Free Malware Removal Forum

by **chayienne** » August 21st, 2008, 10:06 am

Hi,
I would like to ask your kind assistance to resolve my problem with our desktop pc. Two weeks ago, I noticed that my internet browsing has slowed down. It wasn't caused by my internet connection because when I used a laptop, I could easily load any webpage. Every time I would load mozilla firefox or internet explorer at my desktop pc, the webpage would stall and take more than an hour to open. I could not open yahoo or google sites to search. Worse, if I managed to get into yahoo or google successfully, , a pop-up window would appear and direct me to hxxp://www.windowsscanner-freever.com. The Norton software has blocked the website from opening but it has not done so far to protect my pc from possible infection. The pop-up window still managed to appear everytime I would visit yahoo or google.

I downloaded the spybot and search software the other day and it managed to find some malware. I remembered that it detected virtumonde and killed several processes but it has completely slowed down my pc further. So I decided to uninstall it for the meantime and run Hijack This to have the log file checked. The problem didn't stop coming too, because when I tried to access the Norton website today, a window opened and tried to direct me to these websites: hxxp://www.software-traff.com and hxxp://www.scanner.vav-scan.com.. Talk about frustration being piled up!

I want to delete whatever is causing my pc to slow down and trigger all those pop-up windows. I have a strong feeling that there's a malware hiding in the background and my Norton Internet Security is completely helpless and useless. Detection is not enough - I need to have it removed.

Please, if someone has some time, kindly check the log below and advise me what to do. I'm getting desperate day by day. My last resort is to reformat my whole Pc.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:29:39 PM, on 8/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
O3 - Toolbar: (no name) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [983aa7f4] rundll32.exe "C:\WINDOWS\system32\updfxdtx.dll",b
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Remote Control.lnk = C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Apps\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Apps\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ethwkm.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\Hudson\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7156 bytes

by **Rodav** » August 21st, 2008, 6:54 pm

Hi and welcome,

I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research so please be patient while I work on your log and I will post back here with any recommendations. If you are having any problems with my instructions please stop and ask.

Step 1:
We will begin with ComboFix.exe, which can be downloaded from one of the following links.
Link 1
Link 2
Link 3

Please visit this webpage for instructions for running the tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
This is very important, if you do not know how to please refer to this topic:
http://www.bleepingcomputer.com/forums/topic114351.html
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt

Step 2:
Run HijackThis, do a system scan and in your next reply please post:

The ComboFix report (C:\ComboFix.txt)
The new HijackThis log

by **chayienne** » August 22nd, 2008, 10:29 am

Thank you very much for your prompt reply. I have downloaded combofix.exe. I encountered a problem trying to create the recovery disks. The floppy drive would not read my diskette. It keeps on saying that my disk is not formatted but when I clicked the format option, it would say that it is unable to format the diskette. I've used 6 brand new diskettes but still I haven't been successful in this part.

Is there a way we could create recovery disks without the use of a floppy drive? I don't have a copy of the Windows XP installer.

by **chayienne** » August 22nd, 2008, 10:51 am

I have another desktop pc at the office. The floppy drive seems to work. I will try to create the setup boot disks from there. Will give you feedback tomorrow.

by **Rodav** » August 22nd, 2008, 1:17 pm

Hi chayienne,

You won't need a floppy drive at all, you don't need to create any recovery disks. All you need to do is install the recovery console, which is a simple case of downloading a file and dragging onto combofix.exe. The following instructions should help you to do that, if you're having trouble let me know.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System, if you are unsure which one you have click Start, then right-click My Computer and select Properties. If you're still not sure let me know before downloading one.

Download the file & save it as it's originally named, next to ComboFix.exe.

Now close all open windows and programs, including all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
At the next prompt, click 'Yes' to run the full ComboFix scan.
When the tool is finished, it will produce a report for you.

Please post the C:\ComboFix.txt along with a new HijackThis log for further review.

by **chayienne** » August 23rd, 2008, 8:58 am

Hi,
Thank you for your reply. I did what you advised me to do except for one thing which I have forgotten to do. I'm so sorry I forgot to turn off my Norton software when I ran the combofix. Here's the log generated by combofix:

ComboFix 08-08-21.02 - Hudson 2008-08-23 13:28:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.487 [GMT 8:00]
Running from: C:\Documents and Settings\Hudson\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hudson\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Hudson\Application Data\inst.exe
C:\Documents and Settings\Hudson\Application Data\macromedia\Flash Player\#SharedObjects\MFMKRCT6\static.youku.com
C:\Documents and Settings\Hudson\Application Data\macromedia\Flash Player\#SharedObjects\MFMKRCT6\static.youku.com\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Hudson\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Hudson\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\WINDOWS\2.exe
C:\WINDOWS\BM9b099468.txt
C:\WINDOWS\BM9b099468.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\apuuukav.exe
C:\WINDOWS\system32\biafhxeu.dll
C:\WINDOWS\system32\bkaxhsrd.ini
C:\WINDOWS\system32\bqiqkjna.dll
C:\WINDOWS\system32\cbubcedh.exe
C:\WINDOWS\system32\cfxamncq.dll
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\cpqkcngu.dll
C:\WINDOWS\system32\cqmuspuc.dll
C:\WINDOWS\system32\dhjcws.dll
C:\WINDOWS\system32\dlkhottv.exe
C:\WINDOWS\system32\drmgs.sys
C:\WINDOWS\system32\eiynjjaw.dll
C:\WINDOWS\system32\ethwkm.dll
C:\WINDOWS\system32\fhebutdr.dll
C:\WINDOWS\system32\fllgrstl.exe
C:\WINDOWS\system32\fzxvbt.dll
C:\WINDOWS\system32\gcrciipj.ini
C:\WINDOWS\system32\gofcsyln.ini
C:\WINDOWS\system32\hfkssycp.exe
C:\WINDOWS\system32\huatncnq.dll
C:\WINDOWS\system32\hxjwgpme.dll
C:\WINDOWS\system32\iifeEXOI.dll
C:\WINDOWS\system32\iijspeoa.exe
C:\WINDOWS\system32\ikwxjamh.dll
C:\WINDOWS\system32\ilrctyjy.dll
C:\WINDOWS\system32\iqgrosdo.exe
C:\WINDOWS\system32\jvknjimx.ini
C:\WINDOWS\system32\khbsag.dll
C:\WINDOWS\system32\knvhptai.ini
C:\WINDOWS\system32\lfpwkl.dll
C:\WINDOWS\system32\lobdqdtq.exe
C:\WINDOWS\system32\lqbmgito.dll
C:\WINDOWS\system32\lrnxxkcs.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mcyudglu.dll
C:\WINDOWS\system32\mgwrakcf.dll
C:\WINDOWS\system32\mugnmn.dll
C:\WINDOWS\system32\mwckci.dll
C:\WINDOWS\system32\nbmrboaa.dll
C:\WINDOWS\system32\nhycxyyy.ini
C:\WINDOWS\system32\nmtykqhg.ini
C:\WINDOWS\system32\nohtxsws.exe
C:\WINDOWS\system32\nqxssith.dll
C:\WINDOWS\system32\nxgdmcca.dll
C:\WINDOWS\system32\pavcch.dll
C:\WINDOWS\system32\pcfbkxbs.dll
C:\WINDOWS\system32\qemhkkul.exe
C:\WINDOWS\system32\qmypkg.dll
C:\WINDOWS\system32\rcjnthio.ini
C:\WINDOWS\system32\RCMUvyay.ini
C:\WINDOWS\system32\RCMUvyay.ini2
C:\WINDOWS\system32\rdtubehf.ini
C:\WINDOWS\system32\rqzdwg.dll
C:\WINDOWS\system32\ruodsepo.dll
C:\WINDOWS\system32\rxkxbmft.ini
C:\WINDOWS\system32\sbxkbfcp.ini
C:\WINDOWS\system32\sgsinaph.ini
C:\WINDOWS\system32\slvwmpwc.ini
C:\WINDOWS\system32\tjeehrmo.exe
C:\WINDOWS\system32\tzwvrg.dll
C:\WINDOWS\system32\ubnnuwcb.dll
C:\WINDOWS\system32\ucrgnm.dll
C:\WINDOWS\system32\ujdbrsut.exe
C:\WINDOWS\system32\uufvfslp.ini
C:\WINDOWS\system32\vetjofed.dll
C:\WINDOWS\system32\vngjpqqf.exe
C:\WINDOWS\system32\wfgjbows.dll
C:\WINDOWS\system32\wnlssfal.dll
C:\WINDOWS\system32\wvcmynmn.exe
C:\WINDOWS\system32\xcxffrxl.exe
C:\WINDOWS\system32\xpdjalwk.exe
C:\WINDOWS\system32\xqypys.dll
C:\WINDOWS\system32\xtdxfdpu.ini
C:\WINDOWS\system32\xvjobylf.dll
C:\WINDOWS\system32\yayvUMCR.dll
C:\WINDOWS\system32\yrcacasr.dll

