06043737-09fe-05f9-a774-9bdba1c6b1d3} - {3d1b6c1a-bdb9-477a-9f50-ef9073734060} - C:\WINDOWS\system32\yepjjr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {DF9A99CF-49C6-4E3E-B668-498B718FD313} - C:\WINDOWS\system32\byXpmjGw.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe "
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [88796ba0] rundll32.exe "C:\WINDOWS\system32\tatkrlki.dll ",b
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" /SCB
O4 - HKCU\..\Run: [] C:\Documents and Settings\Jordan\Application Data\Adobe\Player.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6FA3BA36-FBF4-45A7-9303-FB95FFF04F42}: NameServer = 203.50.2.71 139.130.4.4
O20 - AppInit_DLLs: yepjjr.dll
O20 - Winlogon Notify: byXpmjGw - C:\WINDOWS\SYSTEM32\byXpmjGw.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 11366 bytes

-- Files created between 2008-09-10 and 2008-10-10 -----------------------------

2008-10-10 16:08:35 80512 --a------ C:\WINDOWS\system32\tatkrlki.dll
2008-10-10 16:07:09 136832 --a------ C:\WINDOWS\system32\yepjjr.dll
2008-10-10 16:06:33 136832 --a------ C:\WINDOWS\system32\rqmucbmv.dll
2008-10-10 16:05:31 653409 --ahs---- C:\WINDOWS\system32\BKjjPqss.ini2
2008-10-10 16:03:53 326016 --a------ C:\WINDOWS\system32\ssqPjjKB.dll
2008-10-10 15:03:51 299072 --a------ C:\WINDOWS\system32\ljJbXpQj.dll
2008-10-10 12:41:30 136832 --a------ C:\WINDOWS\system32\wgoahfxr.dll
2008-10-10 12:39:38 627391 --ahs---- C:\WINDOWS\system32\TwGQpXyb.ini2
2008-10-10 12:32:34 38272 --a------ C:\WINDOWS\system32\byXRhEXP.dll
2008-10-10 12:32:33 38272 --a------ C:\WINDOWS\system32\byXpmjGw.dll
2008-10-09 00:52:06 112128 --a------ C:\WINDOWS\system32\sgksdehl.dll
2008-10-09 00:49:31 686824 --ahs---- C:\WINDOWS\system32\SsCbKkkj.ini2
2008-10-09 00:42:51 42496 --a------ C:\WINDOWS\system32\nnnkKDuv.dll
2008-10-09 00:42:51 42496 --a------ C:\WINDOWS\system32\fcccbBSI.dll
2008-10-06 16:53:50 14848 --a------ C:\WINDOWS\system32\MediaCodec.exe
2008-10-06 10:50:16 0 d-------- C:\Documents and Settings\Jordan\Application Data\Real
2008-10-05 19:46:44 0 d-------- C:\Program Files\Common Files\xing shared
2008-10-02 16:09:44 0 d-------- C:\Documents and Settings\LocalService\Application Data\Help
2008-09-29 18:44:41 0 -rahs---- C:\khq
2008-09-24 18:04:19 781141 --a------ C:\WINDOWS\system32\cftmem.exe
2008-09-19 22:11:51 702336 -ra------ C:\WINDOWS\system32\drivers\3xHybrid.sys <Not Verified; Philips Semiconductors GmbH; Philips Semiconductors 3xHybrid>
2008-09-19 21:57:08 0 d-------- C:\WFDB
2008-09-19 21:56:49 0 d-------- C:\Program Files\WinFast
2008-09-19 21:30:32 27392 --a------ C:\WINDOWS\system32\drivers\ULCDRHlp.sys <Not Verified; Ulead Systems, Inc.; Ulead CD/DVD Burning Engine>

-- Find3M Report ---------------------------------------------------------------

2008-10-10 12:31:47 54296 --a------ C:\Documents and Settings\Jordan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-10 11:30:50 0 d-------- C:\Program Files\Ad-Aware
2008-10-09 18:27:50 0 d-------- C:\Program Files\Spyware Doctor
2008-10-05 19:46:44 0 d-------- C:\Program Files\Common Files
2008-10-05 19:46:41 0 d-------- C:\Program Files\Common Files\Real
2008-10-04 13:32:02 0 d-------- C:\Program Files\Soulseek
2008-10-02 13:34:02 0 d-------- C:\Documents and Settings\Jordan\Application Data\Azureus
2008-10-01 19:30:00 0 d-------- C:\Documents and Settings\Jordan\Application Data\Adobe
2008-10-01 13:42:54 0 d-------- C:\Program Files\QuickTime
2008-10-01 13:42:54 0 d-------- C:\Program Files\Dell Support
2008-09-30 16:58:32 2 --a------ C:\WINDOWS\system32\Dvbpws.dll
2008-09-19 21:56:47 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-08-14 00:18:10 0 d-------- C:\Program Files\Messenger
2008-08-10 13:36:01 0 d-------- C:\Documents and Settings\Jordan\Application Data\HTML Executable
2008-08-02 22:07:08 197120 --a------ C:\WINDOWS\system32\Depeche Mode Red.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>
2008-08-02 22:06:59 197120 --a------ C:\WINDOWS\system32\Depeche Mode Blue.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0FC9802E-98C9-4248-9DFD-3E0E8BB3767B}]
10/10/2008 04:05 PM 326016 --a------ C:\WINDOWS\system32\ssqPjjKB.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3d1b6c1a-bdb9-477a-9f50-ef9073734060}]
10/10/2008 04:07 PM 136832 --a------ C:\WINDOWS\system32\yepjjr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DF9A99CF-49C6-4E3E-B668-498B718FD313}]
10/10/2008 12:32 PM 38272 --a------ C:\WINDOWS\system32\byXpmjGw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [04/08/2004 08:00 AM]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [04/08/2004 08:00 AM]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 08:00 AM]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 08:00 AM]
"SigmatelSysTrayApp "= "stsystra.exe" [23/03/2005 03:20 AM C:\WINDOWS\stsystra.exe]
"ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [06/08/2005 12:05 AM]
"CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [15/09/2005 12:47 PM]
"MBMon "= "CTMBHA.DLL" [19/05/2005 11:54 AM C:\WINDOWS\system32\CTMBHA.DLL]
"UpdReg "= "C:\WINDOWS\UpdReg.EXE" [11/05/2000 04:00 AM]
"VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [19/09/2005 10:42 AM]
"DLA "= "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [08/09/2005 08:20 AM]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [27/07/2004 07:50 PM]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [27/07/2004 07:50 PM]
"igfxtray "= "C:\WINDOWS\system32\igfxtray.exe" [14/10/2005 11:49 PM]
"igfxhkcmd "= "C:\WINDOWS\system32\hkcmd.exe" [14/10/2005 11:46 PM]
"igfxpers "= "C:\WINDOWS\system32\igfxpers.exe" [14/10/2005 11:50 PM]
"ISTray "= "C:\Program Files\Spyware Doctor\pctsTray.exe" [11/09/2008 04:52 PM]
"WinFastDTV "= "C:\Program Files\WinFast\WFDTV\DTVSchdl.exe" [16/11/2007 05:13 PM]
"WinFast Schedule "= "C:\Program Files\WinFast\WFDTV\WFWIZ.exe" [15/11/2007 04:55 PM]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05/10/2008 07:46 PM]
"88796ba0 "= "C:\WINDOWS\system32\tatkrlki.dll" [10/10/2008 04:08 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI "= "MIDIDef.exe" [22/12/2004 08:40 PM C:\WINDOWS\MIDIDEF.EXE]
"Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [02/12/2004 09:23 PM]
"DellSupport "= "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" [15/05/2005 05:04 AM]
"MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 11:34 AM]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 08:00 AM]
"Creative MediaSource Go "= "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" [19/10/2005 05:39 PM]
"@ "= "C:\Documents and Settings\Jordan\Application Data\Adobe\Player.exe" [01/10/2008 07:29 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [23/02/2006 2:23:21 AM]
dlbcserv.lnk - C:\Program Files\Dell Photo Printer 720\dlbcserv.exe [5/11/2007 10:13:25 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 1:01:04 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"csrcs "=C:\WINDOWS\system32\csrcs.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{DF9A99CF-49C6-4E3E-B668-498B718FD313} "= C:\WINDOWS\system32\byXpmjGw.dll [10/10/2008 12:32 PM 38272]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell "= "Explorer.exe csrcs.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byXpmjGw]
byXpmjGw.dll 10/10/2008 12:32 PM 38272 C:\WINDOWS\system32\byXpmjGw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls "=yepjjr.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages "= msv1_0 C:\WINDOWS\system32\ssqPjjKB

