Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

"Advertisement" pop up malware

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

"Advertisement" pop up malware

Unread postby srg999999 » April 17th, 2008, 10:00 pm

Help. I keep having Advertisement pop up on my screen.
I have tried everything. Vundo Fix, ComboFix, Panda's PQRemove., AVG. I've run these in Safe Mode and regular boot up mode.
The latest attempt at Combofix seemed to cut down on the pop ups but I still get an advertisement pop up that says "Advertisement- Microsoft INternet Explorer" at the top of the window. Even if I have not opened the internet explorer program. I am guessing that internet explorer is not acutally opened but the malware is trying to get me to open it. Anyway I've attached the Combofix log and the Hijack this log below. Please help me remove this software. THanks.

Hijack this log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:29 PM, on 4/17/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe
C:\Program Files\Twain\Twain.exe
C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\ApvxdWin.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WebProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimreal.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {584C5668-9E23-4BC2-989D-2FCA1A07B3E3} - C:\WINDOWS\System32\vtutu.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: BndBlock5 BHO Class - {82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B} - C:\Program Files\QdrDrive\QdrDrive10.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: (no name) - {E0E765A4-74A2-45BD-B1AF-AE07F2A174E7} - C:\WINDOWS\System32\vturr.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EF7D8850-CA99-405C-987C-3380ADE566A7} - C:\WINDOWS\System32\awvtr.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe"
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [AdwareProMFC] C:\Program Files\Ad-Ware Pro\Ad-Ware Pro.exe
O4 - HKCU\..\Run: [Rndo] "C:\DOCUME~1\ADMINI~1\APPLIC~1\RACLE~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe"
O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe"
O4 - HKCU\..\Run: [Smcse] C:\WINDOWS\?racle\u?erinit.exe
O4 - HKCU\..\Run: [Twain] C:\Program Files\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcxplode.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://modsecgat.dimeshare.com/mod/cds ... ica32t.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info. ... taller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5874778312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2429600125
O16 - DPF: {A609CB6E-FEB5-47C3-966C-1B916842BD01} (Nlopflash Class) - http://poker.nlop.com/poker/PokerCreations.cab
O20 - Winlogon Notify: efcayyy - efcayyy.dll (file missing)
O20 - Winlogon Notify: ohjqxnbv - ohjqxnbv.dll (file missing)
O21 - SSODL: Cmpaplib - {CF7DC1AC-4560-46DC-A054-17CDF20F3692} - C:\WINDOWS\System32\bitamdel.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe

--
End of file - 9481 bytes

ComboFix Log:

ComboFix 08-04-13.1 - Administrator 2008-04-17 20:04:50.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.608 [GMT -4:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\RACLE~1
C:\Documents and Settings\Administrator\Application Data\RACLE~1\?racle\
C:\Documents and Settings\Administrator\Application Data\RACLE~1\javaw.exe
C:\Documents and Settings\Administrator\Application Data\WinTouch
C:\Documents and Settings\Administrator\Application Data\WinTouch\wintouch.cfg
C:\Documents and Settings\Administrator\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Administrator\Application Data\WinTouch\WTUninstaller.exe
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\CPV
C:\Program Files\CPV\CPV8.dll
C:\Program Files\CPV\CPV8.dll.lzma
C:\Program Files\inetget2
C:\Program Files\inetget2\SRInstaller.exe
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive15.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\dicy.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrModule\kwdy.gz
C:\Program Files\QdrModule\QdrModule15.exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\dicts.gz
C:\Program Files\QdrPack\QdrPack15.exe
C:\Program Files\QdrPack\trgts.gz
C:\Program Files\Temporary
C:\Program Files\Temporary\InsiDERInst.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\racle~1
C:\WINDOWS\racle~1\u?erinit.exe
C:\WINDOWS\system32\000070.exe
C:\WINDOWS\system32\000080.exe
C:\WINDOWS\system32\000090.exe
C:\WINDOWS\system32\eajeftfp.ini
C:\WINDOWS\system32\fncmapyo.ini
C:\WINDOWS\system32\fuomqsmg.dll
C:\WINDOWS\system32\jbwrbogw.dll
C:\WINDOWS\system32\kjukkdej.dll
C:\WINDOWS\system32\nnnnNDtS.dll
C:\WINDOWS\system32\omscsntm.dll
C:\WINDOWS\system32\pmnmkHaW.dll
C:\WINDOWS\system32\pngemrja.dll
C:\WINDOWS\system32\StDNnnnn.ini
C:\WINDOWS\system32\StDNnnnn.ini2
C:\WINDOWS\system32\stqvlpqe.dll
C:\WINDOWS\system32\tnntmmrh.ini
C:\WINDOWS\system32\wgobrwbj.ini
C:\WINDOWS\system32\xpcqljri.dll
C:\WINDOWS\system32\xpghck.dll
C:\WINDOWS\system32\ymsmtuhb.dll
C:\WINDOWS\system32\ypbwdnvm.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 )))))))))))))))))))))))))))))))
.