----- BITS: Possible infected sites -----

http://www.drivesentry.com
.
((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-22 22:28 . 2008-08-22 22:29 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-08-20 21:10 . 2008-08-20 21:10 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-20 20:56 . 2006-03-14 20:05 380,928 -ra------ C:\WINDOWS\system32\pSOAP32.dll
2008-08-20 20:56 . 2006-03-14 20:05 188,416 -ra------ C:\WINDOWS\system32\pocketHTTP.dll
2008-08-20 20:56 . 2006-03-14 20:05 110,676 -ra------ C:\WINDOWS\system32\psDime.dll
2008-08-20 20:56 . 2006-03-14 20:05 73,728 -ra------ C:\WINDOWS\system32\psProxy.dll
2008-08-20 19:27 . 2008-08-20 19:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-18 23:15 . 2008-08-18 23:15 149 --a------ C:\WINDOWS\wininit.ini
2008-08-18 22:39 . 2008-08-19 19:55 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 22:39 . 2008-08-19 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-18 22:22 . 2008-08-18 22:22 <DIR> d-------- C:\Program Files\Safer Networking
2008-08-18 13:29 . 2008-08-18 13:29 <DIR> d-------- C:\Program Files\IsoBuster
2008-08-18 13:29 . 2008-08-18 13:29 <DIR> d-------- C:\Program Files\Conduit
2008-08-11 13:06 . 2008-07-30 22:58 32,768 --a------ C:\Program Files\bcd_installed.exe
2008-08-10 06:28 . 2008-08-10 06:28 79,572 --a------ C:\WINDOWS\system32\ganaqbag.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 05:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-15 14:54 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 11:25 --------- d-----w C:\Documents and Settings\Hudson\Application Data\Vso
2008-08-13 00:35 --------- d-----w C:\Documents and Settings\Hudson\Application Data\AdobeUM
2008-08-11 12:39 --------- d-----w C:\Program Files\NextPoker
2008-08-05 00:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-03 14:33 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-01 18:55 --------- d-----w C:\Documents and Settings\Hudson\Application Data\Skype
2008-07-30 09:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 09:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 09:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-25 13:59 --------- d-----w C:\Documents and Settings\Hudson\Application Data\Corel
2008-07-24 12:26 --------- d-----w C:\Documents and Settings\Hudson\Application Data\dBpoweramp
2008-07-24 12:22 --------- d-----w C:\Documents and Settings\Hudson\Application Data\AccurateRip
2008-07-22 15:23 --------- d-----w C:\Program Files\Illustrate
2008-07-18 05:10 --------- d-----w C:\Program Files\colorMiraball
2008-07-10 14:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\vsosdk
2008-07-03 12:30 --------- d-----w C:\Program Files\Xvid
2008-07-02 12:51 --------- d-----w C:\Program Files\GametimePlus
2008-07-02 12:48 --------- d-----w C:\Program Files\SQLite ODBC Driver
2008-06-30 12:30 --------- d-----w C:\Program Files\Skype
2008-06-30 12:30 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-28 13:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
2008-06-25 13:40 --------- d-----w C:\Program Files\Sony Ericsson
2008-06-25 13:40 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-06-25 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2008-06-25 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-06-20 05:16 47,360 ----a-w C:\Documents and Settings\Hudson\Application Data\pcouffin.sys
2008-06-18 14:44 5,986 ----a-w C:\Program Files\ST6UNST.LOG
2008-06-18 14:42 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-18 14:42 307,200 ------w C:\WINDOWS\Setup1.exe
2008-06-03 13:30 4,755 ----a-w C:\unins000.dat
2007-10-07 14:46 88 --sh--r C:\WINDOWS\system32\A4D6CF5998.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-17 10:04 139264]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:56 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 00:24 1694208]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 17:59 2289664]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-03-22 10:50 8425472]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-25 17:47 51048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-08 09:35 1294336]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-03 05:00:41 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Remote Control.lnk - C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe [2007-10-03 05:04:21 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= DivXa32.acm
"vidc.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\program files\\bcd_installed.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15884:TCP"= 15884:TCP:BitComet 15884 TCP
"15884:UDP"= 15884:UDP:BitComet 15884 UDP
"12862:TCP"= 12862:TCP:BitComet 12862 TCP
"12862:UDP"= 12862:UDP:BitComet 12862 UDP

R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-25 17:47]
R3 Cap713x;Philips Cap713x Video Capture;C:\WINDOWS\system32\DRIVERS\Cap713x.sys [2005-05-04 16:32]
S2 RoxLiveShare10;LiveShare P2P Server 10;C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe []
S2 SessionLauncher;SessionLauncher;C:\DOCUME~1\Hudson\LOCALS~1\Temp\DX9\SessionLauncher.exe []
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2006-07-06 06:35]

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-08-18 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Hudson.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - (no file)
Toolbar-{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - (no file)
WebBrowser-{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} - (no file)
HKCU-Run-SRS Audio Sandbox - C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe
HKLM-Run-983aa7f4 - C:\WINDOWS\system32\fhebutdr.dll
HKLM-Run-BM9b099468 - C:\WINDOWS\system32\cpqkcngu.dll

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Hudson\Application Data\Mozilla\Firefox\Profiles\t8od1km2.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.yahoo.com
FF -: plugin - C:\Apps\plugins\np_gp.dll
FF -: plugin - C:\Apps\plugins\npnul32.dll
FF -: plugin - C:\Apps\plugins\nppdf32.dll
FF -: plugin - C:\Apps\plugins\npqtplugin.dll
FF -: plugin - C:\Apps\plugins\npqtplugin2.dll
FF -: plugin - C:\Apps\plugins\npqtplugin3.dll
FF -: plugin - C:\Apps\plugins\npqtplugin4.dll
FF -: plugin - C:\Apps\plugins\npqtplugin5.dll
FF -: plugin - C:\Apps\plugins\npqtplugin6.dll
FF -: plugin - C:\Apps\plugins\npqtplugin7.dll
FF -: plugin - C:\Apps\plugins\NPSWF32.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 13:39:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\stacsv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\SoftwareDistribution\Download\69b4634e26426212182d03d1e1c76c7b\update\update.exe
.
**************************************************************************
.
Completion time: 2008-08-23 13:44:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-23 05:44:03

Pre-Run: 137,452,351,488 bytes free
Post-Run: 137,396,424,704 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

277 --- E O F --- 2008-07-09 19:01:33

**************************************************************************************
Here's the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:45:38 PM, on 8/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\BitComet\BitComet.exe
C:\Apps\firefox.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Remote Control.lnk = C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Apps\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Apps\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\Hudson\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8166 bytes

by **Rodav** » August 23rd, 2008, 1:31 pm

Hi chayienne,

With reference to Malware Removal's P2P Programs Policy, please uninstall the following programs before we continue:

Click on Start > Control Panel and double click on Add/Remove Programs.
Locate BitComet and click on the Change/Remove button to uninstall it.
Close Add/Remove Programs and Control Panel when done.

Open HijackThis.
Click on the Open the Misc Tools section button.
Look under System tools.
Click on the Open Uninstall Manager... button.
Click on the Save list... button.
It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
Notepad will open. Please post this log in your next reply.

by **chayienne** » August 23rd, 2008, 9:12 pm

Here's the uninstall list, thanks:
-----------------------------
Adobe Flash Player ActiveX
Adobe Photoshop 7.0
Adobe Reader 7.0.9
Adobe Reader Chinese Simplified Fonts
Allok Video to MP4 Converter 4.2.0608
AppCore
ccCommon
Color LaserJet 1600
ColorMiraBall
Component Framework
ConvertXtoDVD 3.1.0.25
Corel Paint Shop Pro Photo XI
CorelDRAW Graphics Suite 12
COWON Media Center - jetAudio Basic
dBpoweramp DSP Effects
dBpoweramp Music Converter
DefilerPak 1.19 (Remove Only)
DirectXInstallService
FW LiveUpdate
GametimePlus
getPlus(R)_dll
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Intel(R) PRO Network Connections
IsoBuster 2.4
IsoBuster Toolbar
Java(TM) 6 Update 3
Java(TM) 6 Update 5
KWorld PVR-TV 7131 WDM Drivers
KWorld PVR-TV 7131/5 Utilities
LightScribe System Software 1.12.37.1
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.1)
MP4 Converter 3
MSVC80_x86
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Nero 7 Essentials
NextPoker (remove only)
Nokia Connectivity Cable Driver
Nokia PC Suite
Nokia PC Suite
Norton AntiVirus
Norton AntiVirus Help
Norton Confidential Core
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
NVIDIA Drivers
PC Connectivity Solution
Poker Tracker Version 2.13.01a
QuickTime
Roxio Activation Module
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
SigmaTel Audio
Skype 3.0
Skype Plugin Manager
SmartSound Quicktracks Plugin
Sony Ericsson PC Suite
SPBBC 32bit
SQLite ODBC Driver (remove only)
Symantec Real Time Storage Protection Component
Ulead PhotoImpact 12
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Ventrilo Client
Win AVI HelixSDK
Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2)
Windows Driver Package - Nokia Modem (10/12/2007 3.6)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
X264 H.264/AVC Video Codec (remove only)
Xvid 1.1.3 final uninstall
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar

by **Rodav** » August 24th, 2008, 10:22 am

Hi,

Step 1:
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Program Files\bcd_installed.exe
C:\WINDOWS\system32\ganaqbag.dll

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:0000000

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\BitComet\\BitComet.exe"=-
"c:\\program files\\bcd_installed.exe"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15884:TCP"=-
"15884:UDP"=-
"12862:TCP"=-
"12862:UDP"=-

DirLook::
C:\Program Files\NextPoker

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Step 2:
Please visit http://virusscan.jotti.org/

Copy/paste this file and path into the white box at the top:

C:\WINDOWS\system32\A4D6CF5998.sys

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

If Jotti is busy you could try the same at Virustotal.