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jordan^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jordan\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule]
C:\Program Files\WinFast TV\WFDTV\WFWIZ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
C:\Program Files\WinFast TV\WFDTV\DTVSchdl.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{effdd6ac-ecb5-11db-915f-00300a41ae78}]
AutoRun\command- E:\vxbjju.exe
explore\Command- E:\vxbjju.exe
open\Command- E:\vxbjju.exe

-- End of Deckard's System Scanner: finished at 2008-10-10 16:45:16 ------------

Cheers!!

Geri · 2008/10/10

Hi Blitzkrieg
Welcome back.
Stick with me on this one until you get the all clean from me.

Ok please do this in the order given.

Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

Double click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded, select 'Perform Quick Scan', then click Scan.

The scan may take some time to finish,so please be patient.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Post the entire report in your next reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Now this.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

Close all open programs and windows

Double click combofix.exe and follow the prompts.

Vista users right click Combofix.exe and select Run As Administrator.

When finished, it shall produce a log for you. Post the Combofix log

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

Please post the MBAM log and the combofix log.

Thanks
Geri

Blitzkrieg · 2008/10/11

Thanks again for the help, very much appreciated!

_________

Malwarebytes' Anti-Malware 1.28
Database version: 1253
Windows 5.1.2600 Service Pack 2

11/10/2008 6:12:18 PM
mbam-log-2008-10-11 (18-12-18).txt

Scan type: Quick Scan
Objects scanned: 51279
Time elapsed: 7 minute(s), 10 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 22

Memory Processes Infected:
C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{998dae3e-7d4f-4952-a71f-467d8fe64407} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkjyvpj (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{998dae3e-7d4f-4952-a71f-467d8fe64407} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcpgmj0ej85 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcpgmj0ej85 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\csrcs (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\jkkJyVPj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fcccbBSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nnnkKDuv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqmucbmv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wgoahfxr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sgksdehl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\byXRhEXP.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljJbXpQj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\Temporary Internet Files\Content.IE5\CTSN93HJ\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\Temporary Internet Files\Content.IE5\UG7EJPH1\file[1].exe (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\Temporary Internet Files\Content.IE5\XA0WGV59\nd82m0[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Application Data\Adobe\Player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\BM8b4a583c.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSS3f66.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSSd94a.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSSdce4.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSSdd7e.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\smchk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\pwrmgr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\sft_ver1.1454.0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\myconfig.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.

_______________

ComboFix 08-10-10.09 - Jordan 2008-10-11 18:16:37.1 - NTFSx86
Running from: C:\Documents and Settings\Jordan\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\BKjjPqss.ini
C:\WINDOWS\system32\BKjjPqss.ini2
C:\WINDOWS\system32\Dvbpws.dll
C:\WINDOWS\system32\iklrktat.ini
C:\WINDOWS\system32\JSBKRqru.ini
C:\WINDOWS\system32\JSBKRqru.ini2
C:\WINDOWS\system32\phpafmkm.dll
C:\WINDOWS\system32\qvmboivb.ini
C:\WINDOWS\system32\SsCbKkkj.ini
C:\WINDOWS\system32\SsCbKkkj.ini2
C:\WINDOWS\system32\ssqOHyxW.dll
C:\WINDOWS\system32\tompyytj.ini
C:\WINDOWS\system32\TwGQpXyb.ini
C:\WINDOWS\system32\TwGQpXyb.ini2
C:\WINDOWS\system32\xrkxyuwj.ini

----- BITS: Possible infected sites -----

hxxp://78.157.143.198
hxxp://91.203.93.6
.
((((((((((((((((((((((((( Files Created from 2008-09-11 to 2008-10-11 )))))))))))))))))))))))))))))))
.

2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Documents and Settings\Jordan\Application Data\Malwarebytes
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-11 18:00 . 2008-09-10 00:08 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-11 18:00 . 2008-09-10 00:08 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-08 22:09 . 2008-10-08 22:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-08 22:09 . 2008-10-08 22:09 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-06 16:53 . 2008-10-10 11:13 14,848 --a------ C:\WINDOWS\system32\MediaCodec.exe
2008-10-05 19:46 . 2008-10-05 19:46 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-10-01 23:09 . 2008-10-01 23:09 268 --ah----- C:\sqmdata00.sqm
2008-10-01 23:09 . 2008-10-01 23:09 244 --ah----- C:\sqmnoopt00.sqm
2008-09-29 18:44 . 2008-09-29 18:44 0 -rahs---- C:\khq
2008-09-24 18:04 . 2008-09-29 18:40 781,141 --a------ C:\WINDOWS\system32\cftmem.exe
2008-09-19 22:11 . 2007-07-30 19:02 702,336 -ra------ C:\WINDOWS\system32\drivers\3xHybrid.sys
2008-09-19 21:57 . 2008-09-19 21:57 <DIR> d-------- C:\WFDB
2008-09-19 21:56 . 2008-09-19 21:57 <DIR> d-------- C:\Program Files\WinFast
2008-09-19 21:30 . 2004-12-23 18:27 27,392 --a------ C:\WINDOWS\system32\drivers\ULCDRHlp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-11 07:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-11 06:34 30,452 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-11 06:34 3,759,648 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-11 06:34 278,560 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-11 06:34 2,032 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-11 01:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-11 00:49 --------- d-----w C:\Program Files\Spyware Doctor
2008-10-10 01:31 54,296 ----a-w C:\Documents and Settings\Jordan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-10 00:30 --------- d-----w C:\Program Files\Ad-Aware
2008-10-05 08:46 --------- d-----w C:\Program Files\Common Files\Real
2008-10-04 02:32 --------- d-----w C:\Program Files\Soulseek
2008-10-02 02:34 --------- d-----w C:\Documents and Settings\Jordan\Application Data\Azureus
2008-10-01 02:42 --------- d-----w C:\Program Files\QuickTime
2008-10-01 02:42 --------- d-----w C:\Program Files\Dell Support
2008-09-22 07:40 33,802 ----a-w C:\WINDOWS\system32\mem.exe.tmp
2008-09-19 10:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-11 05:29 81,288 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys
2008-09-11 05:29 66,952 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys
2008-09-11 05:29 40,840 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-02 11:07 197,120 ----a-w C:\WINDOWS\system32\Depeche Mode Red.scr
2008-08-02 11:06 197,120 ----a-w C:\WINDOWS\system32\Depeche Mode Blue.scr
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"DellSupport "= "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" [2005-05-15 332800]
"MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Creative MediaSource Go "= "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" [2005-10-19 135168]
"SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 C:\WINDOWS\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 1159168]
"DLA "= "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"igfxtray "= "C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd "= "C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers "= "C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 114688]
"WinFastDTV "= "C:\Program Files\WinFast\WFDTV\DTVSchdl.exe" [2007-11-16 90112]
"WinFast Schedule "= "C:\Program Files\WinFast\WFDTV\WFWIZ.exe" [2007-11-15 2850816]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-05 185632]
"SigmatelSysTrayApp "= "stsystra.exe" [2005-03-23 C:\WINDOWS\stsystra.exe]
"MBMon "= "CTMBHA.DLL" [2005-05-19 C:\WINDOWS\system32\CTMBHA.DLL]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-02-23 24576]
dlbcserv.lnk - C:\Program Files\Dell Photo Printer 720\dlbcserv.exe [2007-11-05 315392]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32 "= DivXa32.acm
"vidc.3IV2 "= 3ivxVfWCodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Jordan^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jordan\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
--a------ 2005-08-12 16:16 1121792 C:\Program Files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Soulseek\\slsk.exe "=
"C:\\Program Files\\Azureus\\Azureus.exe "=
"C:\\WINDOWS\\system32\\cftmem.exe "=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R3 3xHybrid;WinFast DTV1000 S;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-07-30 702336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S3 8023714a-b8f8-4baa-9bf2-7c5df6d7b971;8023714a-b8f8-4baa-9bf2-7c5df6d7b971;D:\Player\cds300.dll [ ]
S3 USB_RNDIS;NetComm NB5 USB;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 12672]
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast TV\WFDTV\WFIOCTL.SYS [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{effdd6ac-ecb5-11db-915f-00300a41ae78}]
\Shell\AutoRun\command - E:\vxbjju.exe
\Shell\explore\Command - E:\vxbjju.exe
\Shell\open\Command - E:\vxbjju.exe