2008-04-17 07:05 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 07:05 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 07:05 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-17 07:05 . 2008-04-12 13:49 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-17 07:05 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-04-17 07:05 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-17 07:05 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-16 18:17 . 2008-04-16 18:25 3,660 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-16 16:28 . 2008-04-16 16:28 38,400 -ra------ C:\WINDOWS\mrofinu72.exe
2008-04-16 07:27 . 2008-04-16 07:33 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-15 20:40 . 2008-04-15 20:40 22 --a------ C:\WINDOWS\b104.exe.bin
2008-04-15 19:25 . 2008-04-15 19:25 <DIR> d-------- C:\Program Files\Inet_Get_2
2008-04-15 19:20 . 2008-04-15 20:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SpeedRunner
2008-04-15 19:15 . 2008-04-17 06:44 <DIR> d-------- C:\Program Files\Twain
2008-04-15 19:15 . 2008-04-15 19:15 9,216 --a------ C:\WINDOWS\system32\~.exe
2008-04-14 20:43 . 2008-04-14 17:43 74,240 --a------ C:\WINDOWS\b156.exe
2008-04-14 14:08 . 2008-04-14 11:08 46,592 --a------ C:\WINDOWS\b157.exe
2008-04-13 16:22 . 2008-04-13 16:22 281 --a------ C:\WINDOWS\system32\PavCPL.dat
2008-04-13 16:21 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-04-13 16:21 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-04-13 16:21 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-04-13 16:21 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-04-13 16:21 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-04-13 15:45 . 2008-04-13 15:45 3,648 --a------ C:\WINDOWS\system32\osairpsf.dll
2008-04-13 15:00 . 2008-04-13 15:00 3,648 --a------ C:\WINDOWS\system32\mehaabct.dll
2008-04-13 14:59 . 2008-04-13 20:33 <DIR> d-------- C:\Program Files\RcvSystem
2008-04-13 14:55 . 2008-04-13 16:30 <DIR> d-------- C:\WINDOWS\system32\PAV
2008-04-13 14:53 . 2008-04-13 14:55 <DIR> d-------- C:\Program Files\Mozilla Firefox(2)
2008-04-13 14:53 . 2008-04-13 14:53 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-11 10:48 . 2008-04-11 07:48 11,264 --a------ C:\WINDOWS\b138.exe
2008-04-08 19:33 . 2008-04-08 16:33 68,096 --a------ C:\WINDOWS\b155.exe
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L5807.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L53A2.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L4D97.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L4588.tmp
2008-04-04 13:25 . 2008-04-04 13:25 187,904 ---hs---- C:\Program Files\Common Files\Yazzle1552OinAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 00:01 13,880 ----a-w C:\WINDOWS\system32\drivers\COMFiltr.sys
2008-04-16 01:21 --------- d-----w C:\Program Files\TrojanHunter 4.6
2008-04-16 01:21 --------- d-----w C:\Program Files\ewido anti-malware
2008-03-30 22:19 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-03-02 14:26 73,728 ----a-w C:\WINDOWS\b153.exe
2008-02-29 11:28 --------- d-----w C:\Program Files\Google
2008-02-29 11:14 --------- d-----w C:\Program Files\Rhapsody
2008-02-29 11:12 --------- d-----w C:\Program Files\PartyGaming
2008-02-27 13:15 --------- d-----w C:\Program Files\Common Files\Panda Software
2008-02-27 12:00 --------- d-----w C:\Program Files\Panda Security
2008-02-20 13:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\sentinel
2008-02-20 12:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-30 13:25 60,968 ----a-w C:\Documents and Settings\Administrator\GoToAssistDownloadHelper.exe
2006-07-04 12:51 825,632 ----a-w C:\Documents and Settings\All Users\english.dat
2006-07-04 12:51 790,928 ----a-w C:\Documents and Settings\All Users\chinese.dat
2006-07-04 12:51 63,120 ----a-w C:\Documents and Settings\All Users\embeddedurls_new.dat
2006-07-04 12:51 596,608 ----a-w C:\Documents and Settings\All Users\spanish.dat
2006-07-04 12:51 54,416 ----a-w C:\Documents and Settings\All Users\extratings_insert.dat
2006-07-04 12:51 444,272 ----a-w C:\Documents and Settings\All Users\precaturls_new.dat
2006-07-04 12:51 258,048 ----a-w C:\Documents and Settings\All Users\UpdaterScript.exe
2006-05-30 01:02 24,192 ----a-w C:\Documents and Settings\Administrator\usbsermptxp.sys
2006-05-30 01:02 22,768 ----a-w C:\Documents and Settings\Administrator\usbsermpt.sys
2005-05-24 21:41 63,264 -c--a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2006-03-19 17:03 10,022 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-04_20.28.08.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-28 03:28:19 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE
+ 2008-04-18 00:10:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-07-11 13:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2000-08-31 12:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe
+ 2006-02-16 12:59:06 2,302 ----a-w C:\WINDOWS\fzko\fzko.dat
+ 2000-08-31 12:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
+ 2008-02-20 12:32:04 65,536 ----a-r C:\WINDOWS\Installer\{685A56F8-75B6-44AD-B3DA-FB0A3266B47C}\ARPPRODUCTICON.exe
+ 2004-12-27 20:27:11 2,560 -c--a-r C:\WINDOWS\Installer\{90190409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2004-12-27 20:07:58 2,560 -c--a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\07DVPZJ3.DAT
+ 2004-12-25 01:24:50 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\9RLBF53D.DAT
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\DZ1BR3Z1.DAT
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\VNB7Z3P7.DAT
+ 2004-12-25 01:24:53 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\XZB71BTN.DAT
- 2000-08-31 13:00:00 51,200 ----a-w C:\WINDOWS\NirCmd.exe
+ 2000-08-31 12:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2004-12-27 20:53:04 2,706 ----a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
+ 2000-08-31 12:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
+ 2000-08-31 12:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 12:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe
+ 2000-08-31 12:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system\KEYBOARD.DRV
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system\MCIAVI.DRV
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system\MCISEQ.DRV
+ 2001-09-26 00:01:20 28,160 ----a-w C:\WINDOWS\system\MCIWAVE.DRV
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system\MOUSE.DRV
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system\SOUND.DRV
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system\SYSTEM.DRV
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system\TIMER.DRV
+ 2001-09-26 00:02:48 2,176 ----a-w C:\WINDOWS\system\VGA.DRV
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system\WFWNET.DRV
+ 2002-08-29 14:41:32 132,096 ----a-w C:\WINDOWS\system\WINSPOOL.DRV
+ 2008-04-15 23:15:55 9,216 ----a-w C:\WINDOWS\system32\~.exe
- 2007-11-24 23:50:10 15,782 ----a-w C:\WINDOWS\system32\cmpusfav.dll
+ 2008-02-20 13:57:52 15,829 ----a-w C:\WINDOWS\system32\cmpusfav.dll
+ 2001-09-26 00:00:18 10,544 ----a-w C:\WINDOWS\system32\comm.drv
- 2008-01-05 01:24:45 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-18 00:10:16 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-11-14 21:39:58 2,173 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_10.dat
+ 2007-11-14 21:42:12 2,339 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_112.dat
+ 2007-11-14 21:42:37 2,277 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_134.dat
+ 2007-11-14 21:42:42 2,677 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_148.dat
+ 2007-11-14 21:42:43 1,505 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_153.dat
+ 2007-11-14 21:42:44 2,274 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_154.dat
+ 2007-11-14 21:42:46 1,638 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_163.dat
+ 2007-11-14 21:42:47 1,532 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_166.dat
+ 2007-11-14 21:42:50 2,834 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_176.dat
+ 2007-11-22 13:45:11 3,068 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_187.dat
+ 2007-11-22 13:45:14 1,884 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_195.dat
+ 2007-11-14 21:41:22 2,869 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_21.dat
+ 2007-11-14 21:41:23 2,104 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_22.dat
+ 2007-11-14 21:41:43 3,000 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_25.dat
+ 2007-11-14 21:41:48 1,621 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_40.dat
+ 2007-11-14 21:41:49 2,523 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_43.dat
+ 2007-11-14 21:39:55 1,666 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_5.dat
+ 2007-11-14 21:41:53 2,335 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_57.dat
+ 2007-11-14 21:41:58 1,819 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_75.dat
+ 2007-11-14 21:42:00 2,314 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_79.dat
+ 2007-11-14 21:39:58 2,761 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_9.dat
- 2008-01-05 01:24:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-04-18 00:10:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-01-05 01:24:45 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-18 00:10:16 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2002-08-29 14:57:58 1,740 -c--a-w C:\WINDOWS\system32\Dcache.bin
+ 2002-08-29 06:32:34 2,816 -c--a-w C:\WINDOWS\system32\dllcache\drmkaud.sys
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system32\dllcache\keyboard.drv
+ 2001-09-26 00:01:20 2,560 -c--a-w C:\WINDOWS\system32\dllcache\lz32.dll
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system32\dllcache\mciavi.drv