Step 3:
Run HijackThis, do a system scan and in your next reply please post:

The ComboFix report (C:\ComboFix.txt)
The jotti/virustotal results
The new HijackThis log

by **chayienne** » August 24th, 2008, 12:29 pm

Hello,

I've accomplished all the tasks you've asked me to do.

**-----------------------**
Here's the combofix log:
**-----------------------**
ComboFix 08-08-23.03 - Hudson 2008-08-24 23:57:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.600 [GMT 8:00]
Running from: C:\Documents and Settings\Hudson\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hudson\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\bcd_installed.exe
C:\WINDOWS\system32\ganaqbag.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\bcd_installed.exe
C:\WINDOWS\system32\ganaqbag.dll

.
((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 )))))))))))))))))))))))))))))))
.

2008-08-22 22:28 . 2008-08-22 22:29 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-08-20 21:10 . 2008-08-20 21:10 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-20 20:56 . 2006-03-14 20:05 380,928 -ra------ C:\WINDOWS\system32\pSOAP32.dll
2008-08-20 20:56 . 2006-03-14 20:05 188,416 -ra------ C:\WINDOWS\system32\pocketHTTP.dll
2008-08-20 20:56 . 2006-03-14 20:05 110,676 -ra------ C:\WINDOWS\system32\psDime.dll
2008-08-20 20:56 . 2006-03-14 20:05 73,728 -ra------ C:\WINDOWS\system32\psProxy.dll
2008-08-20 19:27 . 2008-08-20 19:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-18 23:15 . 2008-08-18 23:15 149 --a------ C:\WINDOWS\wininit.ini
2008-08-18 22:39 . 2008-08-19 19:55 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 22:39 . 2008-08-19 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-18 22:22 . 2008-08-18 22:22 <DIR> d-------- C:\Program Files\Safer Networking
2008-08-18 13:29 . 2008-08-18 13:29 <DIR> d-------- C:\Program Files\IsoBuster
2008-08-18 13:29 . 2008-08-18 13:29 <DIR> d-------- C:\Program Files\Conduit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 15:09 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-24 01:07 --------- d-----w C:\Program Files\BitComet
2008-08-24 00:29 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-24 00:29 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-24 00:29 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-24 00:29 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-24 00:29 --------- d-----w C:\Program Files\Symantec
2008-08-15 14:54 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 11:25 --------- d-----w C:\Documents and Settings\Hudson\Application Data\Vso
2008-08-13 00:35 --------- d-----w C:\Documents and Settings\Hudson\Application Data\AdobeUM
2008-08-11 12:39 --------- d-----w C:\Program Files\NextPoker
2008-08-05 00:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-03 14:33 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-01 18:55 --------- d-----w C:\Documents and Settings\Hudson\Application Data\Skype
2008-07-30 09:42 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 09:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 09:28 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-25 13:59 --------- d-----w C:\Documents and Settings\Hudson\Application Data\Corel
2008-07-25 13:55 2,828 ----a-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-24 12:26 --------- d-----w C:\Documents and Settings\Hudson\Application Data\dBpoweramp
2008-07-24 12:22 --------- d-----w C:\Documents and Settings\Hudson\Application Data\AccurateRip
2008-07-22 15:28 2,857,336 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2008-07-22 15:23 --------- d-----w C:\Program Files\Illustrate
2008-07-18 05:10 --------- d-----w C:\Program Files\colorMiraball
2008-07-10 14:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\vsosdk
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-03 12:30 --------- d-----w C:\Program Files\Xvid
2008-07-02 12:51 --------- d-----w C:\Program Files\GametimePlus
2008-07-02 12:48 --------- d-----w C:\Program Files\SQLite ODBC Driver
2008-06-30 12:30 --------- d-----w C:\Program Files\Skype
2008-06-30 12:30 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-28 13:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
2008-06-25 13:40 --------- d-----w C:\Program Files\Sony Ericsson
2008-06-25 13:40 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-06-25 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2008-06-25 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 05:16 47,360 ----a-w C:\Documents and Settings\Hudson\Application Data\pcouffin.sys
2008-06-18 14:44 5,986 ----a-w C:\Program Files\ST6UNST.LOG
2008-06-18 14:42 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-18 14:42 307,200 ------w C:\WINDOWS\Setup1.exe
2008-06-13 06:45 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 06:45 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
2008-06-03 13:30 4,755 ----a-w C:\unins000.dat
2007-10-07 14:46 88 --sh--r C:\WINDOWS\system32\A4D6CF5998.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Program Files\NextPoker ----