*Newly Created Service* - CATCHME
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{DF9A99CF-49C6-4E3E-B668-498B718FD313} - (no file)
ShellExecuteHooks-{998DAE3E-7D4F-4952-A71F-467D8FE64407} - (no file)
Notify-byXpmjGw - byXpmjGw.dll
MSConfigStartUp-QuickTime Task - C:\Program Files\QuickTime\qttask.exe
MSConfigStartUp-WinFast Schedule - C:\Program Files\WinFast TV\WFDTV\WFWIZ.exe
MSConfigStartUp-WinFastDTV - C:\Program Files\WinFast TV\WFDTV\DTVSchdl.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Jordan\Application Data\Mozilla\Firefox\Profiles\j595b8md.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-11 18:20:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-11 18:22:46
ComboFix-quarantined-files.txt 2008-10-11 07:22:22
ComboFix2.txt 2008-07-23 07:01:42

Pre-Run: 114,217,754,624 bytes free
Post-Run: 114,322,145,280 bytes free

188 --- E O F --- 2008-09-10 12:36:25

_________

Cheers!

Geri · 2008/10/11

Hi
OK please do this.

Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.
Code:
Folder::
C:\Program Files\Soulseek

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{effdd6ac-ecb5-11db-915f-00300a41ae78}]

DirLook::
C:\khq 
Your flash Drive is infected.

Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

Hold down the Shift key and insert your flash drive. (USB thumb drives)
It is important to hold the shift key while plugging in flash drive so the virus does not run and re-infect system.

Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Your desktop will vanish for a while, and then reappear. This is normal.
Wait until the program has finished scanning, then please exit the program.

Repeat this step if you have more than one flash drives.

Update your Java.

Please download JavaRa and save the file to your desktop.

Right click and Extract All

Once extracted, open and run JavaRa.exe

Click Search For Updates

Select Update Using jucheck.exe

Click Search

If a newer version is found, allow it to be installed

Uncheck the Google Toolbar option. (if you don't want the Google tool bar)

When complete, click Remove Older Versions in the JavaRa interface and allow it to proceed

When that is complete, click Additional Tasks, then select Remove Useless JRE Files and click Go

Exit the tool when complete.

Read and then You can delete the gpl-2.0.txt file.

Please post the Combofix log.

Thanks
Geri

Blitzkrieg · 2008/10/11

Hi Geri,

The Java update wouldn't work due to a server being down or something, I tried a couple of times and it kept getting an error in the same place. I shall try again later.

___________

ComboFix 08-10-10.09 - Jordan 2008-10-12 12:43:28.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.608 [GMT 11:00]
Running from: C:\Documents and Settings\Jordan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jordan\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Soulseek
C:\Program Files\Soulseek\attributes.cfg
C:\Program Files\Soulseek\attrstrings.cfg
C:\Program Files\Soulseek\autoaway.cfg
C:\Program Files\Soulseek\BlackBox.dll
C:\Program Files\Soulseek\chatrooms.cfg
C:\Program Files\Soulseek\chatui.cfg
C:\Program Files\Soulseek\DbgHelp.Dll
C:\Program Files\Soulseek\dlbans.cfg
C:\Program Files\Soulseek\extensions.cfg
C:\Program Files\Soulseek\hotlist.cfg
C:\Program Files\Soulseek\ignores.cfg
C:\Program Files\Soulseek\login.cfg
C:\Program Files\Soulseek\message.wav
C:\Program Files\Soulseek\pchat.cfg
C:\Program Files\Soulseek\port.cfg
C:\Program Files\Soulseek\Psapi.Dll
C:\Program Files\Soulseek\queue.cfg
C:\Program Files\Soulseek\queue2.cfg
C:\Program Files\Soulseek\rcmnd.cfg
C:\Program Files\Soulseek\Readme.txt
C:\Program Files\Soulseek\save.cfg
C:\Program Files\Soulseek\search.cfg
C:\Program Files\Soulseek\shared.cfg
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Soulseek\ticker.cfg
C:\Program Files\Soulseek\transfersview.cfg
C:\Program Files\Soulseek\ui.cfg
C:\Program Files\Soulseek\uninstall.exe
C:\Program Files\Soulseek\userinfo.cfg
C:\Program Files\Soulseek\usernotes.cfg
C:\Program Files\Soulseek\wishlist.cfg

.
((((((((((((((((((((((((( Files Created from 2008-09-12 to 2008-10-12 )))))))))))))))))))))))))))))))
.

2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Documents and Settings\Jordan\Application Data\Malwarebytes
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-11 18:00 . 2008-09-10 00:08 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-11 18:00 . 2008-09-10 00:08 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-08 22:09 . 2008-10-08 22:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-08 22:09 . 2008-10-08 22:09 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-06 16:53 . 2008-10-10 11:13 14,848 --a------ C:\WINDOWS\system32\MediaCodec.exe
2008-10-05 19:46 . 2008-10-05 19:46 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-10-01 23:09 . 2008-10-01 23:09 268 --ah----- C:\sqmdata00.sqm
2008-10-01 23:09 . 2008-10-01 23:09 244 --ah----- C:\sqmnoopt00.sqm
2008-09-29 18:44 . 2008-09-29 18:44 0 -rahs---- C:\khq
2008-09-24 18:04 . 2008-09-29 18:40 781,141 --a------ C:\WINDOWS\system32\cftmem.exe
2008-09-19 22:11 . 2007-07-30 19:02 702,336 -ra------ C:\WINDOWS\system32\drivers\3xHybrid.sys
2008-09-19 21:57 . 2008-09-19 21:57 <DIR> d-------- C:\WFDB
2008-09-19 21:56 . 2008-09-19 21:57 <DIR> d-------- C:\Program Files\WinFast
2008-09-19 21:30 . 2004-12-23 18:27 27,392 --a------ C:\WINDOWS\system32\drivers\ULCDRHlp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-11 12:06 2,032 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-11 12:05 30,452 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-11 12:05 3,759,648 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-11 12:05 278,560 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-11 07:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-11 01:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-11 00:49 --------- d-----w C:\Program Files\Spyware Doctor
2008-10-10 01:31 54,296 ----a-w C:\Documents and Settings\Jordan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-10 00:30 --------- d-----w C:\Program Files\Ad-Aware
2008-10-05 08:46 --------- d-----w C:\Program Files\Common Files\Real
2008-10-02 02:34 --------- d-----w C:\Documents and Settings\Jordan\Application Data\Azureus
2008-10-01 02:42 --------- d-----w C:\Program Files\QuickTime
2008-10-01 02:42 --------- d-----w C:\Program Files\Dell Support
2008-09-22 07:40 33,802 ----a-w C:\WINDOWS\system32\mem.exe.tmp
2008-09-19 10:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-11 05:29 81,288 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys
2008-09-11 05:29 66,952 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys
2008-09-11 05:29 40,840 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-02 11:07 197,120 ----a-w C:\WINDOWS\system32\Depeche Mode Red.scr
2008-08-02 11:06 197,120 ----a-w C:\WINDOWS\system32\Depeche Mode Blue.scr
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\khq ----

C:\khq\

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"DellSupport "= "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" [2005-05-15 332800]
"MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Creative MediaSource Go "= "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" [2005-10-19 135168]
"SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 C:\WINDOWS\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 1159168]
"DLA "= "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"igfxtray "= "C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd "= "C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers "= "C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 114688]
"WinFastDTV "= "C:\Program Files\WinFast\WFDTV\DTVSchdl.exe" [2007-11-16 90112]
"WinFast Schedule "= "C:\Program Files\WinFast\WFDTV\WFWIZ.exe" [2007-11-15 2850816]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-05 185632]
"SigmatelSysTrayApp "= "stsystra.exe" [2005-03-23 C:\WINDOWS\stsystra.exe]
"MBMon "= "CTMBHA.DLL" [2005-05-19 C:\WINDOWS\system32\CTMBHA.DLL]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-02-23 24576]
dlbcserv.lnk - C:\Program Files\Dell Photo Printer 720\dlbcserv.exe [2007-11-05 315392]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32 "= DivXa32.acm
"vidc.3IV2 "= 3ivxVfWCodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Jordan^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jordan\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
--a------ 2005-08-12 16:16 1121792 C:\Program Files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Azureus\\Azureus.exe "=
"C:\\WINDOWS\\system32\\cftmem.exe "=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R3 3xHybrid;WinFast DTV1000 S;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-07-30 702336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S3 8023714a-b8f8-4baa-9bf2-7c5df6d7b971;8023714a-b8f8-4baa-9bf2-7c5df6d7b971;D:\Player\cds300.dll [ ]
S3 USB_RNDIS;NetComm NB5 USB;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 12672]
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast TV\WFDTV\WFIOCTL.SYS [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-12 12:47:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-12 12:49:56
ComboFix-quarantined-files.txt 2008-10-12 01:49:31
ComboFix2.txt 2008-07-23 07:01:42

Pre-Run: 114,243,940,352 bytes free
Post-Run: 114,310,340,608 bytes free

186 --- E O F --- 2008-09-10 12:36:25

_________________

Cheers!

Geri · 2008/10/11

Hi
OK Here we go again.

Try to update your Java manually, here is how.

Updating Java and Clearing Cache

Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel.

It will say "Java Plug-in" under the icon.
Please find the update button or tab in the Java Control Panel. Update your Java then reboot.

If you are unable to update you can manually update by going here:

http://java.sun.com/javase/downloads/index.jsp

After the reboot, go back into the Control Panel and double-click the Java Icon.

On the general tab, at the bottom it has "temporary internet files "

Click the settings button. Then the Delete files button.

There are two options in the window to clear the cache - Leave both Checked

Applications and Applets
Trace and Log files

Click OK
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

Click OK to leave the Java Control Panel.

Delete older versions from Add/Remove list.

Now Run AFT Cleaner, I'm guessing you still have it installed.

Now a on line scan.

Please do an online scan with Kaspersky WebScanner

Click on “Accept” If your pop –up blocker blocks any windows from opening.

Click Run on the window that opens.
Windows Vista users you must open the web browser using the Run as Administrator command.

The program will launch and then begin downloading the latest definition files:

Under Scan on the left side.Click on My Computer

This will start the program and scan your system.

Click the “Scan Report” On the left side.

The scan will take a while so be patient and let it run.

Once the scan is complete it will display if your system has been infected.

Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:

Save the text file to your desktop.

Copy and paste that information in your next post.

Please post the Kaspersky results.

Thanks
Geri

Blitzkrieg · 2008/10/19

Hi Geri,

I finally got the Java to update, but as was the problem last time, the online scanner would not work for me. I was able to use the other online scanner that you suggested last time though, here are the results:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-20 10:47:17
PROTECTIONS: 1
MALWARE: 25
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Kaspersky Anti-Virus 8.0.0.357 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Application Data\Mozilla\Firefox\Profiles\j595b8md.default\cookies-1.txt[.atdmt.com/]
00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Cookies\jordan@clickbank[1].txt
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Cookies\jordan@searchportal.information[1].txt
00366244 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\Jordan\Desktop\virus ****\Flash_Disinfector.exe[C:\Documents and Settings\Jordan\Desktop\virus ****\Flash_Disinfector.exe][nircmd.exe]
00390780 W32/Sohanat.FP.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP710\A0105826.exe
00394756 Bck/SDBot.LYF Virus/Trojan No 1 Yes No C:\WINDOWS\system32\mem.exe.tmp
00394756 Bck/SDBot.LYF Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP708\A0105749.exe
00394780 W32/IRCBot.CFI.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP715\A0111332.exe
00394780 W32/IRCBot.CFI.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP714\A0111273.exe
00396707 Bck/Bifrose.BHA Virus/Trojan No 0 Yes No C:\WINDOWS\system32\cftmem.exe
00410913 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP722\A0119995.dll
00411026 Adware/SpywareNo Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121023.exe
00411261 Adware/VistaAntivirus Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121028.exe
00411271 Adware/VistaAntivirus Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121025.exe
00411281 Adware/VistaAntivirus Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121027.exe
00411533 Trj/Agent.JZG Virus/Trojan No 1 Yes No C:\WINDOWS\system32\MediaCodec.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP646\A0094756.EXE
01895148 Malicious Packer SecRisk No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP722\A0117799.dll
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP646\A0094745.sys
02970484 Trj/KeyStroke.B Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP643\A0092671.exe
03310100 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP646\A0094734.dll
03310100 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\kbltomae.dll.vir
03738686 Generic Malware Virus/Trojan No 0 No No C:\Documents and Settings\Jordan\Desktop\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
03834121 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121032.dll
03834627 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121030.exe
03839851 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP728\A0125158.sys
03843122 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121022.exe
03894793 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP722\A0119996.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Cheers!

Geri · 2008/10/19

Hi
OK Good.

Please do this.

Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
C:\WINDOWS\system32\mem.exe.tmp
C:\WINDOWS\system32\cftmem.exe
C:\WINDOWS\system32\MediaCodec.exe 
Please post the combofix log.

Thanks

Blitzkrieg · 2008/10/20

Hi Geri,

After a few attempts it worked for me. I kept on getting prompt boxes come up with the following messages:

"C:\32788R22FWJFW\pv.cfexe is not a valid Win32 application "

&

"C:\ComboFix\pv.cfexe is not a valid Win32 application "

I pressed the ok button through many of those interuptions, and after a few attempts, I had success. Here is the log:

ComboFix 08-10-19.03 - Jordan 2008-10-20 16:40:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.605 [GMT 11:00]
Running from: C:\Documents and Settings\Jordan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jordan\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\cftmem.exe
C:\WINDOWS\system32\MediaCodec.exe
C:\WINDOWS\system32\mem.exe.tmp
.
/wow section not completed

((((((((((((((((((((((((( Files Created from 2008-09-20 to 2008-10-20 )))))))))))))))))))))))))))))))
.

2008-10-20 01:24 . 2008-10-20 01:24 <DIR> d-------- C:\WINDOWS\LastGood
2008-10-20 01:24 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Documents and Settings\Jordan\Application Data\Malwarebytes
2008-10-11 18:00 . 2008-10-11 18:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-11 18:00 . 2008-09-10 00:08 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-11 18:00 . 2008-09-10 00:08 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-08 22:09 . 2008-10-16 13:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-08 22:09 . 2008-10-08 22:09 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-05 19:46 . 2008-10-05 19:46 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-10-01 23:09 . 2008-10-01 23:09 268 --ah----- C:\sqmdata00.sqm
2008-10-01 23:09 . 2008-10-01 23:09 244 --ah----- C:\sqmnoopt00.sqm
2008-09-29 18:44 . 2008-09-29 18:44 0 -rahs---- C:\khq

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-20 05:15 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-19 09:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-19 01:23 --------- d-----w C:\Program Files\Java
2008-10-18 13:48 30,452 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-18 13:48 3,759,648 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-18 13:48 278,560 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-18 13:48 2,032 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-17 06:25 --------- d-----w C:\Program Files\Spyware Doctor
2008-10-10 01:31 54,296 ----a-w C:\Documents and Settings\Jordan\Application Data\GDIPFONTCACHEV1.DAT
2008-10-10 00:30 --------- d-----w C:\Program Files\Ad-Aware
2008-10-05 08:46 --------- d-----w C:\Program Files\Common Files\Real
2008-10-03 17:41 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-02 02:34 --------- d-----w C:\Documents and Settings\Jordan\Application Data\Azureus
2008-10-01 02:42 --------- d-----w C:\Program Files\QuickTime
2008-10-01 02:42 --------- d-----w C:\Program Files\Dell Support
2008-09-19 10:57 --------- d-----w C:\Program Files\WinFast
2008-09-19 10:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-15 11:57 1,846,016 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-09-11 05:29 81,288 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys
2008-09-11 05:29 66,952 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys
2008-09-11 05:29 40,840 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-28 10:04 333,056 ------w C:\WINDOWS\system32\dllcache\srv.sys
2008-08-27 08:24 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-14 09:57 2,185,984 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 09:55 2,142,720 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 09:55 2,142,720 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 09:51 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-08-14 09:18 2,062,976 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 09:18 2,020,864 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 09:18 2,020,864 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-08-02 11:07 197,120 ----a-w C:\WINDOWS\system32\Depeche Mode Red.scr
2008-08-02 11:06 197,120 ----a-w C:\WINDOWS\system32\Depeche Mode Blue.scr
.

((((((((((((((((((((((((((((( snapshot@2008-10-20_12.29.33.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-30 22:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe
+ 2000-08-30 21:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe
- 2000-08-30 22:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
+ 2000-08-30 21:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
- 2000-08-30 22:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
+ 2000-08-30 21:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
- 2000-08-30 22:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe
+ 2000-08-30 21:00:00 136,704 ----a-w C:\WINDOWS\SWSC.exe
- 2000-08-30 22:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2000-08-30 21:00:00 49,152 ----a-w C:\WINDOWS\VFIND.exe
- 2000-08-30 22:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
+ 2000-08-30 21:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"DellSupport "= "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" [2005-05-15 332800]
"MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Creative MediaSource Go "= "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" [2005-10-19 135168]
"SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 C:\WINDOWS\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 1159168]
"DLA "= "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"igfxtray "= "C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd "= "C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers "= "C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 114688]
"WinFastDTV "= "C:\Program Files\WinFast\WFDTV\DTVSchdl.exe" [2007-11-16 90112]
"WinFast Schedule "= "C:\Program Files\WinFast\WFDTV\WFWIZ.exe" [2007-11-15 2850816]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-05 185632]
"ISTray "= "C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-09-11 1168264]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SigmatelSysTrayApp "= "stsystra.exe" [2005-03-23 C:\WINDOWS\stsystra.exe]
"MBMon "= "CTMBHA.DLL" [2005-05-19 C:\WINDOWS\system32\CTMBHA.DLL]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-02-23 24576]
dlbcserv.lnk - C:\Program Files\Dell Photo Printer 720\dlbcserv.exe [2007-11-05 315392]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell "= "Explorer.exe csrcs.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32 "= DivXa32.acm
"vidc.3IV2 "= 3ivxVfWCodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Jordan^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Jordan\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
--a------ 2005-08-12 16:16 1121792 C:\Program Files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Azureus\\Azureus.exe "=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R3 3xHybrid;WinFast DTV1000 S;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-07-30 702336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S3 8023714a-b8f8-4baa-9bf2-7c5df6d7b971;8023714a-b8f8-4baa-9bf2-7c5df6d7b971;D:\Player\cds300.dll [ ]
S3 USB_RNDIS;NetComm NB5 USB;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 12672]
S3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast TV\WFDTV\WFIOCTL.SYS [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - MBAMSWISSARMY
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-20 16:41:14
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-10-20 16:45:15
ComboFix-quarantined-files.txt 2008-10-20 05:43:48
ComboFix2.txt 2008-10-20 01:30:31
ComboFix3.txt 2008-10-12 01:49:58
ComboFix4.txt 2008-07-23 07:01:42

Pre-Run: 113,408,094,208 bytes free
Post-Run: 113,390,235,648 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

175 --- E O F --- 2008-10-16 16:00:45

_____________

Cheers!

Geri · 2008/10/20

Hi

OK please do this.

Delete Flash_Disinfector.exe

Click Start > Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing any infected files there as well.
Please check and verify that C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.

We need to turn off and on system restore. There are infections in it and by using system restore you would reinfect yourself.

You must be logged in as an Administrator to do this. If you are not logged in as an Administrator, the System Restore tab will not be displayed.
Turning off System Restore will clear out all previous restore points.

To turn off Windows XP System Restore:
NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:
1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives. "
5. Click Apply, and then click OK
6. Make a new restore point.
7. Click Start, All Programs, Accessories, System Tools, System Restore.
Choose Create a restore point and clicked Next, Under "Type a description for your restore pointâ€¦â€put a name in the box,. Click Create. In the next window click Close.

Run ATF Cleaner, Make sure you do the Firefox instructions also.

OK, now lets get another on line scan from Panda.

Geri

Blitzkrieg · 2008/10/23

Hi Geri!

It seems things are looking good!

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-24 15:12:08
PROTECTIONS: 1
MALWARE: 1
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Kaspersky Anti-Virus 8.0.0.357 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Application Data\Mozilla\Firefox\Profiles\j595b8md.default\cookies-1.txt[.atdmt.com/]
;===================================================================================================================================================================================
SUSPECTS
Sent Location y
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description y
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Cheers!

Blitzkrieg · 2008/10/24

I forgot to mention, everytime I start up windows, I get this prompt:

"Windows cannot find 'csrcs.exe'. Make sure you typed the name correctly, then try again. To search for a file, click the start button, and then click search. "

Is there anyway I can make it stop appearing?

Cheers!

Geri · 2008/10/25

Hi
OK the Kaspersky scan looks good., Just a cookie showing.

Please do this.

Please backup your registry using ERUNT before proceeding to any of the steps.

Download ERUNT from Derfisch or Aumha and save it to your desktop.

Use the setup program to install ERUNT on your computer
Click ERUNT.Setup.exe to install ERUNT and backup your registry.
Uncheck the "Create NTREGOPT desktop icon” box.
In the window that comes up to Create an ERUNT entry to the Start up folder select No.

By Default the backup location is C:\windows\erunt\ (current date)
Click OK to continue with the registry backup.
If the folder does not exist then let ERUNT create the folder for you by clicking Yes
You should see a progress bar when ERUNT is backing up the Windows Registry.
After ERUNT has completed the Windows Registry backup. Click OK to exit ERUNT

Now do this.

Open “Notepad” Copy the contents of the code box below to the blank Notepad.
Click "File" > "Save as "
In the "Save In" box at the top click the down arrow and select DeskTop

In the “File name” type in: fix.reg
In the “Save As Type” select: All Files
Once saved, Go to your desktop double click “fix.reg file” and let it merge with the registry.
Code:
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
 "Shell "= "Explorer.exe" 
Now reboot and let me know if the message is gone.

Please post a new RSIT log.

Thanks
Geri

Blitzkrieg · 2008/10/26

Hi Geri,

The message has disappeared, and I just ran another Panda scan which gave the same result as above.

Thanks again for all your help!

Geri · 2008/10/27

Hi

Please post a new RSIT log if you would, I would like to look it over.

Thanks

Blitzkrieg · 2008/10/27

Sorry, which program was the RSIT log from again?

Geri · 2008/10/27

RSIT.exe

Should be on your Desktop.

Blitzkrieg · 2008/10/27

Just looked over the 2 threads and my programs and have found no mention of it!

Geri · 2008/10/27

Hi
OK, sorry you posted a dss log.
We are no longer using dss. Please delete it and post this.

Download RSIT by random/random and save it to your desktop.

Double click RSIT.exe to start the tool.

At the disclaimer, please use the drop down box to select 3 months for the file/folder search, then click Continue.

If prompted by your firewall to allow RSIT to access the internet, please allow it. It will be updating yourr version of HijackThis.

When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.

Please post the contents of log.txt here in your next reply.

Thanks

Blitzkrieg · 2008/10/27

Logfile of random's system information tool 1.04 (written by random/random)
Run by Jordan at 2008-10-28 11:48:58
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 109 GB (46%) free of 238 GB
Total RAM: 1022 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:12 AM, on 28/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\PROGRA~1\DELLSU~1\DSAgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\DOCUME~1\Jordan\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Documents and Settings\Jordan\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\HijackThis\Jordan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" /SCB
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6FA3BA36-FBF4-45A7-9303-FB95FFF04F42}: NameServer = 203.50.2.71 139.130.4.4
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 10847 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 853672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-09-08 110652]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-07-21 654320]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1 "=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]
"MSPY2002 "=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-04 59392]
"PHIME2002ASync "=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"PHIME2002A "=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"SigmatelSysTrayApp "=C:\WINDOWS\stsystra.exe [2005-03-23 339968]
"ATIPTA "=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-06 344064]
"CTSysVol "=C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe [2005-09-15 57344]
"MBMon "=Rundll32 CTMBHA.DLL []
"UpdReg "=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]
"VoiceCenter "=C:\Program Files\Creative\VoiceCenter\AndreaVC.exe [2005-09-19 1159168]
"DLA "=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-09-08 122940]
"ISUSPM Startup "=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-07-27 221184]
"ISUSScheduler "=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-07-27 81920]
"igfxtray "=C:\WINDOWS\system32\igfxtray.exe [2005-10-14 94208]
"igfxhkcmd "=C:\WINDOWS\system32\hkcmd.exe [2005-10-14 77824]
"igfxpers "=C:\WINDOWS\system32\igfxpers.exe [2005-10-14 114688]
"WinFastDTV "=C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2007-11-16 90112]
"WinFast Schedule "=C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2007-11-15 2850816]
"TkBellExe "=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-10-05 185632]
"ISTray "=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-09-11 1168264]
"SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI "=C:\WINDOWS\MIDIDef.exe [2004-12-22 24576]
"Creative Detector "=C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe [2004-12-02 102400]
"DellSupport "=C:\PROGRA~1\DELLSU~1\DSAgnt.exe [2005-05-15 332800]
"MsnMsgr "=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Creative MediaSource Go "=C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe [2005-10-19 135168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe [2005-08-12 1121792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jordan^Start Menu^Programs^Startup^Adobe Gamma.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
dlbcserv.lnk - C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-10-14 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-04-25 206088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives "=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun "=
"NoDrives "=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Azureus\Azureus.exe "= "C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus "
"%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
"C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
"C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe -a

======List of files/folders created in the last 3 months======

2008-10-28 11:48:58 ----D---- C:\rsit
2008-10-27 11:53:22 ----D---- C:\Program Files\ERUNT
2008-10-26 01:07:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-10-24 23:25:23 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-24 12:47:28 ----SHD---- C:\Config.Msi
2008-10-24 12:43:44 ----D---- C:\WINDOWS\Prefetch
2008-10-24 12:11:49 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-24 12:11:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-10-24 12:11:21 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-24 12:11:06 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-24 12:10:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-10-24 12:10:42 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-10-24 12:10:30 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-10-24 12:10:15 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-10-24 12:10:02 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-10-24 12:09:52 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-10-24 12:09:42 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-10-24 12:02:45 ----D---- C:\WINDOWS\system32\scripting
2008-10-24 12:02:43 ----D---- C:\WINDOWS\l2schemas
2008-10-24 12:02:42 ----D---- C:\Program Files\msn
2008-10-24 12:02:41 ----D---- C:\WINDOWS\system32\en
2008-10-24 12:02:41 ----D---- C:\WINDOWS\system32\bits
2008-10-24 11:57:48 ----D---- C:\WINDOWS\ServicePackFiles
2008-10-24 11:45:21 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-10-24 11:44:54 ----D---- C:\WINDOWS\EHome
2008-10-21 19:12:59 ----SHD---- C:\RECYCLER
2008-10-20 16:45:19 ----D---- C:\WINDOWS\temp
2008-10-20 16:40:04 ----A---- C:\Boot.bak
2008-10-20 16:39:58 ----RASHD---- C:\cmdcons
2008-10-20 16:15:25 ----A---- C:\WINDOWS\NIRCMD.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\zip.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\VFIND.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\SWSC.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\SWREG.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\sed.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\grep.exe
2008-10-20 16:15:24 ----A---- C:\WINDOWS\fdsv.exe
2008-10-19 12:22:30 ----A---- C:\WINDOWS\system32\javaws.exe
2008-10-19 12:22:30 ----A---- C:\WINDOWS\system32\javaw.exe
2008-10-19 12:22:30 ----A---- C:\WINDOWS\system32\java.exe
2008-10-16 01:52:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-10-16 01:52:39 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 01:52:32 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-10-16 01:51:57 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-10-16 01:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-10-12 11:00:42 ----RASHD---- C:\autorun.inf
2008-10-11 18:00:10 ----D---- C:\Documents and Settings\Jordan\Application Data\Malwarebytes
2008-10-11 18:00:02 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-11 18:00:02 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-06 10:50:16 ----D---- C:\Documents and Settings\Jordan\Application Data\Real
2008-10-05 19:46:44 ----D---- C:\Program Files\Common Files\xing shared
2008-09-19 21:57:08 ----D---- C:\WFDB
2008-09-19 21:56:49 ----D---- C:\Program Files\WinFast
2008-09-19 21:45:13 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2008-09-19 21:45:12 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2008-09-19 21:45:11 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2008-09-19 21:45:11 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2008-09-19 21:45:11 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2008-09-19 21:45:10 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2008-09-19 21:45:10 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2008-09-19 21:45:09 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2008-09-19 21:45:09 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2008-09-19 21:45:08 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2008-09-19 21:45:08 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2008-09-19 21:45:07 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2008-09-19 21:45:06 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2008-09-19 21:45:06 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2008-09-19 21:45:06 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2008-09-19 21:45:05 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2008-09-19 21:45:05 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2008-09-19 21:45:04 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2008-09-19 21:45:04 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2008-09-19 21:45:03 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2008-09-19 21:45:00 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2008-09-10 23:34:25 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2008-09-10 23:34:04 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-05 20:46:08 ----N---- C:\WINDOWS\system32\wmphoto.dll
2008-09-05 20:46:07 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-09-05 20:46:05 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2008-09-05 20:46:05 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2008-09-05 20:45:57 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-09-05 20:45:57 ----N---- C:\WINDOWS\system32\tsgqec.dll
2008-09-05 20:45:51 ----N---- C:\WINDOWS\system32\spupdwxp.exe
2008-09-05 20:45:49 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
2008-09-05 20:45:48 ----N---- C:\WINDOWS\system32\slserv.exe
2008-09-05 20:45:48 ----N---- C:\WINDOWS\system32\slrundll.exe
2008-09-05 20:45:48 ----N---- C:\WINDOWS\system32\slgen.dll
2008-09-05 20:45:48 ----N---- C:\WINDOWS\system32\slextspk.dll
2008-09-05 20:45:48 ----N---- C:\WINDOWS\system32\slcoinst.dll
2008-09-05 20:45:48 ----N---- C:\WINDOWS\slrundll.exe
2008-09-05 20:45:44 ----N---- C:\WINDOWS\system32\setupn.exe
2008-09-05 20:45:42 ----N---- C:\WINDOWS\system32\s3gnb.dll
2008-09-05 20:45:41 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2008-09-05 20:45:40 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-09-05 20:45:39 ----N---- C:\WINDOWS\system32\qutil.dll
2008-09-05 20:45:38 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-09-05 20:45:38 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-09-05 20:45:37 ----N---- C:\WINDOWS\system32\qagent.dll
2008-09-05 20:45:36 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2008-09-05 20:45:34 ----N---- C:\WINDOWS\system32\onex.dll
2008-09-05 20:45:26 ----N---- C:\WINDOWS\system32\napstat.exe
2008-09-05 20:45:26 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-09-05 20:45:26 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-09-05 20:45:26 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2008-09-05 20:45:24 ----N---- C:\WINDOWS\system32\msxml6r.dll
2008-09-05 20:45:24 ----N---- C:\WINDOWS\system32\msxml6.dll
2008-09-05 20:45:22 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-09-05 20:45:22 ----N---- C:\WINDOWS\system32\mssha.dll
2008-09-05 20:45:11 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-09-05 20:45:10 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-09-05 20:45:10 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-09-05 20:45:10 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-09-05 20:44:57 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-09-05 20:44:57 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-09-05 20:44:56 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-09-05 20:44:56 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-09-05 20:44:56 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-09-05 20:44:56 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-09-05 20:44:48 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2008-09-05 20:44:45 ----A---- C:\WINDOWS\002835_.tmp
2008-09-05 20:44:44 ----N---- C:\WINDOWS\system32\faxpatch.exe
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-09-05 20:44:43 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-09-05 20:44:41 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-09-05 20:44:40 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-09-05 20:44:40 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-09-05 20:44:40 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-09-05 20:44:38 ----N---- C:\WINDOWS\system32\credssp.dll
2008-09-05 20:44:35 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-09-05 20:44:34 ----N---- C:\WINDOWS\system32\azroles.dll
2008-09-05 20:44:34 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2008-09-05 20:44:32 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2008-09-05 20:44:32 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2008-09-05 20:44:27 ----N---- C:\WINDOWS\system32\aaclient.dll
2008-08-14 00:18:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2008-08-14 00:18:09 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2008-08-14 00:18:04 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
2008-08-14 00:17:49 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2008-08-14 00:16:32 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-08-14 00:16:22 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2008-08-14 00:15:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2008-08-10 13:36:01 ----D---- C:\Documents and Settings\Jordan\Application Data\HTML Executable
2008-08-06 16:42:47 ----A---- C:\WINDOWS\system32\srusd.dll
2008-08-06 16:42:42 ----A---- C:\WINDOWS\system32\fnfilter.dll
2008-08-02 22:07:08 ----D---- C:\WINDOWS\system32\Depeche Mode Red dir
2008-08-02 22:06:58 ----D---- C:\WINDOWS\system32\Depeche Mode Blue dir

======List of files/folders modified in the last 3 months======

2008-10-28 11:49:03 ----D---- C:\Program Files\HijackThis
2008-10-28 11:47:34 ----A---- C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt
2008-10-28 11:42:27 ----D---- C:\Program Files\Mozilla Firefox
2008-10-28 11:08:00 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-28 10:43:46 ----D---- C:\WINDOWS\system32\drivers
2008-10-28 00:02:02 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-27 21:38:10 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-27 18:33:13 ----D---- C:\Program Files\Spyware Doctor
2008-10-27 11:53:58 ----D---- C:\WINDOWS\ERDNT
2008-10-27 11:53:22 ----RD---- C:\Program Files
2008-10-26 20:54:18 ----D---- C:\WINDOWS\system32\CatRoot2
2008-10-26 20:33:01 ----D---- C:\WINDOWS
2008-10-26 01:07:53 ----HD---- C:\WINDOWS\inf
2008-10-26 01:07:47 ----RSHD---- C:\WINDOWS\system32\dllcache
2008-10-26 01:07:46 ----D---- C:\WINDOWS\system32
2008-10-25 09:30:17 ----HD---- C:\WINDOWS\$hf_mig$
2008-10-24 23:25:54 ----D---- C:\WINDOWS\system32\CatRoot
2008-10-24 23:25:40 ----A---- C:\WINDOWS\imsins.BAK
2008-10-24 15:58:43 ----SHD---- C:\WINDOWS\Installer
2008-10-24 12:46:51 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-24 12:46:01 ----SHD---- C:\System Volume Information
2008-10-24 12:46:01 ----D---- C:\WINDOWS\system32\Restore
2008-10-24 12:44:32 ----AC---- C:\WINDOWS\OEWABLog.txt
2008-10-24 12:43:40 ----AC---- C:\WINDOWS\setuplog.txt
2008-10-24 12:43:00 ----D---- C:\WINDOWS\system32\Setup
2008-10-24 12:43:00 ----D---- C:\WINDOWS\AppPatch
2008-10-24 12:42:59 ----RSD---- C:\WINDOWS\Fonts
2008-10-24 12:42:59 ----D---- C:\WINDOWS\system32\wbem
2008-10-24 12:09:54 ----D---- C:\Program Files\Messenger
2008-10-24 12:09:24 ----D---- C:\WINDOWS\security
2008-10-24 12:03:27 ----D---- C:\WINDOWS\WinSxS
2008-10-24 12:03:13 ----D---- C:\WINDOWS\network diagnostic
2008-10-24 12:03:12 ----D---- C:\WINDOWS\ime
2008-10-24 12:03:11 ----D---- C:\WINDOWS\Help
2008-10-24 12:02:47 ----D---- C:\WINDOWS\system32\usmt
2008-10-24 12:02:47 ----D---- C:\WINDOWS\system32\en-US
2008-10-24 12:02:41 ----D---- C:\WINDOWS\PeerNet
2008-10-24 12:02:40 ----D---- C:\Program Files\Movie Maker
2008-10-24 11:57:39 ----D---- C:\WINDOWS\system32\npp
2008-10-24 11:57:36 ----D---- C:\WINDOWS\msagent
2008-10-24 11:57:34 ----D---- C:\WINDOWS\srchasst
2008-10-24 11:57:27 ----D---- C:\Program Files\NetMeeting
2008-10-24 11:57:24 ----D---- C:\WINDOWS\system32\Com
2008-10-24 11:57:18 ----D---- C:\Program Files\Windows Media Player
2008-10-24 11:57:17 ----D---- C:\Program Files\Windows NT
2008-10-24 11:57:17 ----D---- C:\Program Files\Outlook Express
2008-10-24 11:57:10 ----D---- C:\Program Files\Common Files\System
2008-10-24 11:56:35 ----D---- C:\WINDOWS\system32\oobe
2008-10-24 11:56:31 ----D---- C:\WINDOWS\system
2008-10-24 11:49:15 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-10-22 19:09:38 ----A---- C:\WINDOWS\dellstat.ini
2008-10-20 16:41:12 ----A---- C:\WINDOWS\system.ini
2008-10-20 16:40:05 ----RASH---- C:\boot.ini
2008-10-19 12:23:19 ----D---- C:\Program Files\Java
2008-10-16 03:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-16 01:52:19 ----D---- C:\Program Files\Internet Explorer
2008-10-12 12:45:58 ----D---- C:\Program Files\Common Files
2008-10-11 18:12:17 ----D---- C:\Documents and Settings\Jordan\Application Data\Adobe
2008-10-11 12:00:26 ----A---- C:\WINDOWS\system32\835aafde-.txt
2008-10-10 11:30:50 ----D---- C:\Program Files\Ad-Aware
2008-10-08 06:19:40 ----A---- C:\WINDOWS\system32\MRT.exe
2008-10-05 19:46:41 ----D---- C:\Program Files\Common Files\Real
2008-10-05 19:46:36 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2008-10-05 19:46:24 ----A---- C:\WINDOWS\system32\pndx5032.dll
2008-10-05 19:46:24 ----A---- C:\WINDOWS\system32\pndx5016.dll
2008-10-05 19:46:22 ----A---- C:\WINDOWS\system32\pncrt.dll
2008-10-04 04:41:15 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-10-02 13:34:02 ----D---- C:\Documents and Settings\Jordan\Application Data\Azureus
2008-10-01 13:42:54 ----D---- C:\Program Files\QuickTime
2008-10-01 13:42:54 ----D---- C:\Program Files\Dell Support
2008-09-30 17:24:48 ----A---- C:\WINDOWS\NeroDigital.ini
2008-09-30 16:45:08 ----D---- C:\WinFast WorkArea
2008-09-25 19:33:12 ----SD---- C:\WINDOWS\system32\Microsoft
2008-09-19 21:56:47 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-19 21:44:49 ----D---- C:\WINDOWS\system32\DirectX
2008-09-15 22:35:19 ----D---- C:\etax2008
2008-09-05 13:05:30 ----D---- C:\WINDOWS\Debug
2008-08-27 19:24:32 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-08-26 18:24:31 ----A---- C:\WINDOWS\system32\wininet.dll
2008-08-26 18:24:31 ----A---- C:\WINDOWS\system32\webcheck.dll
2008-08-26 18:24:31 ----A---- C:\WINDOWS\system32\urlmon.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\url.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\pngfilt.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\occache.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\mstime.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\msrating.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\mshtmled.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\msfeeds.dll
2008-08-26 18:24:30 ----A---- C:\WINDOWS\system32\jsproxy.dll
2008-08-26 18:24:29 ----A---- C:\WINDOWS\system32\iertutil.dll
2008-08-26 18:24:29 ----A---- C:\WINDOWS\system32\iernonce.dll
2008-08-26 18:24:29 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\ieaksie.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\ieakeng.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\icardie.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\extmgr.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\dxtrans.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\dxtmsft.dll
2008-08-26 18:24:28 ----A---- C:\WINDOWS\system32\advpack.dll
2008-08-25 19:38:00 ----A---- C:\WINDOWS\system32\ieudinit.exe
2008-08-25 19:37:59 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2008-08-23 16:54:51 ----A---- C:\WINDOWS\system32\ieakui.dll
2008-08-14 21:09:26 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 20:33:16 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-08-25 5628]
R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-08-25 22684]
R1 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-09-11 66952]
R1 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-09-11 81288]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2008-07-20 187920]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2002-07-17 16877]
R2 CDRPDACC;Arrowkey Device Access; \??\C:\Program Files\Shared\CDRPDACC.SYS []
R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-09-08 25628]
R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-09-08 2496]
R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-09-08 86524]
R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-09-08 14684]
R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-09-08 6364]
R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-09-08 87036]
R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-09-08 94332]
R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-08-12 40544]
R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2006-04-22 8064]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]
R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
R3 3xHybrid;WinFast DTV1000 S; C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2007-07-30 702336]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2006-09-25 20096]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-11 138752]
R3 CTUSFSYN;Creative SoundFont Synthesizer; C:\WINDOWS\system32\drivers\ctusfsyn.sys [2005-05-26 158464]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-10-15 155648]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2003-11-18 1042432]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2003-11-18 212224]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-11 106496]
R3 sigfilt;sigfilt; C:\WINDOWS\system32\drivers\sigfilt.sys [2005-09-22 1350784]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2005-08-17 1022040]
R3 ULCDRHlp;ULCDRHlp; C:\WINDOWS\System32\Drivers\ULCDRHlp.sys [2004-12-23 27392]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2002-02-05 28396]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2003-11-18 680704]
S2 Nsynas32;Nsynas32; C:\WINDOWS\system32\drivers\Nsynas32.sys []
S3 8023714a-b8f8-4baa-9bf2-7c5df6d7b971;8023714a-b8f8-4baa-9bf2-7c5df6d7b971; \??\D:\Player\cds300.dll []
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-10-15 1302812]
S3 MPE;BDA MPE Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 StillCam;Still Serial Digital Camera Driver; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-08-17 6784]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 TSP;TSP; \??\C:\WINDOWS\system32\drivers\klif.sys []
S3 U81xbus;LGE U8XXX driver (WDM); C:\WINDOWS\system32\DRIVERS\U81xbus.sys [2005-05-06 52352]
S3 U81xmdfl;LGE U8XXX USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\U81xmdfl.sys [2005-05-06 6064]
S3 U81xmdm;LGE U8XXX USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\U81xmdm.sys [2005-05-06 84480]
S3 U81xmgmt;LGE U8XXX USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\U81xmgmt.sys [2005-05-06 77472]
S3 U81xobex;LGE U8XXX USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\U81xobex.sys [2005-05-06 75456]
S3 USB_RNDIS;NetComm NB5 USB; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2008-04-14 12800]
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2005-05-26 21344]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2005-05-26 38144]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2005-06-24 39036]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WFIOCTL;WFIOCTL; \??\C:\Program Files\WinFast TV\WFDTV\WFIOCTL.SYS []
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-14 5504]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Ad-Aware\aawservice.exe [2008-07-21 611664]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-13 44032]
R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [2002-01-29 77824]
R2 EPSONStatusAgent2;EPSON Printer Status Agent2; C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe [2002-07-17 94208]
R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-21 137200]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2004-03-05 311296]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-10-20 1079176]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R2 WANMiniportService;WAN Miniport (ATW) Service; C:\WINDOWS\wanmpsvc.exe [2002-05-10 65536]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 Creative Labs Licensing Service;Creative Labs Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe [2008-10-01 69632]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-03-09 72704]
S3 AVP;Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2008-04-25 201992]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2004-11-19 147456]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

-----------------EOF-----------------

Cheers Geri!!

Log in or Sign up

Solved more Virtumonde trouble

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Share This Page

Log in or Sign up

Solved more Virtumonde trouble

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Geri Inactive Alumni

Blitzkrieg Inactive Thread Starter

Share This Page

Useful Searches