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system32\dllcache\mciseq.drv
+ 2001-09-26 00:01:20 28,160 -c--a-w C:\WINDOWS\system32\dllcache\mciwave.drv
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system32\dllcache\mouse.drv
+ 2001-09-26 00:01:56 2,944 -c--a-w C:\WINDOWS\system32\dllcache\null.sys
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system32\dllcache\sound.drv
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system32\dllcache\system.drv
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system32\dllcache\timer.drv
+ 2001-09-26 00:02:48 2,176 -c--a-w C:\WINDOWS\system32\dllcache\vga.drv
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system32\dllcache\wfwnet.drv
+ 2001-09-26 00:03:10 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll
+ 2002-08-29 14:41:32 132,096 -c--a-w C:\WINDOWS\system32\dllcache\winspool.drv
+ 2001-09-26 00:03:10 2,112 -c--a-w C:\WINDOWS\system32\dllcache\winspool.exe
+ 2001-09-26 00:03:16 2,736 -c--a-w C:\WINDOWS\system32\dllcache\wowdeb.exe
- 2005-08-12 19:36:56 16,640 ----a-w C:\WINDOWS\system32\drivers\cpoint.sys
+ 2007-06-08 12:44:06 24,760 ----a-w C:\WINDOWS\system32\drivers\cpoint.sys
+ 2002-08-29 06:32:34 2,816 ----a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2001-09-26 00:01:56 2,944 ----a-w C:\WINDOWS\system32\drivers\null.sys
- 2006-02-22 08:43:34 71,552 ----a-r C:\WINDOWS\system32\drivers\pavdrv51.sys
+ 2007-06-06 14:43:32 83,640 ----a-w C:\WINDOWS\system32\drivers\pavdrv51.sys
- 2006-04-25 15:02:48 165,120 ----a-r C:\WINDOWS\system32\drivers\PavProc.sys
+ 2007-07-12 18:49:38 178,872 ----a-w C:\WINDOWS\system32\drivers\PavProc.sys
+ 2007-05-23 20:40:30 38,968 ----a-w C:\WINDOWS\system32\drivers\ShlDrv51.sys
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system32\keyboard.drv
+ 2001-09-26 00:01:18 221,600 -c--a-w C:\WINDOWS\system32\lanman.drv
- 2006-11-22 17:37:20 143,360 ----a-w C:\WINDOWS\system32\libexpat.dll
+ 2008-03-15 01:37:59 151,552 ----a-w C:\WINDOWS\system32\libexpat.dll
+ 2001-09-26 00:01:20 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
+ 2006-11-09 19:46:28 190,072 ----a-w C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system32\mciavi.drv
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system32\mciseq.drv
+ 2001-09-26 00:01:20 28,160 ----a-w C:\WINDOWS\system32\mciwave.drv
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system32\mouse.drv
+ 2001-09-26 00:01:34 20,480 ----a-w C:\WINDOWS\system32\msacm32.drv
+ 2002-08-29 14:41:32 184,320 ----a-w C:\WINDOWS\system32\msh261.drv
+ 2002-08-29 14:50:10 286,720 ----a-w C:\WINDOWS\system32\msh263.drv
- 2004-02-25 16:05:28 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
+ 2006-02-03 16:00:00 348,160 ----a-w C:\WINDOWS\system32\MSVCR71.DLL
+ 2001-09-26 00:01:50 2,656 -c--a-w C:\WINDOWS\system32\netware.drv
- 2007-12-11 01:38:47 52,996 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-13 20:30:16 52,996 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-12-11 01:38:47 380,966 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-13 20:30:16 380,966 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-10-17 07:33:10 2,048,000 ----a-w C:\WINDOWS\system32\python25.dll
- 2007-12-09 22:12:38 48,480 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-04-13 18:56:02 449,512 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system32\sound.drv
+ 2003-12-23 18:49:58 2,348 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\E_A4X2D1.DAT
+ 2006-04-03 09:00:00 2,981 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FAIFBIA.DAT
+ 2003-12-23 18:49:58 2,348 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_c845b4d\E_A4X2D1.DAT
+ 2006-04-03 09:00:00 2,981 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_cx60008c3e\E_FAIFBIA.DAT
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system32\system.drv
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system32\timer.drv
- 2006-07-05 10:46:36 205,696 ----a-w C:\WINDOWS\system32\vbamac32.dll
+ 2006-07-05 10:46:36 177,218 ----a-w C:\WINDOWS\system32\vbamac32.dll
+ 2001-09-26 00:02:48 2,176 -c--a-w C:\WINDOWS\system32\vga.drv
+ 2001-08-18 03:37:04 22,016 ----a-w C:\WINDOWS\system32\wdmaud.drv
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system32\wfwnet.drv
+ 2001-09-26 00:03:10 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
+ 2002-08-29 14:41:32 132,096 ----a-w C:\WINDOWS\system32\winspool.drv
+ 2001-09-26 00:03:10 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
+ 2001-09-26 00:03:16 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
- 2006-11-22 17:41:14 282,112 ----a-w C:\WINDOWS\system32\wxIE.dll
+ 2008-03-15 01:37:59 300,816 ----a-w C:\WINDOWS\system32\wxIE.dll