2008-08-21 21:03 758 --a------ C:\Program Files\NextPoker\Resources\Pigs\SpecialProgramSettings.pig
2008-08-21 21:03 29255 --a------ C:\Program Files\NextPoker\WPCLog.txt
2008-08-21 21:03 2040 --a------ C:\Program Files\NextPoker\Resources\Pigs\User17447525.pig
2008-08-21 21:02 57028 --a------ C:\Program Files\NextPoker\tmpfile
2008-08-21 21:02 0 --a------ C:\Program Files\NextPoker\patch.lck
2008-08-21 21:01 0 --a------ C:\Program Files\NextPoker\prepatch.lck
2008-08-11 00:09 103162 --a------ C:\Program Files\NextPoker\oldWPCLog1.txt
2008-08-06 01:33 123938 --a------ C:\Program Files\NextPoker\oldWPCLog2.txt
2008-08-06 01:30 12796928 --a------ C:\Program Files\NextPoker\Resources\Databases\User17447525Statistics.db
2008-08-05 13:13 104324 --a------ C:\Program Files\NextPoker\oldWPCLog3.txt
2008-08-03 10:56 144164 --a------ C:\Program Files\NextPoker\oldWPCLog4.txt
2008-08-02 13:36 104487 --a------ C:\Program Files\NextPoker\oldWPCLog5.txt
2008-07-10 19:28 867 --a------ C:\Program Files\NextPoker\UpdateNextPoker.exe.manifest
2008-07-10 19:28 589 --a------ C:\Program Files\NextPoker\StartNextPoker.exe.manifest
2008-07-10 19:28 30598 --a------ C:\Program Files\NextPoker\Resources\Pigs\PlayerGraphics.pig
2008-07-10 19:28 200812 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\greek\DefaultLanguage.pig
2008-07-10 19:28 192990 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\French\DefaultLanguage.pig
2008-07-10 19:28 192734 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\German\DefaultLanguage.pig
2008-07-10 19:28 191458 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Italian\DefaultLanguage.pig
2008-07-10 19:28 190366 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\spanish\DefaultLanguage.pig
2008-07-10 19:28 185620 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Polish\DefaultLanguage.pig
2008-07-10 19:28 184308 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Russian\DefaultLanguage.pig
2008-07-10 19:28 183990 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\portuguese\DefaultLanguage.pig
2008-07-10 19:28 183896 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Turkish\DefaultLanguage.pig
2008-07-10 19:28 183588 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Hungarian\DefaultLanguage.pig
2008-07-10 19:28 182154 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Finnish\DefaultLanguage.pig
2008-07-10 19:28 181976 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Dutch\DefaultLanguage.pig
2008-07-10 19:28 181058 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\swedish\DefaultLanguage.pig
2008-07-10 19:28 180356 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\english\DefaultLanguage.pig
2008-07-10 19:28 179420 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Danish\DefaultLanguage.pig
2008-07-10 19:28 175152 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Slovak\DefaultLanguage.pig
2008-07-10 19:28 174324 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Norwegian\DefaultLanguage.pig
2008-07-10 19:27 7098368 --a------ C:\Program Files\NextPoker\NextPoker.exe
2008-07-10 19:27 4326 --a------ C:\Program Files\NextPoker\Resources\Pigs\DefaultProgramSettings.pig
2008-07-10 19:27 29270 --a------ C:\Program Files\NextPoker\Resources\Pigs\GameDialogs.pig
2008-07-10 19:27 25333 --a------ C:\Program Files\NextPoker\Resources\Pigs\GameDialogsMini.pig
2008-07-10 19:27 236984 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Add-Chips-Dialog-Bkg.tga
2008-07-10 19:27 18410 --a------ C:\Program Files\NextPoker\Resources\Pigs\Game.pig
2008-07-10 19:27 174492 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Czech\DefaultLanguage.pig
2008-07-10 19:27 15066 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Add-Max-Button.tga
2008-07-10 19:27 12605 --a------ C:\Program Files\NextPoker\Resources\Pigs\GameMini.pig
2008-07-10 19:27 120886 --a------ C:\Program Files\NextPoker\Resources\Pigs\Languages\Chinese\DefaultLanguage.pig
2008-07-10 19:27 1166 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\GameDialogs.pig
2008-07-10 19:26 61440 --a------ C:\Program Files\NextPoker\browser.exe
2008-07-10 19:26 606208 --a------ C:\Program Files\NextPoker\UpdateNextPoker.exe
2008-05-28 19:08 913408 --a------ C:\Program Files\NextPoker\Stats.dll
2008-05-28 19:08 57344 --a------ C:\Program Files\NextPoker\SearchPlayer.dll
2008-05-28 19:08 294912 --a------ C:\Program Files\NextPoker\ServerConnection.dll
2008-05-28 19:08 225280 --a------ C:\Program Files\NextPoker\SpriteWindow.dll
2008-05-28 19:07 6750 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Slider-Background.tga
2008-05-28 19:07 503808 --a------ C:\Program Files\NextPoker\Protocol.dll
2008-05-28 19:07 3477504 --a------ C:\Program Files\NextPoker\Lobby.dll
2008-05-28 19:07 331776 --a------ C:\Program Files\NextPoker\ResourceManager.dll
2008-05-28 19:07 2042 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Slider-Button.tga
2008-05-28 19:07 17802 --a------ C:\Program Files\NextPoker\Resources\Graphics\BetAdviceBtn03.tga
2008-05-28 19:07 17802 --a------ C:\Program Files\NextPoker\Resources\Graphics\BetAdviceBtn01.tga
2008-05-28 19:07 17490 --a------ C:\Program Files\NextPoker\Resources\Graphics\BetAdviceBtn02.tga
2008-05-28 19:07 147456 --a------ C:\Program Files\NextPoker\PlayerNotes.dll
2008-05-28 19:07 11770 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Slider-Background.tga
2008-05-28 19:07 11250 --a------ C:\Program Files\NextPoker\Resources\Graphics\BetAdviceBtnMini01.tga
2008-05-28 19:07 10962 --a------ C:\Program Files\NextPoker\Resources\Graphics\BetAdviceBtnMini02.tga
2008-05-28 19:06 966656 --a------ C:\Program Files\NextPoker\Generic.dll
2008-05-28 19:06 921600 --a------ C:\Program Files\NextPoker\Eventer.dll
2008-05-28 19:06 847872 --a------ C:\Program Files\NextPoker\Gui.dll
2008-05-28 19:06 397312 --a------ C:\Program Files\NextPoker\Framework.dll
2008-05-28 19:06 2494464 --a------ C:\Program Files\NextPoker\Game.dll
2008-05-28 19:06 110592 --a------ C:\Program Files\NextPoker\GlobalSettings.dll
2008-05-28 19:05 86016 --a------ C:\Program Files\NextPoker\DBAccess.dll
2008-05-24 13:27 69689 --a------ C:\Program Files\NextPoker\Uninstall.exe
2008-05-23 20:46 200 --a------ C:\Program Files\NextPoker\Resources\PlayerNotes.irf
2008-05-20 19:13 5798 --a------ C:\Program Files\NextPoker\Resources\Pigs\LobbyMenu.pig
2008-05-20 19:13 13086 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Icon-Custom-Link1.tga
2008-05-20 19:13 1282 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Links.pig
2008-05-03 22:57 348496 --a------ C:\Program Files\NextPoker\sqlite3.exe
2008-05-03 22:57 333043 --a------ C:\Program Files\NextPoker\sqlite3.dll
2008-05-03 22:57 258352 --a------ C:\Program Files\NextPoker\unicows.dll
2008-05-03 22:56 986 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Lobby.pig
2008-05-03 22:56 9831 --a------ C:\Program Files\NextPoker\Resources\Pigs\BasicTexasStats.pig
2008-05-03 22:56 9763 --a------ C:\Program Files\NextPoker\Resources\Pigs\SettingsWindow.pig
2008-05-03 22:56 8889 --a------ C:\Program Files\NextPoker\Resources\Pigs\GameMenuMini.pig
2008-05-03 22:56 8780 --a------ C:\Program Files\NextPoker\Resources\Pigs\QuickSeatLobby.pig
2008-05-03 22:56 8549 --a------ C:\Program Files\NextPoker\Resources\Pigs\CreateTable.pig
2008-05-03 22:56 7716 --a------ C:\Program Files\NextPoker\Resources\Sounds\deal_card.wav
2008-05-03 22:56 760 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\GameMenuMini.pig
2008-05-03 22:56 749 --a------ C:\Program Files\NextPoker\Resources\Pigs\Links.pig
2008-05-03 22:56 68396 --a------ C:\Program Files\NextPoker\Resources\Sounds\shuffle_deck.wav
2008-05-03 22:56 658 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\SettingsWindow.pig
2008-05-03 22:56 650 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\CreateNewDatabase.pig
2008-05-03 22:56 6260 --a------ C:\Program Files\NextPoker\Resources\Pigs\Login.pig
2008-05-03 22:56 6176 --a------ C:\Program Files\NextPoker\Resources\Sounds\fold.wav
2008-05-03 22:56 61 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\ServerSettings.pig
2008-05-03 22:56 602 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\CreatePrivateTournaments.pig
2008-05-03 22:56 5945 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfirmRegistration.pig
2008-05-03 22:56 5629 --a------ C:\Program Files\NextPoker\Resources\Pigs\Moderator.pig
2008-05-03 22:56 550 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\GameMini.pig
2008-05-03 22:56 5314 --a------ C:\Program Files\NextPoker\Resources\Sounds\your_turn.wav
2008-05-03 22:56 52 --a------ C:\Program Files\NextPoker\Resources\Pigs\CRMPopup.pig
2008-05-03 22:56 5157 --a------ C:\Program Files\NextPoker\Resources\Pigs\PlayerNotes.pig
2008-05-03 22:56 487 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\QuickSeatLobby.pig
2008-05-03 22:56 4844 --a------ C:\Program Files\NextPoker\Resources\Sounds\check.wav
2008-05-03 22:56 484 --a------ C:\Program Files\NextPoker\Resources\Pigs\ServerSettings.pig
2008-05-03 22:56 4616 --a------ C:\Program Files\NextPoker\Resources\Pigs\Popup.pig
2008-05-03 22:56 457 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\RingGameLobby.pig
2008-05-03 22:56 4108 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\TournamentLobby.pig
2008-05-03 22:56 4 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Stats.pig
2008-05-03 22:56 39176 --a------ C:\Program Files\NextPoker\Resources\Sounds\slide_chips.wav
2008-05-03 22:56 3739 --a------ C:\Program Files\NextPoker\Resources\Pigs\Fonts.pig
2008-05-03 22:56 322 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Moderator.pig
2008-05-03 22:56 32128 --a------ C:\Program Files\NextPoker\Resources\Pigs\PlayerGraphicsMini.pig
2008-05-03 22:56 31843 --a------ C:\Program Files\NextPoker\Resources\Pigs\Stats.pig
2008-05-03 22:56 3090 --a------ C:\Program Files\NextPoker\Resources\Pigs\Theme.pig
2008-05-03 22:56 30662 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\PlayerGraphics.pig
2008-05-03 22:56 302 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\PlayerGraphicsMini.pig
2008-05-03 22:56 2973 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\GameMenu.pig
2008-05-03 22:56 28996 --a------ C:\Program Files\NextPoker\Resources\Sounds\wake_up.wav
2008-05-03 22:56 26938 --a------ C:\Program Files\NextPoker\Resources\Pigs\TournamentLobby.pig
2008-05-03 22:56 2682 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\ConfirmRegistration.pig
2008-05-03 22:56 26650 --a------ C:\Program Files\NextPoker\Resources\Sounds\raise.wav
2008-05-03 22:56 254864 --a------ C:\Program Files\NextPoker\sqlite.exe
2008-05-03 22:56 2281 --a------ C:\Program Files\NextPoker\Resources\Pigs\CreateNewDatabase.pig
2008-05-03 22:56 222 --a------ C:\Program Files\NextPoker\Resources\Pigs\Databases.pig
2008-05-03 22:56 2199 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Game.pig
2008-05-03 22:56 2046 --a------ C:\Program Files\NextPoker\Resources\Pigs\DefaultGraphicsMini.pig
2008-05-03 22:56 2020 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\DefaultGraphics.pig
2008-05-03 22:56 17201 --a------ C:\Program Files\NextPoker\Resources\Pigs\GameMenu.pig
2008-05-03 22:56 166898 --a------ C:\Program Files\NextPoker\Resources\Sounds\win_pot.wav
2008-05-03 22:56 16486 --a------ C:\Program Files\NextPoker\Resources\Pigs\CreatePrivateTournaments.pig
2008-05-03 22:56 16152 --a------ C:\Program Files\NextPoker\Resources\Pigs\Lobby.pig
2008-05-03 22:56 1529 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Login.pig
2008-05-03 22:56 152 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\TournamentStats.pig
2008-05-03 22:56 1484 --a------ C:\Program Files\NextPoker\Resources\Pigs\DefaultSounds.pig
2008-05-03 22:56 147 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\CreateTable.pig
2008-05-03 22:56 14148 --a------ C:\Program Files\NextPoker\Resources\Sounds\bet.wav
2008-05-03 22:56 14053 --a------ C:\Program Files\NextPoker\Resources\Pigs\TournamentStats.pig
2008-05-03 22:56 14032 --a------ C:\Program Files\NextPoker\Resources\Pigs\DefaultGraphics.pig
2008-05-03 22:56 13201 --a------ C:\Program Files\NextPoker\Resources\Pigs\RingGameLobby.pig
2008-05-03 22:56 12612 --a------ C:\Program Files\NextPoker\Resources\Sounds\click.wav
2008-05-03 22:56 11841 --a------ C:\Program Files\NextPoker\Resources\Pigs\HandBrowser.pig
2008-05-03 22:56 1158 --a------ C:\Program Files\NextPoker\Resources\Pigs\ProgressWindow.pig
2008-05-03 22:56 115 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\PlayerNotes.pig
2008-05-03 22:56 1124 --a------ C:\Program Files\NextPoker\Resources\Pigs\DefaultUserSettings.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Theme.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\ProgressWindow.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Popup.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\LobbyMenu.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\HandBrowser.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\GameDialogsMini.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Fonts.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\DefaultUserSettings.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\DefaultSounds.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\DefaultProgramSettings.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\DefaultLanguage.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\DefaultGraphicsMini.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\Databases.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\CRMPopup.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\BasicTexasStats.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\BasicSevenCardStats.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\BasicOmahaStats.pig
2008-05-03 22:56 0 --a------ C:\Program Files\NextPoker\Resources\Pigs\ConfigurationSpecific\About.pig
2008-05-03 22:55 9715 --a------ C:\Program Files\NextPoker\Resources\Pigs\BasicOmahaStats.pig
2008-05-03 22:55 944 --a------ C:\Program Files\NextPoker\Resources\Graphics\Panel_1px_transp.tga
2008-05-03 22:55 93618 --a------ C:\Program Files\NextPoker\Resources\Graphics\QuickSeat-list.bkg.tga
2008-05-03 22:55 8780 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Image-AllInProb.tga
2008-05-03 22:55 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Vip-star-Icon.tga
2008-05-03 22:55 77810 --a------ C:\Program Files\NextPoker\Resources\Graphics\TournamentStats-List-Background.tga
2008-05-03 22:55 76484 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Timer.tga
2008-05-03 22:55 720 --a------ C:\Program Files\NextPoker\Resources\Graphics\Vip-star-Icon-Red.tga
2008-05-03 22:55 720 --a------ C:\Program Files\NextPoker\Resources\Graphics\Vip-star-Icon-Green.tga
2008-05-03 22:55 61494 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Undocked-Stat-Background.bmp
2008-05-03 22:55 6128 --a------ C:\Program Files\NextPoker\Resources\Graphics\Panel_2px_r12.tga
2008-05-03 22:55 5826 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Cards-Hidden-Big.tga
2008-05-03 22:55 5720 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Cards-Selected.tga
2008-05-03 22:55 5720 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Cards-Selectable.tga
2008-05-03 22:55 570054 --a------ C:\Program Files\NextPoker\Resources\Graphics\TournamentStats-Bkg.bmp
2008-05-03 22:55 53248 --a------ C:\Program Files\NextPoker\Resources\msimg32.tmp
2008-05-03 22:55 528 --a------ C:\Program Files\NextPoker\Resources\Graphics\Ticket11.tga
2008-05-03 22:55 528 --a------ C:\Program Files\NextPoker\Resources\Graphics\NoTicket11.tga
2008-05-03 22:55 515564 --a------ C:\Program Files\NextPoker\Resources\Graphics\Progress-Anim.tga
2008-05-03 22:55 5012 --a------ C:\Program Files\NextPoker\Resources\Graphics\Tab-Button-Settings.tga
2008-05-03 22:55 4986 --a------ C:\Program Files\NextPoker\Resources\Graphics\Tab-Button-Lobby-Upper.tga
2008-05-03 22:55 4748 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Size-Button.tga
2008-05-03 22:55 474570 --a------ C:\Program Files\NextPoker\Resources\Graphics\StatWindow-Bkg.bmp
2008-05-03 22:55 46378 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Table-Logo.tga
2008-05-03 22:55 4338 --a------ C:\Program Files\NextPoker\Resources\Graphics\Tab-Button-Lobby-Lower.tga
2008-05-03 22:55 431934 --a------ C:\Program Files\NextPoker\Resources\Graphics\Settings-Window-Bkg.bmp
2008-05-03 22:55 4268 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Chips.tga
2008-05-03 22:55 416262 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Table.bmp
2008-05-03 22:55 396 --a------ C:\Program Files\NextPoker\Resources\Graphics\RedLock11.tga
2008-05-03 22:55 396 --a------ C:\Program Files\NextPoker\Resources\Graphics\RedFlash11.tga
2008-05-03 22:55 390870 --a------ C:\Program Files\NextPoker\Resources\Graphics\Moderator-bkg.bmp
2008-05-03 22:55 3862 --a------ C:\Program Files\NextPoker\Resources\Graphics\QuickSeat-number-03.tga
2008-05-03 22:55 3862 --a------ C:\Program Files\NextPoker\Resources\Graphics\QuickSeat-number-02.tga
2008-05-03 22:55 3862 --a------ C:\Program Files\NextPoker\Resources\Graphics\QuickSeat-number-01.tga
2008-05-03 22:55 3640 --a------ C:\Program Files\NextPoker\Resources\Graphics\Vip-star-Table.tga
2008-05-03 22:55 354450 --a------ C:\Program Files\NextPoker\Resources\Graphics\StatWindow-List-Bkg.tga
2008-05-03 22:55 332214 --a------ C:\Program Files\NextPoker\Resources\Graphics\PlayerNotes-Background.bmp
2008-05-03 22:55 295196 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Cards-Normal.tga
2008-05-03 22:55 295196 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Cards-BigSymbol.tga
2008-05-03 22:55 269054 --a------ C:\Program Files\NextPoker\Resources\Graphics\Setting-Tab-Background.bmp
2008-05-03 22:55 264044 --a------ C:\Program Files\NextPoker\Resources\Graphics\PlayerNotes-Edit-Background.tga
2008-05-03 22:55 252222 --a------ C:\Program Files\NextPoker\Resources\Graphics\SplashScreen.bmp
2008-05-03 22:55 230454 --a------ C:\Program Files\NextPoker\Resources\Graphics\Progress-Bkg.bmp
2008-05-03 22:55 227894 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Undocked-Chat-Background.bmp
2008-05-03 22:55 210 --a------ C:\Program Files\NextPoker\Resources\Graphics\Scrollbar-Background.bmp
2008-05-03 22:55 193218 --a------ C:\Program Files\NextPoker\Resources\Graphics\Ring-Game-Chat-bkg.tga
2008-05-03 22:55 1810 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Scrollbar-Page.tga
2008-05-03 22:55 17100 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Plate-AwaySign.tga
2008-05-03 22:55 160098 --a------ C:\Program Files\NextPoker\Resources\Graphics\Tournament-Chat-Bkg.tga
2008-05-03 22:55 148690 --a------ C:\Program Files\NextPoker\Resources\Graphics\Tour-Description-Bkg.tga
2008-05-03 22:55 1440 --a------ C:\Program Files\NextPoker\Resources\Pigs\About.pig
2008-05-03 22:55 14274 --a------ C:\Program Files\NextPoker\Resources\Graphics\PlayerNotes-Classification-Desc-Button.tga
2008-05-03 22:55 1340 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Hand-Evaluation-Bkg.tga
2008-05-03 22:55 1336854 --a------ C:\Program Files\NextPoker\Resources\Graphics\QuickSeat-lobby-bkg.bmp
2008-05-03 22:55 117678 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-MenuBackground.bmp
2008-05-03 22:55 11328 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Plate-SitDown.tga
2008-05-03 22:55 11328 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Plate-Highlight.tga
2008-05-03 22:55 11302 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Plate.tga
2008-05-03 22:55 11302 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Plate-Action-Yellow.tga
2008-05-03 22:55 10791 --a------ C:\Program Files\NextPoker\Resources\Pigs\BasicSevenCardStats.pig
2008-05-03 22:55 1052 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-DealerButton.tga
2008-05-03 22:55 103386 --a------ C:\Program Files\NextPoker\Resources\Graphics\Moderator-PlayerList-Background.tga
2008-05-03 22:54 9428 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Size-Button.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon5.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon4.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon3.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon2.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon1.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon0.tga
2008-05-03 22:54 828 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Classification-Icon.tga
2008-05-03 22:54 81654 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-GameSelector-Background.bmp
2008-05-03 22:54 7654 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-ContextMenu-NormalBackground.bmp
2008-05-03 22:54 7654 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-ContextMenu-AltBackground.bmp
2008-05-03 22:54 746348 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Cards-Normal.tga
2008-05-03 22:54 72054 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-GameSelector-Background.bmp
2008-05-03 22:54 66404 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Register-Field.tga
2008-05-03 22:54 6572 --a------ C:\Program Files\NextPoker\Resources\Graphics\Login-Checkbox.tga
2008-05-03 22:54 6162 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-Help.tga
2008-05-03 22:54 614 --a------ C:\Program Files\NextPoker\Resources\Graphics\List-Sort-Bright.bmp
2008-05-03 22:54 6128 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Menu-Stat-Background.tga
2008-05-03 22:54 563218 --a------ C:\Program Files\NextPoker\Resources\Graphics\HandBrowser-HandList-Bkg.tga
2008-05-03 22:54 5456 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Chat-Smileys.bmp
2008-05-03 22:54 54306 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Action-Button-H29.tga
2008-05-03 22:54 5420 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Checkbox.tga
2008-05-03 22:54 53346 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-GameSelector.tga
2008-05-03 22:54 528 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Vip-Star.tga
2008-05-03 22:54 528 --a------ C:\Program Files\NextPoker\Resources\Graphics\GreenCheck11.tga
2008-05-03 22:54 520186 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-List-bkg.tga
2008-05-03 22:54 50444 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Timer.tga
2008-05-03 22:54 48 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-User-Info-window.tga
2008-05-03 22:54 48 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-Support.tga
2008-05-03 22:54 48 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-Cashier.tga
2008-05-03 22:54 48 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Bkg-Playerwindow-Seated.tga
2008-05-03 22:54 48 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Bkg-News.tga
2008-05-03 22:54 475878 --a------ C:\Program Files\NextPoker\Resources\Graphics\Login-Bkg.bmp
2008-05-03 22:54 4722 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Radio-Button.tga
2008-05-03 22:54 40350 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-Main.bmp
2008-05-03 22:54 361014 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Undocked-Chat-Background.bmp
2008-05-03 22:54 3438 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-User-Info-Refresh-Button.tga
2008-05-03 22:54 3378 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Scrollbar-Page.tga
2008-05-03 22:54 3242 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Slider-Button.tga
2008-05-03 22:54 3154 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Scrollbar-Buttons.tga
2008-05-03 22:54 304854 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-MenuBackground.bmp
2008-05-03 22:54 2966 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Chat-Buttons.bmp
2008-05-03 22:54 2758 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Chat-Scrollbar.bmp
2008-05-03 22:54 2744 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Toggle-Large-Chat.tga
2008-05-03 22:54 2744 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Tab-L3.tga
2008-05-03 22:54 2744 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Tab-L2.tga
2008-05-03 22:54 2744 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Tab-L1.tga
2008-05-03 22:54 2744 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Icon-Team.tga
2008-05-03 22:54 2744 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Icon-Pokah.tga
2008-05-03 22:54 26226 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-Promo.tga
2008-05-03 22:54 26226 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Button-FindP.tga
2008-05-03 22:54 259124 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Table-Dialog-Large.tga
2008-05-03 22:54 25644 --a------ C:\Program Files\NextPoker\Resources\Graphics\Login-Light-Red.tga
2008-05-03 22:54 25644 --a------ C:\Program Files\NextPoker\Resources\Graphics\Login-Light-Dark.tga
2008-05-03 22:54 256044 --a------ C:\Program Files\NextPoker\Resources\Graphics\Login-Light-Animation.tga
2008-05-03 22:54 253838 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Bkg-Info.tga
2008-05-03 22:54 253838 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Bkg-Info-Waiting.tga
2008-05-03 22:54 250002 --a------ C:\Program Files\NextPoker\Resources\Graphics\HandBrowser-SessionDetailsList-Bkg.tga
2008-05-03 22:54 22 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Ring-Game-Tab-Background.tga
2008-05-03 22:54 21830 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Logo.tga
2008-05-03 22:54 21800 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Plate-Highlight.tga
2008-05-03 22:54 21800 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Image-ActiveArrow.tga
2008-05-03 22:54 20994 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Radio-Upper.tga
2008-05-03 22:54 19890 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Radio-Mid-Vert.tga
2008-05-03 22:54 19890 --a------ C:\Program Files\NextPoker\Resources\Graphics\Mini-Button-Radio-Lower.tga
2008-05-03 22:54 18944 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Plate-AwaySign.tga
2008-05-03 22:54 178352 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Table-Dialog.tga
2008-05-03 22:54 16936 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Plate-SitDown.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-SpeechBubbleRight.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-SpeechBubbleLeft.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-10.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-09.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-08.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-07.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-06.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-05.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-04.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-03.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-02.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Player-01.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Plate.tga
2008-05-03 22:54 16910 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Plate-Action-Yellow.tga
2008-05-03 22:54 1686 --a------ C:\Program Files\NextPoker\Resources\Graphics\List-Header-Bright.bmp
2008-05-03 22:54 1674 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Cards-Hidden.tga
2008-05-03 22:54 1628 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-DealerButton.tga
2008-05-03 22:54 16172 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Chips.tga
2008-05-03 22:54 155662 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-Bkg-Playerwindow.tga
2008-05-03 22:54 150930 --a------ C:\Program Files\NextPoker\Resources\Graphics\HandBrowser-SessionList-Bkg.tga
2008-05-03 22:54 149618 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Table-Logo.tga
2008-05-03 22:54 14396 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Cards-Selected.tga
2008-05-03 22:54 14396 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Cards-Selectable.tga
2008-05-03 22:54 14370 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Cards-Hidden-Big.tga
2008-05-03 22:54 1336854 --a------ C:\Program Files\NextPoker\Resources\Graphics\Lobby-bkg.bmp
2008-05-03 22:54 1314 --a------ C:\Program Files\NextPoker\Resources\Graphics\Hand-Evaluation-Bkg.tga
2008-05-03 22:54 13112 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Icon-Custom-Link2.tga
2008-05-03 22:54 1188 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Icon-Playernotes.tga
2008-05-03 22:54 1160374 --a------ C:\Program Files\NextPoker\Resources\Graphics\HandBrowser-Bkg.bmp
2008-05-03 22:54 11492 --a------ C:\Program Files\NextPoker\Resources\Graphics\Login-Edit-Bkg.tga
2008-05-03 22:54 11020 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Image-AllInProb.tga
2008-05-03 22:54 1063254 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Table.bmp
2008-05-03 22:54 103426 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Undocked-Stat-Background.bmp
2008-05-03 22:53 944 --a------ C:\Program Files\NextPoker\Resources\Graphics\Edit-Error-Bkg.tga
2008-05-03 22:53 939 --a------ C:\Program Files\NextPoker\Resources\Graphics\AlphaTest.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-9.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-8.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-7.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-6.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-5.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-4.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-3.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-2.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-1.tga
2008-05-03 22:53 8816 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-0.tga
2008-05-03 22:53 8595 --a------ C:\Program Files\NextPoker\Resources\Databases\CreateDB_3_0.sql
2008-05-03 22:53 8169 --a------ C:\Program Files\NextPoker\Resources\Databases\CreateDB_2_0.sql
2008-05-03 22:53 76272 --a------ C:\Program Files\NextPoker\Resources\Graphics\CreateTable-Description.tga
2008-05-03 22:53 749062 --a------ C:\Program Files\NextPoker\Resources\Graphics\CreateTournament-Bkg.bmp
2008-05-03 22:53 746843 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Cards-BigSymbol.tga
2008-05-03 22:53 72738 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-GameSelector.tga
2008-05-03 22:53 7148 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Toggle-Large-Chat.tga
2008-05-03 22:53 6980 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-HelpOnError.tga
2008-05-03 22:53 686 --a------ C:\Program Files\NextPoker\Resources\Databases\UpdateDB_2_0_to_3_0.sql
2008-05-03 22:53 631354 --a------ C:\Program Files\NextPoker\Resources\Graphics\CreateTable-bkg.bmp
2008-05-03 22:53 6128 --a------ C:\Program Files\NextPoker\Resources\Graphics\DialogWind-Fat.tga
2008-05-03 22:53 5920 --a------ C:\Program Files\NextPoker\Resources\Databases\CreateDB_1_0.sql
2008-05-03 22:53 54476 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-FullScreen.tga
2008-05-03 22:53 54306 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Action-Button-H29.tga
2008-05-03 22:53 54306 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-H29.tga
2008-05-03 22:53 54306 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-H29-Signalclr.tga
2008-05-03 22:53 526554 --a------ C:\Program Files\NextPoker\Resources\Graphics\Confirmation-Bkg-Var3.bmp
2008-05-03 22:53 507904 --a------ C:\Program Files\NextPoker\msvcp71_.dll
2008-05-03 22:53 50562 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Action-Button-H27.tga
2008-05-03 22:53 50562 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-H27.tga
2008-05-03 22:53 49650 --a------ C:\Program Files\NextPoker\Resources\Graphics\CreateTable-LimitList-Bkg.tga
2008-05-03 22:53 44946 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Action-Button-H24.tga
2008-05-03 22:53 43972 --a------ C:\Program Files\NextPoker\Resources\Graphics\CreateTable-Preview-Bkg.tga
2008-05-03 22:53 42546 --a------ C:\Program Files\NextPoker\Resources\Graphics\Filter-Bkg.tga
2008-05-03 22:53 396 --a------ C:\Program Files\NextPoker\Resources\Graphics\BlackFlash11.tga
2008-05-03 22:53 38658 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-Radio-Left.tga
2008-05-03 22:53 37818 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-Radio-Right.tga
2008-05-03 22:53 37818 --a------ C:\Program Files\NextPoker\Resources\Graphics\Button-Radio-Mid-Horiz.tga
2008-05-03 22:53 35552 --a------ C:\Program Files\NextPoker\Resources\Graphics\CreateTournament-preview-bkg.bmp
2008-05-03 22:53 352256 --a------ C:\Program Files\NextPoker\msvcr71_.dll
2008-05-03 22:53 34244 --a------ C:\Program Files\NextPoker\Resources\Graphics\About-Logo1.tga
2008-05-03 22:53 34218 --a------ C:\Program Files\NextPoker\Resources\Graphics\About-Logo2.tga
2008-05-03 22:53 33138 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Radio-Upper.tga
2008-05-03 22:53 32444 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-bkg.tga
2008-05-03 22:53 3212 --a------ C:\Program Files\NextPoker\Resources\Graphics\CheckboxSmall.tga
2008-05-03 22:53 32034 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Radio-Mid-Vert.tga
2008-05-03 22:53 32034 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Radio-Lower.tga
2008-05-03 22:53 2739 --a------ C:\Program Files\NextPoker\Resources\Databases\UpdateDB_1_0_to_2_0.sql
2008-05-03 22:53 2696 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-number-colon.tga
2008-05-03 22:53 25240 --a------ C:\Program Files\NextPoker\Resources\Compressor\string0.lzt
2008-05-03 22:53 23760 --a------ C:\Program Files\NextPoker\Resources\Graphics\break-clock-bkg.tga
2008-05-03 22:53 23536 --a------ C:\Program Files\NextPoker\Resources\Compressor\string1.lzt
2008-05-03 22:53 213354 --a------ C:\Program Files\NextPoker\Resources\Graphics\About-Bkg.bmp
2008-05-03 22:53 213174 --a------ C:\Program Files\NextPoker\Resources\Graphics\Classification-Background.bmp
2008-05-03 22:53 20044 --a------ C:\Program Files\NextPoker\Resources\Graphics\DialogWind.tga
2008-05-03 22:53 1998 --a------ C:\Program Files\NextPoker\Resources\Graphics\Create-Table-Drop-Button.bmp
2008-05-03 22:53 18944 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-AwaySign.tga
2008-05-03 22:53 17900 --a------ C:\Program Files\NextPoker\Resources\Graphics\Classification-Description-Edit-Bkg.tga
2008-05-03 22:53 14696 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Tab-L2.tga
2008-05-03 22:53 14252 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Tab-L3.tga
2008-05-03 22:53 14252 --a------ C:\Program Files\NextPoker\Resources\Graphics\Game-Button-Tab-L1.tga
2008-05-03 22:53 1046528 --a------ C:\Program Files\NextPoker\mfc71_u.dll
2008-05-03 22:53 1022 --a------ C:\Program Files\NextPoker\Resources\Compressor\Huffman1.tree
2008-05-03 22:53 1022 --a------ C:\Program Files\NextPoker\Resources\Compressor\Huffman0.tree
2008-05-03 22:51 719360 --a------ C:\Program Files\NextPoker\dbghelp.dll
2008-05-03 22:51 35328 --a------ C:\Program Files\NextPoker\dsetup.dll
2008-04-17 09:08 57344 --a------ C:\Program Files\NextPoker\StartNextPoker.exe
2008-04-17 09:08 55808 --a------ C:\Program Files\NextPoker\zlib1.dll
2008-04-17 09:08 451 --a------ C:\Program Files\NextPoker\patch.cfg

((((((((((((((((((((((((((((( snapshot@2008-08-23_13.43.42.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-07 20:06:43 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP2QFE\es.dll
+ 2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3GDR\es.dll
+ 2008-07-07 20:23:18 253,952 ----a-w C:\WINDOWS\$hf_mig$\KB950974\SP3QFE\es.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB950974\update\updspapi.dll
+ 2008-07-14 11:03:00 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe
+ 2008-07-11 12:42:28 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe
+ 2008-07-11 12:51:51 62,976 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951072-v2\update\updspapi.dll
+ 2008-06-24 16:28:00 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP2QFE\mscms.dll
+ 2008-06-24 16:43:16 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3GDR\mscms.dll
+ 2008-06-24 16:53:10 74,240 ----a-w C:\WINDOWS\$hf_mig$\KB952954\SP3QFE\mscms.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB952954\update\updspapi.dll
+ 2008-06-23 16:11:40 1,024,000 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\browseui.dll
+ 2008-06-23 16:11:40 151,040 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\cdfview.dll
+ 2008-06-23 16:11:42 1,054,208 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\danim.dll
+ 2008-06-23 16:11:43 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\dxtmsft.dll
+ 2008-06-23 16:11:43 205,312 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\dxtrans.dll
+ 2008-06-23 16:11:43 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\extmgr.dll
+ 2008-06-23 09:53:58 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\iedw.exe
+ 2008-06-23 16:11:52 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\iepeers.dll
+ 2008-06-23 16:11:52 96,256 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\inseng.dll
+ 2008-06-23 16:11:52 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\jsproxy.dll
+ 2008-06-23 16:11:58 3,067,392 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mshtml.dll
+ 2008-06-23 16:12:00 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mshtmled.dll
+ 2008-06-23 16:12:02 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\msrating.dll
+ 2008-06-23 16:12:02 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\mstime.dll
+ 2008-06-23 16:12:02 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\pngfilt.dll
+ 2008-06-23 16:12:05 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\shdocvw.dll
+ 2008-06-23 16:12:05 474,112 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\shlwapi.dll
+ 2008-06-23 16:12:06 618,496 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\urlmon.dll
+ 2008-06-23 16:12:08 667,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\wininet.dll
+ 2008-07-03 09:14:02 351,744 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\xpsp3res.dll
+ 2008-06-23 15:09:27 3,067,392 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\mshtml.dll
+ 2008-06-26 08:15:29 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\shdocvw.dll
+ 2008-06-26 08:15:30 619,520 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\urlmon.dll
+ 2008-06-23 15:09:27 666,112 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll
+ 2008-06-25 04:24:48 3,067,904 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\mshtml.dll
+ 2008-06-26 08:00:52 1,499,136 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\shdocvw.dll
+ 2008-06-26 08:00:52 619,520 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\urlmon.dll
+ 2008-06-23 14:54:47 666,624 ----a-w C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB953838\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB953838\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB953838\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB953838\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB953838\update\updspapi.dll
- 2008-04-21 07:03:56 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
+ 2008-06-23 15:38:28 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
- 2008-04-21 07:03:56 151,040 ------w C:\WINDOWS\system32\cdfview.dll
+ 2008-06-23 15:38:29 151,040 ------w C:\WINDOWS\system32\cdfview.dll
- 2008-04-21 07:03:57 1,054,208 ------w C:\WINDOWS\system32\danim.dll
+ 2008-06-23 15:38:30 1,054,208 ------w C:\WINDOWS\system32\danim.dll
- 2008-04-21 07:03:56 1,023,488 -c----w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2008-06-23 15:38:28 1,023,488 -c----w C:\WINDOWS\system32\dllcache\browseui.dll
- 2008-04-21 07:03:56 151,040 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2008-06-23 15:38:29 151,040 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2008-04-21 07:03:57 1,054,208 -c----w C:\WINDOWS\system32\dllcache\danim.dll
+ 2008-06-23 15:38:30 1,054,208 -c----w C:\WINDOWS\system32\dllcache\danim.dll
- 2008-04-21 07:03:57 357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-06-23 15:38:30 357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-04-21 07:03:57 205,312 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-06-23 15:38:30 205,312 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2005-07-26 04:39:45 243,200 -c----w C:\WINDOWS\system32\dllcache\es.dll
+ 2008-07-07 20:32:22 253,952 -c----w C:\WINDOWS\system32\dllcache\es.dll
- 2008-04-21 07:03:57 55,808 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-06-23 15:38:30 55,808 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-04-17 10:52:54 18,432 -c----w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2008-06-23 09:49:29 18,432 -c----w C:\WINDOWS\system32\dllcache\iedw.exe
- 2008-04-21 07:03:58 251,392 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2008-06-23 15:38:31 251,392 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2007-08-21 06:15:44 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2008-04-21 07:03:58 96,256 -c----w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2008-06-23 15:38:31 96,256 -c----w C:\WINDOWS\system32\dllcache\inseng.dll
- 2008-04-21 07:03:58 16,384 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-23 15:38:31 16,384 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2004-08-03 22:56:44 331,776 -c----w C:\WINDOWS\system32\dllcache\msadce.dll
+ 2008-05-01 14:30:33 331,776 -c----w C:\WINDOWS\system32\dllcache\msadce.dll
- 2005-06-29 01:46:00 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll
+ 2008-06-24 16:23:05 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll
- 2008-04-21 07:03:59 3,059,712 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-23 15:38:33 3,059,712 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-04-21 07:03:59 449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-06-23 15:38:33 449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-04-21 07:03:59 146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-06-23 15:38:33 146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-04-21 07:03:59 532,480 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-23 15:38:33 532,480 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-04-21 07:03:59 39,424 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-23 15:38:33 39,424 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2008-04-21 07:04:00 1,494,528 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2008-06-23 15:38:34 1,494,528 -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2008-04-21 07:04:00 474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2008-06-23 15:38:34 474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2008-04-21 07:04:00 615,936 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-06-23 15:38:34 615,936 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-04-21 07:04:00 659,456 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 15:38:34 659,456 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-02-05 03:34:44 13,616 ------w C:\WINDOWS\system32\drivers\symdns.sys
+ 2008-06-13 06:13:38 13,616 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
- 2008-02-05 03:34:44 96,432 ------w C:\WINDOWS\system32\drivers\symfw.sys
+ 2008-06-13 06:13:38 96,432 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
- 2008-02-05 03:34:44 38,576 ------w C:\WINDOWS\system32\drivers\symids.sys
+ 2008-06-13 06:13:38 38,576 ----a-w C:\WINDOWS\system32\drivers\symids.sys
- 2008-02-06 05:43:54 31,408 ------w C:\WINDOWS\system32\drivers\SymIM.sys
+ 2008-06-13 06:14:02 31,280 ----a-w C:\WINDOWS\system32\drivers\SymIM.sys
- 2008-02-05 03:34:44 37,424 ------w C:\WINDOWS\system32\drivers\symndis.sys
+ 2008-06-13 06:13:38 37,424 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
- 2008-02-05 03:34:44 41,008 ------w C:\WINDOWS\system32\drivers\symndisv.sys
+ 2008-06-13 06:13:40 41,008 ----a-w C:\WINDOWS\system32\drivers\symndisv.sys
- 2008-02-05 03:34:44 22,320 ------w C:\WINDOWS\system32\drivers\symredrv.sys
+ 2008-06-13 06:13:38 22,320 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
- 2008-02-05 03:34:44 188,464 ------w C:\WINDOWS\system32\drivers\symtdi.sys
+ 2008-06-13 06:13:40 184,240 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
- 2008-04-21 07:03:57 357,888 ------w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 15:38:30 357,888 ------w C:\WINDOWS\system32\dxtmsft.dll
- 2008-04-21 07:03:57 205,312 ------w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 15:38:30 205,312 ------w C:\WINDOWS\system32\dxtrans.dll
- 2008-04-21 07:03:57 55,808 ------w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 15:38:30 55,808 ------w C:\WINDOWS\system32\extmgr.dll
- 2008-04-21 07:03:58 251,392 ------w C:\WINDOWS\system32\iepeers.dll
+ 2008-06-23 15:38:31 251,392 ------w C:\WINDOWS\system32\iepeers.dll
- 2007-08-21 06:15:44 683,520 ------w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 ------w C:\WINDOWS\system32\inetcomm.dll
- 2008-04-21 07:03:58 96,256 ------w C:\WINDOWS\system32\inseng.dll
+ 2008-06-23 15:38:31 96,256 ------w C:\WINDOWS\system32\inseng.dll
- 2008-04-21 07:03:58 16,384 ------w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 15:38:31 16,384 ------w C:\WINDOWS\system32\jsproxy.dll
- 2008-04-21 07:03:59 3,059,712 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-23 15:38:33 3,059,712 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-04-21 07:03:59 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 15:38:33 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-04-21 07:03:59 146,432 ------w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 15:38:33 146,432 ------w C:\WINDOWS\system32\msrating.dll
- 2008-04-21 07:03:59 532,480 ------w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 15:38:33 532,480 ------w C:\WINDOWS\system32\mstime.dll
- 2008-04-21 07:03:59 39,424 ------w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 15:38:33 39,424 ------w C:\WINDOWS\system32\pngfilt.dll
- 2008-04-21 07:04:00 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2008-06-23 15:38:34 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2008-04-21 07:04:00 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2008-06-23 15:38:34 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2007-11-13 11:31:11 60,416 ----a-w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-14 11:09:18 62,976 ----a-w C:\WINDOWS\system32\tzchange.exe
- 2008-04-21 07:04:00 615,936 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 15:38:34 615,936 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-04-17 10:37:04 351,744 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-07-03 09:14:02 351,744 ----a-w C:\WINDOWS\system32\xpsp3res.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-17 10:04 139264]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:56 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 00:24 1694208]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 17:59 2289664]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-03-22 10:50 8425472]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-25 17:47 51048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-08 09:35 1294336]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-03 05:00:41 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Remote Control.lnk - C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe [2007-10-03 05:04:21 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= DivXa32.acm
"vidc.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-25 17:47]
R3 Cap713x;Philips Cap713x Video Capture;C:\WINDOWS\system32\DRIVERS\Cap713x.sys [2005-05-04 16:32]
S2 RoxLiveShare10;LiveShare P2P Server 10;C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe []
S2 SessionLauncher;SessionLauncher;C:\DOCUME~1\Hudson\LOCALS~1\Temp\DX9\SessionLauncher.exe []
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2006-07-06 06:35]

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-08-18 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Hudson.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 06:05]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-24 23:59:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-25 0:00:27
ComboFix-quarantined-files.txt 2008-08-24 16:00:21
ComboFix2.txt 2008-08-23 05:44:19

Pre-Run: 137,109,516,288 bytes free
Post-Run: 137,164,558,336 bytes free

708 --- E O F --- 2008-08-23 19:04:44

**----------------------**
Here's the jotti results:
**----------------------**
Scan taken on 24 Aug 2008 16:10:42 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

**------------------------**
Here's the HijackThis Log:
**------------------------**
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:19 AM, on 8/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Apps\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Remote Control.lnk = C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Apps\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Apps\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\Hudson\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7454 bytes

Thanks,
Chayienne

by **Rodav** » August 24th, 2008, 3:02 pm

Hi chayienne,

Things are starting to look better, hows your computer running?

You seem to have NextPoker installed, I can't find too much about it. Many of these poker programs are malware/adware themselves although I don't know if Next Poker is one. You can remove it through Add/Remove Programs if you want.

Here are links to some poker sites regarded as safe for your reference.
1. http://www.pokerstars.net/ - This is a free to use/play site with play money.
2. http://www.pokerstars.com/ - This is a free to use/play site with play money and real money.

Step 1:
Please visit http://virusscan.jotti.org/

Copy/paste this file and path into the white box at the top:

C:\Program Files\NextPoker\NextPoker.exe

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

Repeat this for the following file:

C:\Program Files\NextPoker\StartNextPoker.exe

If Jotti is busy you could try the same at Virustotal.

Step 2:
Run Eset NOD32 Online AntiVirus
http://www.eset.eu/online-scanner
Note: You will need to use Internet Explorer for this scan.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
Click Start
Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checked
Click Scan
Wait for the scan to finish
Re-enable your Anvirisus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

Step 3:
Run HijackThis, do a system scan and in your next reply please post:

The NOD32 results
The jotti/virustotal results
The new HijackThis log

Also let me know how your computer is running.

by **chayienne** » August 25th, 2008, 9:51 am

Hi,

The computer is running fast now. I could open a website in a fraction of seconds. Thank you so much!

Here's the report you requested me to post:

[A] ESET Online Scan:

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3384 (20080825)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=edd53953e5e6c943b1403e50f2e94809
# end=stopped
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-08-25 01:31:16
# local_time=2008-08-25 09:31:16 (+0800, China Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=230862
# found=0
# scan_time=1613

[B] JOTTI Malware Scan :
Service load: 0% 100%
File: NextPoker.exe
Status: OK
MD5: fa8703f9672c7e6e74e01bcd68893a38
Packers detected: -

Scan taken on 25 Aug 2008 12:19:20 (GMT)
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

---------------------------------------------------
Service load: 0% 100%
File: StartNextPoker.exe
Status: OK
MD5: 43f948df0cc22d2c27bb3d7f062bc813
Packers detected: -
Scan taken on 25 Aug 2008 12:23:37 (GMT)
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

[c] Hijack This Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:32:29 PM, on 8/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Apps\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Remote Control.lnk = C:\Program Files\KWorld Multimedia\PVR-TV 7131 Utilities\P3XRCtl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Apps\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Apps\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\Hudson\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 8015 bytes

My brother installed the nextpoker program. Is it safe to continue using it?

Regards,
chayienne

by **Rodav** » August 25th, 2008, 11:17 am

I'm happy to say things look a lot better, just a couple of quick steps left.

NextPoker seems OK, so it should be safe to carry on using it.

Step 1:

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application and Restart your computer.

Step 2:

Click START then RUN
Now type Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.

please let me know now

Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints Malware Complaints, you need to be registered to post as unfortunately we were hit with too many spam posting to allow guest posting to continue just find your country room and register your complaint.

Make sure you install all the security updates for Windows, Internet explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch for it to that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC, so keeping up with these patches will help to prevent malicious software being installed on your PC
Go here to check for & install updates to Microsoft applications
Note: The update process uses activex, so you will need to use internet explorer for it, and allow the activex control that it wants to install
Keep your non-Microsoft applications updated as well
Microsoft isn't the only company whose products can contain security vulnerabilities, to check for other vulnerable programs running on your PC that are in need of an update, you can use the Secunia Software Inspector - I suggest that you run it at least once a month
Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Install a Hosts File
I recommend MVPS Hosts File
Every version of windows includes a hosts file as part of them. A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
On some PCs, having a custom HOSTS file installed can cause a significant slowdown. Following these instructions should resolve the issue
- Click Start > Run
- Type services.msc & click OK
- In the list, find the service called DNS Client & double click on it.
- On the dropdown box, change the setting from automatic to manual.
- Click OK & then close the Services window
For a more detailed explanation of the HOSTS file, click here
Install Malwarebytes & update and scan with it regularly
Malwarebytes is a free for personal use on demand scanner which is developed by active members of the Malware Removal community. It detects and removes many modern infections. The paid version offers realtime protection.
Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program. If you want to help the developer of the program and get more information about what the programs that you see in Winpatrol please check out Winpatrol Plus. It does not need a new download.
The last and most important thing I can tell you is UPDATE, UPDATE, UPDATE.
If you don't update your security programs (Antivirus, Antispyware, even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

Miekiemoes an expert in malware removal has a fantastic article on how to prevent Malware for further tips, it's well worth a read. http://users.telenet.be/bluepatchy/miek ... ntion.html

Please reply to this topic one more time so I know you have read through it or with any questions you may have.

by **chayienne** » August 26th, 2008, 11:38 am

Hi Rodav,

Thank you very much for all your help. :compress:

I hope I can pay your kindness forward someday.

I've read your post and done everything as you've instructed. I'm currently subscribed to Norton Internet Security for a year. Is it okay to run this and malwarebytes at the same time?

I have one desktop PC at the office and if it's not asking too much, can I also ask you to review the hijackthis log in case it is also infected?

Regards,
Chayienne

by **Rodav** » August 26th, 2008, 12:25 pm

Malwarebytes should compliment Norton or any other antivirus, it will typically target infections that some antivirus software struggle with.

Start a new topic for your other computer and I'll take a look.

Free Malware Removal Forum

Urgent help needed - Possible malware infection

Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Re: Urgent help needed - Possible malware infection

Who is online