+ 2000-08-31 12:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2006-12-02 03:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-02 03:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 03:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 03:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 05:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 05:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 05:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 05:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 05:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
+ 2000-08-31 12:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{584C5668-9E23-4BC2-989D-2FCA1A07B3E3}]
C:\WINDOWS\System32\vtutu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B}]
C:\Program Files\QdrDrive\QdrDrive10.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E0E765A4-74A2-45BD-B1AF-AE07F2A174E7}]
C:\WINDOWS\System32\vturr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF7D8850-CA99-405C-987C-3380ADE566A7}]
C:\WINDOWS\System32\awvtr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 10:41 13312]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe" [2003-04-29 11:40 524288]
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" [ ]
"AdwareProMFC"="C:\Program Files\Ad-Ware Pro\Ad-Ware Pro.exe" [ ]
"Rndo"="C:\DOCUME~1\ADMINI~1\APPLIC~1\RACLE~1\javaw.exe" [ ]
"QdrModule15"="C:\Program Files\QdrModule\QdrModule15.exe" [ ]
"QdrPack15"="C:\Program Files\QdrPack\QdrPack15.exe" [ ]
"Smcse"="C:\WINDOWS\?racle\u?erinit.exe" [ ]
"Twain"="C:\Program Files\Twain\Twain.exe" [2008-04-15 19:15 57344]
"SpeedRunner"="C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe" [2008-04-15 19:20 181248]
"SfKg6wIP"="C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe" [2008-04-15 19:20 35328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-02-10 12:55 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-02-10 12:51 118784]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 106544 C:\WINDOWS\system32\TWEAKUI.CPL]
"EPSON Stylus C84 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 04:00 99840]
"EPSON Stylus C84 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 04:00 99840]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2003-12-01 12:38 892928]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 05:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07 49263]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-02-25 14:41:01 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Cmpaplib"= {CF7DC1AC-4560-46DC-A054-17CDF20F3692} - C:\WINDOWS\System32\bitamdel.dll [2006-07-05 06:46 843776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayyy]
efcayyy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ohjqxnbv]
ohjqxnbv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^xhxp.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\xhxp.exe
backup=C:\WINDOWS\pss\xhxp.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2002-08-29 10:41 13312 C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-06-01 16:51 257088 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-04-27 09:41 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsync]
C:\WINDOWS\System32\wiwyar.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R1 ewido security suite driver;ewido security suite driver;C:\Program Files\ewido anti-malware\guard.sys [2005-12-30 07:12]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\System32\Drivers\ShlDrv51.sys [2007-05-23 16:40]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\System32\DRIVERS\PavProc.sys [2007-07-12 14:49]
R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys [2008-04-17 20:12]
S3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\System32\PavSRK.sys []
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\System32\PavTPK.sys []
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\System32\Drivers\usbbc.sys [2001-01-07 21:53]

*Newly Created Service* - COMFILTR
.
Contents of the 'Scheduled Tasks' folder
"2008-03-06 03:23:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 20:11:10
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\System32\bitamdel.dll
-> C:\WINDOWS\System32\camohaut.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PAVSRV51.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrlS.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WEBPROXY.EXE
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-17 20:15:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-18 00:15:21
ComboFix2.txt 2008-01-05 01:28:56
Pre-Run: 19,702,435,840 bytes free
Post-Run: 20,227,022,848 bytes free
srg999999
Active Member
 
Posts: 1
Joined: April 17th, 2008, 9:57 pm
Advertisement
Register to Remove

Re: "Advertisement" pop up malware

Unread postby Shaba » April 21st, 2008, 8:29 am

Hi srg999999

Dan12 helps you here

So I close this thread as you are already getting help.
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 23 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware