Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Banker trojan?

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Banker trojan?

Unread postby halbibabe » February 24th, 2009, 3:39 pm

Hi,
When I run advanced systemcare free It saids I have a Trojan-spy.Win32.banker, located in
HKEY_local_Machine\software\sos
Advanced systemcare fixes it everytime but as soon as I reboot the advanced systemcare fines it again. I've used spysweeper anti-virus and anti spyware, Malwarebytes Anti malware, and superanti-spyware, but none of these find anything
I've done REGEDIT and removed the sos from there but it always comes back at reboot.

Any help would be appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 12:24:15 PM, on 2/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\S4F\filter7.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\NEIL.DHFNYKB1\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.majorgeeks.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80203
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_custom ... tbid=80203
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cli ... channel=us
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://redirect.zonelabs.com/redirect/r ... hx644bu4g0
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [S4F] "C:\Program Files\S4F\Filter7.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (http://www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

installed programs
Acrobat.com
Actiontec Gateway
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Advanced SystemCare 3
aiofw
aioocr
aioprnt
aioscnnr
AOLIcon
CCleaner (remove only)
center
Conexant D850 56K V.9x DFVc Modem
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Digital Content Portal
Digital Line Detect
Documentation & Support Launcher
EducateU
ELIcon
e-Sword
FitDay PC version 1.0
Google Toolbar for Internet Explorer
Help_CTR
helptut
helpug
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet for Wired Connections
Java(TM) 6 Update 11
KODAK All-in-One Printer Software
ksdip
Malwarebytes' Anti-Malware
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft MPEG-4 VKI Video Codec V1/V2/V3
Microsoft National Language Support Downlevel APIs
Microsoft Picture It! Express 9
Microsoft Picture It! Library 9
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Word 97
Modem Helper
MRU-Blaster v1.5 (Database 3/28/2004)
MSN
MSN Encarta Plus Support Files
MSN Messenger 7.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MySpaceIM
netbrdg
NetWaiting
PC Wizard 2008.1.871
Revo Uninstaller 1.80
Roxio DLA
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
SFR
Smart Defrag 1.10
Sonic Activation Module
Sonic Update Manager
Sophos Anti-Rootkit 1.3.1
Spy Sweeper Core
Spybot - Search & Destroy
Spybot - Search & Destroy 1.3.1 TX
SpywareBlaster 4.1
SUPERAntiSpyware Free Edition
System Requirements Lab
URL Assistant
VC 9.0 Runtime
Viewpoint Media Player
Webroot AntiVirus with AntiSpyware
Window Washer
Windows Live installer
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows XP Service Pack 3
XP Codec Pack
ZoneAlarm
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm
Advertisement
Register to Remove

Re: Banker trojan?

Unread postby Bio-Hazard » March 8th, 2009, 10:19 am

Hello!

Sorry for a late reply. If you still need help please post a new HijackThis log for me to see.
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 8th, 2009, 1:11 pm

Thanks,

Logfile of HijackThis v1.99.1
Scan saved at 11:01:48 AM, on 3/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\S4F\filter7.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Documents and Settings\NEIL.DHFNYKB1\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.majorgeeks.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80203
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_custom ... tbid=80203
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=del ... channel=us
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://redirect.zonelabs.com/redirect/r ... hx644bu4g0
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [S4F] "C:\Program Files\S4F\Filter7.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm

Re: Banker trojan?

Unread postby Bio-Hazard » March 8th, 2009, 2:44 pm

Hello!

lets have a closer look of your system.

Step 1

Image
Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt
  • Save both reports to your desktop.

Step 2

Please download gmer.zip from Gmer and save it to your desktop.

  1. Right click on gmer.zip and select Extract All....
  2. Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  3. Click on the Browse button. Click on Desktop. Then click OK.
  4. Click Next. It will start extracting.
  5. Once done, check (tick) the Show extracted files box and click Finish.

Double click on gmer.exe to run it. It will start running a scan. If it detects rootkit activity, you will receive a prompt to run a full scan. Click Yes.

  • When done, you may receive another notice. Click OK.
  • Click on Save ... to save a log.
  • Copy and paste in Gmer.txt and click Save.
  • Close Gmer.

If you receive no notice, click on the Scan button.

  • It will start scanning again.
  • When done, click on Save ... to save a log.
  • Copy and paste in Gmer.txt and click Save.
  • Close Gmer.

Note: Do not run any programs while Gmer is running.

In your next reply, please post:

  1. DDS.txt
  2. Attach.txt
  3. Gmer.txt
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 8th, 2009, 4:05 pm

Here they are,

DDS (Ver_09-02-01.01) - NTFSx86
Run by NEIL at 13:36:43.95 on Sun 03/08/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1278.819 [GMT -6:00]

AV: Webroot AntiVirus with AntiSpyware *On-access scanning enabled* (Updated)
FW: Webroot Internet Security Essentials *disabled*
FW: ZoneAlarm Firewall *enabled*

============== Running Processes ===============

C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\S4F\filter7.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Documents and Settings\NEIL.DHFNYKB1\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.majorgeeks.com/
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/ ... channel=us
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/ ... channel=us
mDefault_Page_URL = hxxp://www.dell.com
mStart Page = hxxp://www.dell.com
uInternet Connection Wizard,ShellNext = hxxp://redirect.zonelabs.com/redirect/r ... hx644bu4g0
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/ ... channel=us
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
uRun: [ctfmon.exe] "c:\windows\system32\ctfmon.exe"
uRun: [SmartRAM] "c:\program files\iobit\advanced systemcare 3\Sup_SmartRAM.exe" /m
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
mRun: [S4F] "c:\program files\s4f\Filter7.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [EKIJ5000StatusMonitor] "c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe"
mRun: [SpySweeper] "c:\program files\webroot\spy sweeper\SpySweeperUI.exe" /startintray
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
LSP: c:\windows\system\wins4f.dll
Trusted Zone: musicmatch.com\online
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/s ... wflash.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {96EA7110-C0E2-44BF-94B1-03133A29521C} - No File
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-12-7 29808]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-15 55024]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-2-4 353680]
R2 KodakSvc;Kodak AiO Device Service;c:\program files\kodak\printer\center\KodakSvc.exe [2007-12-13 18944]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\spy sweeper\SpySweeper.exe [2008-12-7 3671408]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\spy sweeper\WRConsumerService.exe [2009-2-2 1090936]
R2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2007-12-11 598856]
S1 AvgAsCln;AVG Anti-Spyware Clean Driver;c:\windows\system32\drivers\avgascln.sys --> c:\windows\system32\drivers\AvgAsCln.sys [?]
S1 SDManager;SDManager;\??\c:\program files\spywaredetector\sdmanager.sys --> c:\program files\spywaredetector\SDManager.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\93.tmp --> c:\windows\system32\93.tmp [?]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-15 7408]
S4 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard;c:\program files\grisoft\avg anti-spyware 7.5\guard.exe --> c:\program files\grisoft\avg anti-spyware 7.5\guard.exe [?]

============== File Associations ===============

regfile=regedit.exe "%1" %*

=============== Created Last 30 ================

2009-03-04 22:59 <DIR> --d----- C:\VundoFix Backups
2009-03-03 18:23 8,885 a------- c:\docume~1\neil.dhfnykb1\application data\DIRFE845.exe
2009-03-03 15:48 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\~0
2009-02-26 13:16 61,440 a------- c:\windows\system32\drivers\gigtm.sys
2009-02-25 18:02 <DIR> --d----- c:\documents and settings\neil.dhfnykb1\.housecall6.6
2009-02-25 17:54 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-24 15:51 162,304 a------- c:\windows\system32\ztvunrar36.dll
2009-02-24 15:51 77,312 a------- c:\windows\system32\ztvunace26.dll
2009-02-24 15:51 69,632 a------- c:\windows\system32\ztvcabinet.dll
2009-02-24 15:51 75,264 a------- c:\windows\system32\unacev2.dll
2009-02-24 15:51 153,088 a------- c:\windows\system32\unrar3.dll
2009-02-24 15:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Simply Super Software
2009-02-24 15:51 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\Simply Super Software
2009-02-20 20:23 194,888 a------- c:\windows\Unwash6.exe
2009-02-20 14:23 23,392 a------- c:\windows\system32\nscompat.tlb
2009-02-20 14:23 16,832 a------- c:\windows\system32\amcompat.tlb
2009-02-20 12:05 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\MSNInstaller
2009-02-20 08:23 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-02-19 21:10 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\MySpace
2009-02-19 21:10 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\IObit
2009-02-19 21:05 35,276 a------- c:\windows\NEIL000.acl
2009-02-19 20:59 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\SUPERAntiSpyware.com
2009-02-19 20:48 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\Webroot
2009-02-19 20:47 <DIR> --d----- c:\docume~1\neil.dhfnykb1\application data\Symantec
2009-02-19 20:47 <DIR> --d----- c:\documents and settings\NEIL.DHFNYKB1
2009-02-17 16:22 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-02-17 16:22 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-02-13 19:38 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-13 19:36 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-13 19:36 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-13 19:36 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-13 19:36 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-13 19:36 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-13 19:36 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-13 19:36 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-13 19:36 <DIR> --d----- C:\594926577cadc84daaff
2009-02-10 16:19 <DIR> --d----- c:\program files\Sophos

==================== Find3M ====================

2009-02-25 17:54 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-04 15:00 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-02-02 14:15 164 a------- C:\install.dat
2009-01-20 10:07 1,553,272 a------- c:\windows\WRSetup.dll
2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
2008-12-19 03:10 70,656 a------- c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 03:10 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2008-12-18 23:25 634,024 a------- c:\windows\system32\dllcache\iexplore.exe
2008-12-18 23:23 161,792 a------- c:\windows\system32\dllcache\ieakui.dll
2008-12-11 04:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-03-18 11:56 88 ---shr-- c:\windows\system32\146DDBD198.sys
2007-05-08 12:48 56 ---shr-- c:\windows\system32\98D1DB6D14.sys
2008-03-18 11:56 4,184 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-06-08 20:47 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008060820080609\index.dat

============= FINISH: 13:37:44.21 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 2/18/2007 3:58:36 PM
System Uptime: 3/8/2009 7:26:43 AM (6 hours ago)

Motherboard: Dell Computer Corp. | | 0WF887
Processor: Intel(R) Celeron(R) CPU 2.53GHz | Microprocessor | 2527/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 109 GiB total, 98.359 GiB free.
D: is FIXED (NTFS) - 37 GiB total, 35.486 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) PRO/100 VE Network Connection
Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_01D51028&REV_02\4&1C660DD6&0&40F0
Manufacturer: Intel
Name: Intel(R) PRO/100 VE Network Connection
PNP Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_01D51028&REV_02\4&1C660DD6&0&40F0
Service: E100B

==== System Restore Points ===================

RP856: 3/1/2009 11:23:56 PM - System Checkpoint
RP857: 3/2/2009 1:02:54 AM - Revo Uninstaller's restore point - LimeWire 5.0.11
RP858: 3/2/2009 3:07:05 PM - Installed Windows Media Player 11
RP859: 3/2/2009 3:11:35 PM - Installed Windows XP MSCompPackV1.
RP860: 3/2/2009 6:32:23 PM - Revo Uninstaller's restore point - Blubster 3.0.7
RP861: 3/3/2009 12:49:23 PM - Revo Uninstaller's restore point - Malwarebytes' Anti-Malware
RP862: 3/3/2009 2:57:24 PM - Installed Driver Detective
RP863: 3/3/2009 3:38:29 PM - Revo Uninstaller's restore point - Rhapsody
RP864: 3/3/2009 4:39:28 PM - Installed Driver Detective
RP865: 3/3/2009 4:44:31 PM - Revo Uninstaller's restore point - Driver Detective
RP866: 3/3/2009 4:46:15 PM - Configured Driver Detective
RP867: 3/4/2009 4:55:30 PM - System Checkpoint
RP868: 3/5/2009 6:28:37 PM - System Checkpoint
RP869: 3/6/2009 6:50:19 PM - System Checkpoint
RP870: 3/7/2009 8:08:33 PM - System Checkpoint

==== Installed Programs ======================

Actiontec Gateway
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Advanced SystemCare 3
aiofw
aioocr
aioprnt
aioscnnr
AOLIcon
CCleaner (remove only)
center
Conexant D850 56K V.9x DFVc Modem
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell System Restore
Digital Content Portal
Digital Line Detect
DIGOpt
Documentation & Support Launcher
Driver Detective
e-Sword
EducateU
ELIcon
FitDay PC version 1.0
Google Toolbar for Internet Explorer
Help_CTR
helptut
helpug
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB954550-v5)
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet for Wired Connections
Java(TM) 6 Update 12
KODAK All-in-One Printer Software
ksdip
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft MPEG-4 VKI Video Codec V1/V2/V3
Microsoft National Language Support Downlevel APIs
Microsoft Picture It! Express 9
Microsoft Picture It! Library 9
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Word 97
Modem Helper
MRU-Blaster v1.5 (Database 3/28/2004)
MSN
MSN Encarta Plus Support Files
MSN Messenger 7.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MySpaceIM
netbrdg
NetWaiting
PC Wizard 2008.1.871
Revo Uninstaller 1.80
Roxio DLA
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB960715)
SFR
Smart Defrag 1.10
Sonic Activation Module
Sonic Update Manager
Sophos Anti-Rootkit 1.3.1
Spy Sweeper Core
Spybot - Search & Destroy
Spybot - Search & Destroy 1.3.1 TX
SpywareBlaster 4.1
SUPERAntiSpyware Free Edition
System Requirements Lab
URL Assistant
VC 9.0 Runtime
Viewpoint Media Player
WebFldrs XP
Webroot AntiVirus with AntiSpyware
Window Washer
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
XP Codec Pack
ZoneAlarm

==== Event Viewer Messages From Past Week ========

3/1/2009 9:25:50 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgAsCln
3/1/2009 9:25:47 AM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified.
3/1/2009 9:29:23 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.timefreq.bldrdoc.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
3/1/2009 11:23:25 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000043' while processing the file 'desktop.ini' on the volume 'HarddiskVolume3'. It has stopped monitoring the volume.
3/2/2009 3:12:01 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
3/3/2009 10:58:59 AM, error: WPDMTPDriver [15300] - MTP WPD Driver has failed to start. Error 0x80070005.

==== End Of File ===========================
GMER 1.0.15.14878 - http://www.gmer.net
Rootkit scan 2009-03-08 14:01:45
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT 8A59C2A8 ZwAllocateVirtualMemory
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB11708D0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB116D6E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0xB117A490]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB1170E90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xB1177C80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xB1177E90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0xB117BD50]
SSDT 8A566680 ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB1170F80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB116DC70]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB117AD10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xB117AAC0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xB1177600]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB117B230]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB117B2B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB116DAD0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xB11794F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0xB11792B0]
SSDT 8A59C320 ZwQueueApcThread
SSDT 8A59C1B8 ZwReadVirtualMemory
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB117B970]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB117B3D0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB11704F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xB117B7C0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xB1170AA0]
SSDT 8A568210 ZwSetContextThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB116DEA0]
SSDT 8A5670B0 ZwSetInformationKey
SSDT 8A51E0E8 ZwSetInformationProcess
SSDT 8A568288 ZwSetInformationThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xB117A800]
SSDT 8A5A1F78 ZwSuspendProcess
SSDT 8A59C398 ZwSuspendThread
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xB1178580]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xB1178400]
SSDT 8A59E5D0 ZwTerminateThread
SSDT 8A59C230 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [90, 0E, 17, B1, 80, 7C, 17, ...]
.text ntoskrnl.exe!_abnormal_termination + 31C 804E2978 2 Bytes [20, C3] {AND BL, AL}
.text ntoskrnl.exe!_abnormal_termination + 31F 804E297B 1 Byte [8A]
.text ntoskrnl.exe!_abnormal_termination + 3DC 804E2A38 8 Bytes CALL 08D87C1D
.text ntoskrnl.exe!_abnormal_termination + 440 804E2A9C 12 Bytes [78, 1F, 5A, 8A, 98, C3, 59, ...]
? srescan.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\MSN\MSNCoreFiles\msn.exe[784] WININET.dll!InternetGoOnlineW 780B5B0F 5 Bytes JMP 2013A45A C:\Program Files\MSN\MSNCoreFiles\msnmetal.dll (msnmetal/Microsoft Corporation)
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[1192] ntdll.dll!KiUserExceptionDispatcher + 9 7C90E465 5 Bytes JMP 00016B30 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[1192] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00017280 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[1192] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00017AD0 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[1192] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00017280 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[1192] kernel32.dll!VirtualAlloc 7C809AE1 5 Bytes JMP 00017A80 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[1192] kernel32.dll!VirtualFree 7C809B74 5 Bytes JMP 00017AB0 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\Washer\WasherSvc.exe[1532] kernel32.dll!CreateThread + 1A 7C8106E1 4 Bytes CALL 0008ED99 C:\Program Files\Webroot\Washer\WasherSvc.exe (Window Washer Engine/Webroot Software, Inc.)
.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[2456] kernel32.dll!CreateThread + 1A 7C8106E1 4 Bytes CALL 00450761 C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Spy Sweeper Client Executable/Webroot Software, Inc.)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 8A540EB0
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 8A540FA8
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [B1175410] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [B1175220] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [B1175B50] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [B1173780] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [B1173780] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [B1175410] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [B1175220] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [B1175B50] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [B1175410] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [B1173780] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [B1175B50] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [B1175220] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [B1175B50] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [B1175220] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [B1175410] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [B117D870] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [B1173780] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [B1175410] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [B1175220] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [B1175B50] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [B1175410] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [B1173780] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [B1175B50] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [B1175220] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [B116E320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [B116E4D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [B116E040] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [B116E3D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Ip 8A0AB9A0
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp 8A0AB9A0
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp 8A0AB9A0
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp 8A0AB9A0
Device \Driver\USB_RNDIS \Device\{B8A05EF1-E438-4CF9-9107-192EE6D11658} RNDISMP.SYS (Remote NDIS Miniport/Microsoft Corporation)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST 8A0AB9A0
Device \FileSystem\Fastfat \Fat AFDA2D20

AttachedDevice \FileSystem\Fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

---- EOF - GMER 1.0.15 ----
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm

Re: Banker trojan?

Unread postby Bio-Hazard » March 9th, 2009, 4:32 am

Move HijackThis
You currently are running HijackThis from here: C:\Documents and Settings\NEIL.DHFNYKB1\Desktop\HijackThis.exe

Please make a folder here: c:\HJT and place HijackThis in that folder.



I'd like you to check (a file/some files) for Viruses.
c:\docume~1\neil.dhfnykb1\application data\DIRFE845.exe

c:\windows\system32\drivers\gigtm.sys

  • Copy/Paste the first file on the list into the white Upload a file box.
  • Click Send/Submit, and the file will upload to VirusTotal/Jotti, where it will be scanned by several anti-virus programmes.
  • After a while, a window will open, with details of what the scans found.
  • Copy and Paste results in your next reply.
  • Repeat for all files on the list, and post me the details please


OTMoveIt3

Download OTMoveIt3 by Old Timer and save it to your Desktop.
  • Double-click OTMoveIt3.exe to run it.
  • Copy the lines in the codebox below.
Code: Select all
:files
C:\VundoFix Backups
c:\windows\system32\146DDBD198.sys
c:\windows\system32\98D1DB6D14.sys
:commands
[EmptyTemp]

  • Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • OTMI3 may ask to reboot the machine. Please do so if asked.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.
  • Close OTMoveIt3


Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:
  • Virustotal or Jotti results
  • OTMoveIt log
  • A fresh HijackThis Log ( after all the above has been done)
  • A description of how your computer is behaving
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 10th, 2009, 3:02 pm

Thanks for the help,I hope I did everything right.
The computer seems to be doing ok, a little slow at times.

Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.10 -
AhnLab-V3 5.0.0.2 2009.03.10 -
AntiVir 7.9.0.107 2009.03.10 -
Authentium 5.1.0.4 2009.03.10 -
Avast 4.8.1335.0 2009.03.09 -
AVG 8.0.0.237 2009.03.10 -
BitDefender 7.2 2009.03.10 -
CAT-QuickHeal 10.00 2009.03.10 -
ClamAV 0.94.1 2009.03.10 -
Comodo 1043 2009.03.10 -
DrWeb 4.44.0.09170 2009.03.10 -
eSafe 7.0.17.0 2009.03.09 -
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.09 -
F-Secure 8.0.14470.0 2009.03.10 -
Fortinet 3.117.0.0 2009.03.10 -
GData 19 2009.03.10 -
Ikarus T3.1.1.45.0 2009.03.10 -
K7AntiVirus 7.10.665 2009.03.10 -
Kaspersky 7.0.0.125 2009.03.10 -
McAfee 5549 2009.03.10 -
McAfee+Artemis 5549 2009.03.10 -
Microsoft 1.4405 2009.03.10 -
NOD32 3924 2009.03.10 -
Norman 6.00.06 2009.03.10 -
nProtect 2009.1.8.0 2009.03.10 -
Panda 10.0.0.10 2009.03.09 -
PCTools 4.4.2.0 2009.03.10 -
Prevx1 V2 2009.03.10 -
Rising 21.20.11.00 2009.03.10 -
SecureWeb-Gateway 6.7.6 2009.03.10 -
Sophos 4.39.0 2009.03.10 -
Sunbelt 3.2.1858.2 2009.03.10 -
Symantec 1.4.4.12 2009.03.10 -
TheHacker 6.3.3.0.278 2009.03.10 -
TrendMicro 8.700.0.1004 2009.03.10 -
VBA32 None 2009.03.10 -
ViRobot 2009.3.10.1643 2009.03.10 -
VirusBuster 4.5.11.0 2009.03.10 -
Additional information
File size: 8885 bytes
MD5...: 08149d3d8b352a515762043d5126b4d4
SHA1..: 35ec35ffd760bb432f1696324bbad1bc4857e61a
SHA256: 45dc9587ddc36cf36ab3b94dbe54e2c492cdcbeb54030c2e50c2e2e9d5c48807
SHA512: 4f459c1f6b09c9da05644de4bf0b67142c299f62aba116b92f57e6e90e11c290
a20dcfb50b6b6863cb1a02b9f018de3d690e371fe7d977579901139455774891
ssdeep: 192:9CAL3hXLv5Ga6EEM9csA0kCihW8CDJu5WGJ/:j3dLb7lqsAdFhFCDwUGV

PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)

File gigtm.sys received on 03.10.2009 19:05:36 (CET)
Current status: finished

Result: 8/39 (20.51%)
Compact Print results
Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.10 -
AhnLab-V3 5.0.0.2 2009.03.10 Win-Trojan/Avenger.61440
AntiVir 7.9.0.107 2009.03.10 -
Authentium 5.1.0.4 2009.03.10 -
Avast 4.8.1335.0 2009.03.09 -
AVG 8.0.0.237 2009.03.10 -
BitDefender 7.2 2009.03.10 -
CAT-QuickHeal 10.00 2009.03.10 -
ClamAV 0.94.1 2009.03.10 -
Comodo 1043 2009.03.10 -
DrWeb 4.44.0.09170 2009.03.10 -
eSafe 7.0.17.0 2009.03.09 Win32.Banker
eTrust-Vet 31.6.6388 2009.03.09 -
F-Prot 4.4.4.56 2009.03.09 -
F-Secure 8.0.14470.0 2009.03.10 -
Fortinet 3.117.0.0 2009.03.10 PossibleThreat
GData 19 2009.03.10 -
Ikarus T3.1.1.45.0 2009.03.10 -
K7AntiVirus 7.10.665 2009.03.10 -
Kaspersky 7.0.0.125 2009.03.10 -
McAfee 5549 2009.03.10 -
McAfee+Artemis 5549 2009.03.10 -
Microsoft 1.4405 2009.03.10 -
NOD32 3924 2009.03.10 -
Norman 6.00.06 2009.03.10 W32/Renos.CNZ
nProtect 2009.1.8.0 2009.03.10 -
Panda 10.0.0.10 2009.03.09 Rootkit/Agent.LNB
PCTools 4.4.2.0 2009.03.10 Trojan-PWS.Bancos.PWN
Prevx1 V2 2009.03.10 Medium Risk Malware
Rising 21.20.11.00 2009.03.10 -
SecureWeb-Gateway 6.7.6 2009.03.10 -
Sophos 4.39.0 2009.03.10 -
Sunbelt 3.2.1858.2 2009.03.10 -
Symantec 1.4.4.12 2009.03.10 -
TheHacker 6.3.3.0.278 2009.03.10 -
TrendMicro 8.700.0.1004 2009.03.10 -
VBA32 3.12.10.1 2009.03.10 -
ViRobot 2009.3.10.1643 2009.03.10 Hoax..Agent.61440
VirusBuster 4.5.11.0 2009.03.10 -
Additional information
File size: 61440 bytes
MD5...: 589312a3b46721c5a751e4d5222a89be
SHA1..: 3a497d3968a4f6e3c648d196da38e5f98e75ec30
SHA256: 03cbe6df7f5605a3659ffe27a1184a8d9066436a17d7bac9cceb122de74f69ae
SHA512: c8abe050c97efe34541c3ef293a750e34b82117ae41f41d83db1f1489eb5d776
a1d59d0b4a1e13536e5bebda630693daf4be66cc386f587a69288c76df98cf7b
ssdeep: 768:UzNrXvTHr4DU6K5H5VLvDcLugwoMcq5+x7J1uQ9VP:QTG2VrOuN+lJpP

PEiD..: -
TrID..: File type identification
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xd394
timedatestamp.....: 0x476b398b (Fri Dec 21 03:56:59 2007)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x400 0xd756 0xd780 5.52 e0dc8fff10e3a7c6343455cd02a67954
.rdata 0xdb80 0x10e 0x180 3.44 d2fd0bc28e070ccc67879e04b7cd5302
.data 0xdd00 0xc0 0x100 0.04 66a415a49d751cb335895306ecfb3389
INIT 0xde00 0x376 0x380 5.17 79cc3d62ef3ba8053786e08dc9b6cddc
.reloc 0xe180 0xe2c 0xe80 6.60 4f845320301140370066cbceee4c5e4c

( 1 imports )
> ntoskrnl.exe: ZwWriteFile, wcslen, RtlUpcaseUnicodeChar, ZwClose, ZwCreateFile, RtlInitUnicodeString, wcscat, wcscpy, _wcsicmp, ZwQueryValueKey, ZwOpenKey, ZwDeleteKey, swprintf, ZwEnumerateKey, ExFreePoolWithTag, DbgPrint, ExAllocatePoolWithTag, RtlPrefixUnicodeString, RtlDeleteRegistryValue, ZwSetValueKey, RtlWriteRegistryValue, ZwEnumerateValueKey, ZwOpenFile, ZwSetInformationFile, KeTickCount, ZwQueryInformationFile, KeBugCheck, MmGetSystemRoutineAddress, ZwFlushKey, PsTerminateSystemThread, KeSetPriorityThread, KeGetCurrentThread, RtlCheckRegistryKey, KeDelayExecutionThread, ZwReadFile, PsCreateSystemThread, PsGetVersion

( 0 exports )

ThreatExpert info: http://www.threatexpert.com/report.aspx ... d5222a89be
CWSandbox info: http://research.sunbelt-software.com/pa ... d5222a89be
Prevx info: http://info.prevx.com/aboutprogramtext. ... 00289EA8D6

========== FILES ==========
C:\VundoFix Backups moved successfully.
c:\windows\system32\146DDBD198.sys moved successfully.
c:\windows\system32\98D1DB6D14.sys moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\NEIL.DHFNYKB1\Local Settings\Temp\fdr1332.fdr scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\NEIL.DHFNYKB1\Local Settings\Temp\~DFB2C.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS04C5AE95-F415-4590-9945-717732D6FC9D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS054D654D-3A8A-4C93-A247-2EFBC6ABF891.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0B3B86BF-7FFE-41D9-A023-BD4706F289EA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0CDF591B-64A1-459C-8820-B6504EA405AF.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0F91810A-2F65-429C-B6A7-B7A4D0360A78.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS11A658B2-4081-47F8-8A06-EB4F5DA62AE1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS12E861AF-530B-44DB-B82F-55E21A806549.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1C023C29-942A-4376-9A1D-9BA41F47500E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1C5BE08A-D162-4363-BC65-41CD51402CFC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1C671879-3AA5-46B7-88A2-9637AAB84D5C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1EC7A916-7908-468B-9024-78E325E1E743.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS22AB8051-7281-450A-85A3-BAF0015E78A8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS23508905-1210-4E89-92B7-F32196A7B9C2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2500CE61-7B48-43D7-8E2A-C89F9B74702A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS25C25D18-D0DC-46BD-AB3D-816DC9D34160.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2B56ABB2-80D5-41A9-8A62-448C3DB7746E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2D12D6C8-15FE-485D-B016-86CDFB851B3D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS31D55368-7221-413A-A218-7E7FA2D5ECC5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS35F40354-7377-4755-AFAC-0246F6453955.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3676B1BC-BEC4-45BD-B34A-491789A4739D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS37AAC0AC-4ABA-4538-9380-30571A84302E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS38F7FB2E-C4CF-4B0E-9695-AB68EF054712.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3C98ABBD-5CD1-4D0C-AADB-093C4545265B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3CA10681-B75F-47E1-8B3F-D8E3D039EB86.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4043F247-9924-4B39-B14B-58F22A972BC1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS45309F08-159D-4F85-BD6C-061E895EB4CE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS491BDD49-C288-4D45-B6BD-90CA161E238F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS49B9956D-3AE7-4D2E-9EFB-2D15DF7CE28D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4A9BE273-0E97-4C38-BE03-94BCD1B8AA13.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4E8CF7B7-F87B-458C-A88C-73C0524F2939.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS51D9AE8B-09A9-4711-8885-3D7EEA5276E7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS55F786DA-E595-4317-9647-BB57EA30114F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS5957B3CA-BDBC-4D4C-AF1C-58827D52F2DA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS5C9DA856-1DF0-4D02-ABFC-FC58B4C503AF.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS5FF710FF-CF61-4F0F-930D-42EB498A075D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6346B61A-2715-4532-9347-EFC6347CAA11.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS63EEE216-7EBC-4F14-94E3-3AC97DECFF5B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS64442DC6-C81B-43CD-9F82-1EFBB756B888.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS69616333-E812-44D1-A4EC-DC57FB2A34DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6D67E7FD-5928-41E5-87EE-C03DFC0FBD03.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6FD2CC86-53DE-4E35-80EA-B7E24ECD961F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7002CCA2-64A8-4A74-A271-E767F6809CBA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS70901E4A-C7DA-4C77-9C52-FCE2EE45CD43.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS70CEBC1B-5E43-433A-93DB-3E79458EFD1B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS71CF8D7E-1C79-4202-AED9-56FA039E0AF9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS73BF5A1F-BF7C-431F-9C7C-AB14B2040177.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS75739ECE-622A-49BC-A971-8D8E79CD4BAA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS771FF283-6CA1-4BF3-93D1-F8028CA94C08.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS792C5C07-A3A2-4F47-9234-BCF5970B6D67.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7B84B4CF-F49A-4604-BA44-02ED71BD0094.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7DB4DD18-22CC-4112-A428-62B6E5EBE91F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7E7AEFDE-4E22-4D11-AF85-B6E5EDBAA7F4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS80A33CEC-9F7D-4E7E-B86C-D25F0FF91C95.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS832522D7-31B9-440A-9899-89B0F863E250.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8D2506EB-F6CD-4CB7-872F-5D2D939C2E8F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8D57ABB6-5F49-4EEF-9662-4F3CD19C9F98.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8EEF11FD-F63D-4B72-A3C0-4834559440C0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8FC3D2FF-EFDA-446C-9446-BD5B2697067E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS91168117-DBC2-4524-BEC2-BD12C9A4F18D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS91B359F6-084B-48DD-B195-119DF8303624.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS923F3E5B-BB9D-4BB2-91C2-C740744E0E70.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9403A30A-34C6-4677-B597-FD48F5099E16.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS94B311DF-A6BD-45BF-BED6-0C287E090884.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS97156FDD-0CF6-4547-95CB-E8EA531C12BB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9999C28B-E85B-447F-BA6B-407D6A4A79E1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9C3531B2-972E-4126-91B3-B16C06BDAAD7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9D72A1CE-3488-4172-96CE-0C0AA1FE2582.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9F827158-5B91-4686-BF25-BFCD58E3E253.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA1227C58-2E09-418C-A501-6A449C2B77AB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA67C1145-E69C-46F1-9D2C-66A1F2CEF80E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA928E135-6745-4AEE-A078-A21F7D273ECA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAADBA0E9-8FBF-48BC-8ABF-80ED217FDA64.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAD2FDF87-7117-4894-B6B8-E098E65012A0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAF710D7E-0E95-4DF9-91B4-0C17E080392D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB0BB2905-200E-46F7-9035-1A64BEB37338.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB0F882A6-C565-469A-AE20-AE5E70A897FB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB45BAD21-0733-4B0F-91B5-0C18374C7EFB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB4D87177-3853-44FB-87DA-90A60DD4DD41.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB5EEA0B1-3662-47A0-9FDA-A7DD80CC6C3F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB8B5E17E-1B43-4A75-9A21-3560992187C7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBA127AF4-EBF1-458D-A3D0-3624D44453C8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBB27FE3D-A27B-4658-95B5-C18278588184.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC8D06B36-2972-421A-892F-81A8A31AB3EE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSCAD82E78-67FE-4860-BB4F-BCF5DA2BF34D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD2D9FA78-1866-4F81-BA24-E84647FF55EA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD2E470E6-C464-4AA4-BB95-D683EE0BB3B6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD464F8FC-E3EA-4857-9010-FA138767267B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD59237A9-82F3-41AB-98AF-836AC233D5D0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD7DA9562-B96C-4647-9BF2-F79C7484264F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDC83A11F-4F58-4A4C-9B53-2F4520B3CD68.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDD398C65-9B18-46A1-8965-FECFB01C6B90.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDF3EC3E9-F467-4B51-AE14-685DD0C21BED.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDF79F4FD-5F1E-4052-89D2-F562FC12A87F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE019D599-FFEF-46E3-9BF9-4A7F15E0F7F8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE3359CCD-1146-43F9-A082-C18EF4389C6B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE4E30F56-C6FC-4FE6-8B61-C2BD3600BF30.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE6B28E3F-DAFB-4C6D-B2DA-25606566F224.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSECF91481-18EA-49D5-BF95-330BD5D6893A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEDCD4C95-3DD3-4AA9-BCE0-1ACDD8E7CA4C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEEFFC2BA-D608-472A-B8B3-7A1422F91ADD.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEFC90B4A-D91C-4C31-A8AE-EA06E2C59C99.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF3D1F22A-27C6-4627-8C19-D4CA2D929DE5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF86D417C-E72B-4ECC-9F9F-332F86C2F426.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF902567C-0717-466C-BDEC-8DCD1DD596F1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_610.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT03b74.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03102009_125724

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:43 PM, on 3/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\S4F\filter7.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.majorgeeks.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80203
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_custom ... tbid=80203
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=del ... channel=us
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://redirect.zonelabs.com/redirect/r ... hx644bu4g0
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [S4F] "C:\Program Files\S4F\Filter7.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 6117 bytes
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm

Re: Banker trojan?

Unread postby Bio-Hazard » March 10th, 2009, 6:22 pm

Hello!

You did well.

Kaspersky Online Scan

Please go to Kaspersky website and perform an online antivirus scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply along with a fresh HijackThis log.
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 10th, 2009, 8:42 pm

Bio,

I did the Kaspersky scan and everything came back ok, I tried saving a report and it wouldn't let me no matter how many times I tried, but it did come back clear nothing in the report block.

Logfile of HijackThis v1.99.1
Scan saved at 6:36:06 PM, on 3/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\S4F\filter7.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\NEIL.DHFNYKB1\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.majorgeeks.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80203
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_custom ... tbid=80203
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cli ... channel=us
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://redirect.zonelabs.com/redirect/r ... hx644bu4g0
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [S4F] "C:\Program Files\S4F\Filter7.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (http://www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm

Re: Banker trojan?

Unread postby Bio-Hazard » March 11th, 2009, 6:44 pm

Move HijackThis
You currently are running HijackThis from here: C:\Documents and Settings\NEIL.DHFNYKB1\Desktop\HijackThis.exe

Please make a folder here: c:\HJT and place HijackThis in that folder.


Remove HijackThis entries

  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://redirect.zonelabs.com/redirect/r ... hx644bu4g0

  • Close all open windows and browsers/email etc...
  • Click on the Fix Checked button
  • When completed close the application.


OTMoveIt3
  • Double-click OTMoveIt3.exe to run it.
  • Copy the lines in the codebox below.
Code: Select all
:files
c:\windows\system32\drivers\gigtm.sys
:commands
[EmptyTemp]

  • Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • OTMI3 may ask to reboot the machine. Please do so if asked.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.
  • Close OTMoveIt3



Optional Fix

I see that Viewpoint is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto-updating for the Viewpoint Manager -- the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.
To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.

Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything bad. This may change,read Viewpoint to Plunge Into Adware.

I recommend that you remove the Viewpoint products; however, decide for yourself.

To uninstall the the Viewpoint components :
  1. Click Start, point to Settings, and then click Control Panel.
  2. In Control Panel, double-click Add or Remove Programs.
  3. In Add or Remove Programs, highlight >>Viewpoint component<< , click Remove.


    How to prevent it from being recreated every time you run the AOL software:
    • Open AOL
    • Go to Help on the toolbar
    • Select About AOL
    • Hit Ctrl D and a secret panel can be accessed which will allow you to disable all desktop and IM features associated with Viewpoint.


Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:
  • OTMoveIt log
  • A fresh HijackThis Log ( after all the above has been done)
  • A description of how your computer is behaving
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 11th, 2009, 10:55 pm

Thanks Bio,

I got rid of viewpoint, and cleaned up the other stuff, it appears that I don't know where to put HJT so if you could give a small step by step class I would appreciate it. It is in programs now :oops:

c:\windows\system32\drivers\gigtm.sys moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\NEIL.DHFNYKB1\Local Settings\Temp\fdr3948.fdr scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\NEIL.DHFNYKB1\Local Settings\Temp\~DF4ED0.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS00456CCF-3281-4200-86E2-3B7E67175182.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS014FC1F2-EBB0-4B99-953E-DE57E1FF898D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0584A747-6AC3-4E39-A422-CC4F3A8303F9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS064DA1C4-4121-4849-BB47-967A16C6F8B7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS065187E1-7EEA-4E9B-9A00-389DB992DC59.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS07F6429B-B4A5-4AB5-8DC7-9C07832647CB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS084C82DF-3DCF-40E2-9CDE-8AD8FF6D6E5D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS097E2F83-3452-4F34-8C50-71B950479B5C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0B9B81DF-E2F0-41F0-8AC6-9431A3B20B65.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0BE225B9-35C5-493D-A9B6-6417A53C5583.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0CA8075E-8A01-44D2-B3A3-F5F71760717E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS0D2D61B8-3F02-4E06-8542-7219750A5F42.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1011017B-3725-4F29-811B-AC87AA5C9E3D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS10163E0D-C8A9-4D54-BE5E-187983464046.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS125C658E-38EA-4049-B60D-C4605F81C42D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS16429D1A-6254-4E38-AC12-B8097D6C859A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS16FE1CEB-EE5A-442F-8313-B9A2B419BEFB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1790B4B7-E82A-4A0B-9F85-C58D5396BF54.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS17D8B7A8-F2F4-4C0D-80CB-38E3ABACD52D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS18293C5E-9D45-4CAB-B9D4-B039242EB342.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS18B537F4-C91D-4595-B843-2D0F19D75B36.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS192C7CD7-6201-4F8E-81E0-6D00501FB88F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1A533F9D-0E2F-4BB2-BB80-675BB6B72B58.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1BE3323C-E92C-4E76-97F2-0342EC6F90DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1C896E5F-2F3D-47C2-8DAC-7003497F9BB3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1EB7EAE8-83E1-4D06-AB49-560F782EBAFE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS1F69D28F-4A35-4848-B623-3C2C95D5B129.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS20FEFF93-11C0-44DD-9A8D-A95211610850.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS22E4EF86-C11C-482B-A1AC-4D5673DE949E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS234C68FD-7460-46AC-95C0-E63D1F21A0F0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS24E3A6FA-52C4-4ACF-9218-068B0ECF4E33.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2906F9A3-AEF8-432C-A81C-5F655AF65668.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS295B531F-0EFE-4B49-B14F-A555B6C4304A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2B0FE0A1-0621-48DA-A5C3-E9B453A9BC97.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2C937C0A-26E6-4A7E-967A-45805E44C8DA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2CABC98D-11A7-40DD-A44A-5713A5246908.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2CB2D886-8300-425B-8713-462B569B1504.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2D138EB4-0A0A-4D56-9C76-0C971C9CA062.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2D856B67-9ED4-49E1-8119-7C3F9CF613F8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2DEE15D6-6746-4289-B8D6-2A7CE7C4C097.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS2EC09249-9A2D-495F-9314-B271AC0EA429.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS30CBA94D-6B46-4AB6-BE4D-0FC0C3E49BFB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS331BFB6B-9186-4E9A-A60D-313453842B55.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3431DAD4-6651-477C-8D0F-65DCD0124F5C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3452C447-FEED-45F3-A983-F4E4E20BCA29.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3510AD25-94D1-4668-B55E-AF23F8AFAECC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS36C8902C-146D-4CA5-A0CA-367EA4121143.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3728E8CC-A6FA-46FE-80FE-06451B6F5EFD.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS37C7F611-2EC2-48A3-9F56-9DB65D3DA522.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3940017F-0DCA-4D08-A0DC-CE3862D3EB25.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS399E55EF-28F1-40A2-8941-517B05B99388.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3B57540E-7C79-4414-A807-2B2E2339F436.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3B93C29F-BE81-4FE6-BF71-DE83DD67C435.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3C9D84F4-D888-42FF-A40B-AAE97D402A72.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3CA7778C-5B11-4C6F-A995-F39F96831D97.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3E498593-3834-4367-98A8-5367663C1544.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3E72E20C-AA13-4893-86C0-0EC3A7395E71.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3ED85612-C228-47C6-9686-6B90161C39A0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS3FC3F726-2FA5-447B-A554-D8DBD89D2F18.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS411A55AF-9117-4915-925F-A300BD049A23.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4271EF91-A757-4B71-A932-5E1A49439F72.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4544A331-F7EA-45C5-8A1A-E56E3CC1AED7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS45A5D685-97D5-4EFA-879F-C0E875B8829D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS46B5A15C-38F9-4E3D-9452-C14704DC5588.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4B352798-7F68-4458-AFB4-9D6611EF9790.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4F483CDE-6BE1-4C22-AF3D-16EEBFB3C886.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS4F5B66AB-D31D-4D5D-9784-D1E79CC1EE6E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS502FF481-F653-445D-8C4F-65FFC7E5A192.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS50822C05-BA73-479A-9332-5F4E13E72044.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS535C3857-D73B-45BE-A31D-FE28190911D8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS538C7867-5ECA-454E-A167-A2D881FE09E5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS53BE847B-200A-433E-8BB6-53936C2A8B24.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS54150124-A886-4E9E-B2EE-B1E1B4F159BA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS57ACC928-2CD8-4766-B1A5-262C94F361F2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS58447BBE-0852-43E2-A66C-2832A9E30575.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS5A343BC3-F8C4-4961-8AAD-57D2A60018BE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS5D893A3A-ADC1-44EE-831C-96CAA13808C3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6101201D-AE5E-4885-B850-D8E5DCE33551.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6295D0F9-2966-44EA-9437-1A5CDF7414D6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS62E75DBE-498E-42DD-AAF6-E8CD16761D49.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS63147859-983A-4A56-B8EE-783BE290D6A1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS63B62466-173F-4A5A-9FA0-438F52261609.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS64FA3CAB-9BF9-4988-BF5F-CF200BD3D3E7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS651CBCE6-18F1-41E9-BA2C-30D7E328576C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS66886CFF-EDC9-4E56-948B-66E1066AB345.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS688A76E3-96AF-4252-88CB-0931A86189D9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6971BAE8-3865-4513-9F1B-D34529267AB3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS69B01295-0C4C-46EB-99AB-FCA59C8ED01B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6A2D6F6E-70D7-4BFA-AF04-F6B582126836.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6A781394-5056-48C7-8F3D-5C1434C30DC6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6C5B7645-1774-42F6-92C1-0506B89714C1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6C739ED5-7CCD-40A4-95A1-0CB19CE7E08D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6D186474-75C1-40BF-BD49-C3CDC93885DA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6E2AA9F2-EC59-48C1-8693-DEF052779048.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS6E62CE02-6800-4446-97F9-82132FBFF2D3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS70910156-AF36-4013-B7B6-6B0D9E7D99CA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS72B28050-82CB-442F-8842-4CC53D2B4508.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7601ACE8-8A90-45CF-9AF2-DDA3EA31D32F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS77108C0D-02ED-4EC2-9789-3A9698757A2D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS796BC795-F99D-4518-BD75-1DF1069FADDD.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7B4C1E3C-5171-42ED-B1D8-E25D1661C730.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS7DBDE114-953C-4554-A1AF-D2310159CCE8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8165D927-6B74-4AB7-B2C8-3556B0C8D6DC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS819541E0-00A2-4E43-9B4E-8CE54B9A45A6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS84531B7F-7709-4E87-A69E-47BC9CF7E02F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS85482836-6BF7-4E63-9D92-8026E7E950A9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS86E72F34-A62E-4342-828B-AAE99E0EFD77.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS87FCBB8C-D65D-4A23-8F61-5F1A5C6105E1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8888CF60-8D68-4109-BED6-0F206DD100BA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8AB6D1A5-00E3-4F6A-99D0-C1DD67AA8388.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8B47C103-70AB-409D-9814-EE2142C4EE6C.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8BCEA1D6-EB10-47CC-AD0F-B8663CAF9C11.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8C6BF5F7-7C19-492C-AA71-77E6C5CE24BA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8DE18264-0F70-43DD-899F-77E3A6B3CAEC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8E391EBC-EDDD-4736-BB2C-07B652DBD6E4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS8F6C151D-9C76-4AA0-BE6C-D0ADDD0E51AC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9058F566-F44D-4F83-B615-1DAF6ED62005.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9132D36E-733D-4972-9EBA-FB4AB37D853D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS91881913-0E1F-4994-9E9D-482A27C167D0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9703702A-D014-477F-AF9B-1C622EDB267F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS971E229B-7046-4A69-BF90-0140DC7B90C5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9A592350-341F-4C62-9DEF-30A030E67F84.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9D89F40C-221C-4A47-9F6B-31844844E79F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9E39D65A-EBFF-4821-B675-29E4E44A6C8A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9E641896-3BB9-4900-9307-DB8FAE4EDC2B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9E875314-31DB-43EA-90FC-A600FB7491D2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMS9EA91850-D03B-44F1-9D33-42CCB552E7CF.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA4C9CAD5-7639-433B-BAE6-7F46F78D4E85.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA50B07D7-E396-4E4A-8896-BD89F817FB11.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA57E68C0-C155-4DF9-8E7E-ABEB15839C9E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA5CE4046-404C-4A58-AD8A-62AD8E7B01F1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA6256FA3-77D8-46BF-A39F-D6D4F732D91F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA68BD19A-68DB-4A2D-8444-89A816F22871.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSA925A035-72E6-433F-A35A-0E982BA67A47.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAA933D95-982D-4EEF-9356-B15BDC659EE8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAD503F06-A2E4-4D91-8A29-831D431C3CBB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAD6C6DA3-2FCF-4283-88CC-97B3EA668DF1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSADC60D52-8D07-4B5F-8CF9-7BEF565342B5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAF4CADA8-3834-4B32-89EB-B892CAE47073.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAFCB2419-06ED-4E06-AE41-C2C8B043056A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAFF23791-127B-43D5-9125-FB4430B4B5DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSAFF7DD99-23D7-4693-A172-2B88696DCDA2.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB13CCDCA-E4FA-414C-B15E-F05AC81287D4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB15937AF-4568-453A-B935-EFD62422E5F9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB28182C0-82BA-4C49-A301-E1867B66825F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB39F312F-1E39-42EF-A4E9-85A39915355D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB5650C47-206D-4C8F-B1BB-57E454FBA83A.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB6417832-A257-4FF1-9E6E-EACA337A4AA3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSB756E9DE-2F9C-47A4-82FF-8314B38D6334.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBAD810A4-E279-4D25-B00B-3C0D8D762636.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBB1DE943-C7AF-4D67-8F79-D91FCB23A4DB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBC1493C0-8186-4B11-BC53-3A64753A8E87.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBC822A44-5BA1-40F5-BD43-2DC0F1121786.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBEDDC674-9AF1-4E17-B51A-F76A1FE10596.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBF145C25-F93E-42A5-A1FB-4C024D2C5EC9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSBF685D04-7030-407C-8C15-6DAA001D512B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC1FCB527-BBD2-4DFB-87FA-EB77B1FE7A0D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC37CB5CD-E27A-4A8D-8205-C837786E9BEF.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC3F0B87C-D94C-4054-B9B3-C750D9C65015.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC4A5A670-4DDC-4EB3-BB35-AA767A7312C0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC507F7A7-F878-4B03-9F64-4CE95E96D9A8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC5C4B73D-7DE8-463C-A66E-40376451760F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC6C37789-00A6-4BEE-A8E3-85DCF5C01985.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSC88C7230-AE95-4A4C-B79F-9FEAF1BAE829.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSCB56A5DE-C36B-4B24-AB2D-3052E8641711.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSCE7C3BA5-B84C-46C8-8B02-6307A62758D3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSCEED69C7-D9FD-457E-87B3-92ED285DFD9E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD1A9BCED-09AA-430F-933E-AACE173C00FC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD439D122-DEBF-4399-8DE0-A824C8277438.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD461F463-E9AE-43EF-9063-52F0E4872B8E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD54F4A5E-1473-4D01-B7F1-A233527CE4DD.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD5AD2796-57F1-472F-9DED-F14F098B831E.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD80627A2-F425-4F75-9163-BB709FCEA451.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD83A5212-E1BF-41F1-BD94-978E7B3B160F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSD9A60A8A-F035-4FEB-B12F-6800DEDF1772.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDA4B2858-8CE8-49E8-B4CF-45115BD13000.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDA83E88C-9068-4308-802B-5792C15960E3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDC7472CA-C17C-4EA9-9641-04107C7DBB47.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDD75CB09-B048-4941-A7B1-41AD356EE38D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSDE62FB39-8756-47D0-826F-67490643544D.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE388EBCE-BD46-4F72-9D54-4331E3FF4932.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE3A5A1AC-90A9-4EAF-9C92-89A176806385.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE3F6FE41-50BD-478B-89D8-18E04A16735B.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE4FEC0D3-468F-4852-AB01-2589493FC715.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE55409D5-4CB7-461E-B26F-1893D56DB1FC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE674D116-A570-4AF2-B92C-447372BE2854.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE7CFDD65-9A00-416B-9FF6-E2F9D703C7B6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE80D4337-B6BF-4848-896E-085E2F1BF4EC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE91BA4FC-A81F-4FF0-896E-28B5D7EA55BA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE94B6A6B-35EC-4645-B29E-A7A5713341E0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSE9E460A5-8023-42B5-AA73-6C110537D761.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEA25FD0B-26F6-43AB-9030-A2496B338FBA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEBD2AAC1-5112-45B6-A13C-C3B889FC6813.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEC26114D-E841-4905-8746-58AEE07F1CE7.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSEFB2E8B3-AB7B-4BB1-AB43-C0F8215A34EA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF0559EF7-8766-4705-9653-8B67877D77A6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF15184AC-1315-445C-8944-A264A8E881BC.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF2CE577D-E720-46AD-AB51-BE2B0CCCCDAD.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF31B801D-9DD7-4692-A79B-9CD43D289243.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF565BC45-2020-451B-8335-F396AB0C9ECB.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF6091546-C579-48F2-90AD-6DE50AF793DA.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF725DEC3-0BCE-472C-B3D5-068F0FEBB287.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF7AD17CA-69A0-4487-B362-56A5F6137176.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF7DA805A-E00E-429E-A62D-D15C85DE54C3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF874C70E-4D09-4BEC-8E88-B142A27EDEB1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSF8DC8A67-1F17-46EF-8341-2293B17A07D5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSFC630CE1-1B25-4442-AEC3-C9BE0AFD0926.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\wrstemp\SSMSFE672750-FCA6-4763-AC2F-DE340EE5DCFE.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_74c.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT07ae1.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03112009_204003

Files moved on Reboot...
C:\DOCUME~1\NEIL.DHFNYKB1\Local Settings\Temp\fdr3948.fdr moved successfully.
C:\DOCUME~1\NEIL.DHFNYKB1\Local Settings\Temp\~DF4ED0.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS00456CCF-3281-4200-86E2-3B7E67175182.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS014FC1F2-EBB0-4B99-953E-DE57E1FF898D.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS0584A747-6AC3-4E39-A422-CC4F3A8303F9.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS064DA1C4-4121-4849-BB47-967A16C6F8B7.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS065187E1-7EEA-4E9B-9A00-389DB992DC59.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS07F6429B-B4A5-4AB5-8DC7-9C07832647CB.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS084C82DF-3DCF-40E2-9CDE-8AD8FF6D6E5D.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS097E2F83-3452-4F34-8C50-71B950479B5C.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS0B9B81DF-E2F0-41F0-8AC6-9431A3B20B65.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS0BE225B9-35C5-493D-A9B6-6417A53C5583.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS0CA8075E-8A01-44D2-B3A3-F5F71760717E.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS0D2D61B8-3F02-4E06-8542-7219750A5F42.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS1011017B-3725-4F29-811B-AC87AA5C9E3D.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS10163E0D-C8A9-4D54-BE5E-187983464046.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS125C658E-38EA-4049-B60D-C4605F81C42D.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS16429D1A-6254-4E38-AC12-B8097D6C859A.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS16FE1CEB-EE5A-442F-8313-B9A2B419BEFB.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS1790B4B7-E82A-4A0B-9F85-C58D5396BF54.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS17D8B7A8-F2F4-4C0D-80CB-38E3ABACD52D.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS18293C5E-9D45-4CAB-B9D4-B039242EB342.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS18B537F4-C91D-4595-B843-2D0F19D75B36.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS192C7CD7-6201-4F8E-81E0-6D00501FB88F.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS1A533F9D-0E2F-4BB2-BB80-675BB6B72B58.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS1BE3323C-E92C-4E76-97F2-0342EC6F90DE.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS1C896E5F-2F3D-47C2-8DAC-7003497F9BB3.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS1EB7EAE8-83E1-4D06-AB49-560F782EBAFE.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS1F69D28F-4A35-4848-B623-3C2C95D5B129.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS20FEFF93-11C0-44DD-9A8D-A95211610850.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS22E4EF86-C11C-482B-A1AC-4D5673DE949E.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS234C68FD-7460-46AC-95C0-E63D1F21A0F0.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS24E3A6FA-52C4-4ACF-9218-068B0ECF4E33.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS2906F9A3-AEF8-432C-A81C-5F655AF65668.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS295B531F-0EFE-4B49-B14F-A555B6C4304A.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS2B0FE0A1-0621-48DA-A5C3-E9B453A9BC97.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS2C937C0A-26E6-4A7E-967A-45805E44C8DA.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS2CABC98D-11A7-40DD-A44A-5713A5246908.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS2CB2D886-8300-425B-8713-462B569B1504.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS2D138EB4-0A0A-4D56-9C76-0C971C9CA062.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS2D856B67-9ED4-49E1-8119-7C3F9CF613F8.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS2DEE15D6-6746-4289-B8D6-2A7CE7C4C097.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS2EC09249-9A2D-495F-9314-B271AC0EA429.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS30CBA94D-6B46-4AB6-BE4D-0FC0C3E49BFB.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS331BFB6B-9186-4E9A-A60D-313453842B55.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS3431DAD4-6651-477C-8D0F-65DCD0124F5C.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS3452C447-FEED-45F3-A983-F4E4E20BCA29.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS3510AD25-94D1-4668-B55E-AF23F8AFAECC.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS36C8902C-146D-4CA5-A0CA-367EA4121143.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS3728E8CC-A6FA-46FE-80FE-06451B6F5EFD.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS37C7F611-2EC2-48A3-9F56-9DB65D3DA522.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS3940017F-0DCA-4D08-A0DC-CE3862D3EB25.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS399E55EF-28F1-40A2-8941-517B05B99388.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS3B57540E-7C79-4414-A807-2B2E2339F436.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS3B93C29F-BE81-4FE6-BF71-DE83DD67C435.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS3C9D84F4-D888-42FF-A40B-AAE97D402A72.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS3CA7778C-5B11-4C6F-A995-F39F96831D97.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS3E498593-3834-4367-98A8-5367663C1544.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS3E72E20C-AA13-4893-86C0-0EC3A7395E71.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS3ED85612-C228-47C6-9686-6B90161C39A0.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS3FC3F726-2FA5-447B-A554-D8DBD89D2F18.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS411A55AF-9117-4915-925F-A300BD049A23.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS4271EF91-A757-4B71-A932-5E1A49439F72.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS4544A331-F7EA-45C5-8A1A-E56E3CC1AED7.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS45A5D685-97D5-4EFA-879F-C0E875B8829D.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS46B5A15C-38F9-4E3D-9452-C14704DC5588.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS4B352798-7F68-4458-AFB4-9D6611EF9790.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS4F483CDE-6BE1-4C22-AF3D-16EEBFB3C886.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS4F5B66AB-D31D-4D5D-9784-D1E79CC1EE6E.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS502FF481-F653-445D-8C4F-65FFC7E5A192.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS50822C05-BA73-479A-9332-5F4E13E72044.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS535C3857-D73B-45BE-A31D-FE28190911D8.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS538C7867-5ECA-454E-A167-A2D881FE09E5.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS53BE847B-200A-433E-8BB6-53936C2A8B24.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS54150124-A886-4E9E-B2EE-B1E1B4F159BA.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS57ACC928-2CD8-4766-B1A5-262C94F361F2.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS58447BBE-0852-43E2-A66C-2832A9E30575.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS5A343BC3-F8C4-4961-8AAD-57D2A60018BE.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS5D893A3A-ADC1-44EE-831C-96CAA13808C3.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS6101201D-AE5E-4885-B850-D8E5DCE33551.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS6295D0F9-2966-44EA-9437-1A5CDF7414D6.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS62E75DBE-498E-42DD-AAF6-E8CD16761D49.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS63147859-983A-4A56-B8EE-783BE290D6A1.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS63B62466-173F-4A5A-9FA0-438F52261609.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS64FA3CAB-9BF9-4988-BF5F-CF200BD3D3E7.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS651CBCE6-18F1-41E9-BA2C-30D7E328576C.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS66886CFF-EDC9-4E56-948B-66E1066AB345.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS688A76E3-96AF-4252-88CB-0931A86189D9.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS6971BAE8-3865-4513-9F1B-D34529267AB3.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS69B01295-0C4C-46EB-99AB-FCA59C8ED01B.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS6A2D6F6E-70D7-4BFA-AF04-F6B582126836.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS6A781394-5056-48C7-8F3D-5C1434C30DC6.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS6C5B7645-1774-42F6-92C1-0506B89714C1.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMS6C739ED5-7CCD-40A4-95A1-0CB19CE7E08D.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS6D186474-75C1-40BF-BD49-C3CDC93885DA.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS6E2AA9F2-EC59-48C1-8693-DEF052779048.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS6E62CE02-6800-4446-97F9-82132FBFF2D3.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS70910156-AF36-4013-B7B6-6B0D9E7D99CA.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS72B28050-82CB-442F-8842-4CC53D2B4508.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS7601ACE8-8A90-45CF-9AF2-DDA3EA31D32F.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS77108C0D-02ED-4EC2-9789-3A9698757A2D.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS796BC795-F99D-4518-BD75-1DF1069FADDD.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS7B4C1E3C-5171-42ED-B1D8-E25D1661C730.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS7DBDE114-953C-4554-A1AF-D2310159CCE8.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS8165D927-6B74-4AB7-B2C8-3556B0C8D6DC.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS819541E0-00A2-4E43-9B4E-8CE54B9A45A6.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS84531B7F-7709-4E87-A69E-47BC9CF7E02F.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS85482836-6BF7-4E63-9D92-8026E7E950A9.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS86E72F34-A62E-4342-828B-AAE99E0EFD77.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS87FCBB8C-D65D-4A23-8F61-5F1A5C6105E1.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS8888CF60-8D68-4109-BED6-0F206DD100BA.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS8AB6D1A5-00E3-4F6A-99D0-C1DD67AA8388.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS8B47C103-70AB-409D-9814-EE2142C4EE6C.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS8BCEA1D6-EB10-47CC-AD0F-B8663CAF9C11.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS8C6BF5F7-7C19-492C-AA71-77E6C5CE24BA.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS8DE18264-0F70-43DD-899F-77E3A6B3CAEC.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS8E391EBC-EDDD-4736-BB2C-07B652DBD6E4.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS8F6C151D-9C76-4AA0-BE6C-D0ADDD0E51AC.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS9058F566-F44D-4F83-B615-1DAF6ED62005.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS9132D36E-733D-4972-9EBA-FB4AB37D853D.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS91881913-0E1F-4994-9E9D-482A27C167D0.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS9703702A-D014-477F-AF9B-1C622EDB267F.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS971E229B-7046-4A69-BF90-0140DC7B90C5.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS9A592350-341F-4C62-9DEF-30A030E67F84.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMS9D89F40C-221C-4A47-9F6B-31844844E79F.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS9E39D65A-EBFF-4821-B675-29E4E44A6C8A.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS9E641896-3BB9-4900-9307-DB8FAE4EDC2B.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMS9E875314-31DB-43EA-90FC-A600FB7491D2.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMS9EA91850-D03B-44F1-9D33-42CCB552E7CF.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSA4C9CAD5-7639-433B-BAE6-7F46F78D4E85.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSA50B07D7-E396-4E4A-8896-BD89F817FB11.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSA57E68C0-C155-4DF9-8E7E-ABEB15839C9E.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSA5CE4046-404C-4A58-AD8A-62AD8E7B01F1.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSA6256FA3-77D8-46BF-A39F-D6D4F732D91F.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSA68BD19A-68DB-4A2D-8444-89A816F22871.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSA925A035-72E6-433F-A35A-0E982BA67A47.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSAA933D95-982D-4EEF-9356-B15BDC659EE8.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSAD503F06-A2E4-4D91-8A29-831D431C3CBB.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSAD6C6DA3-2FCF-4283-88CC-97B3EA668DF1.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSADC60D52-8D07-4B5F-8CF9-7BEF565342B5.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSAF4CADA8-3834-4B32-89EB-B892CAE47073.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSAFCB2419-06ED-4E06-AE41-C2C8B043056A.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSAFF23791-127B-43D5-9125-FB4430B4B5DE.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSAFF7DD99-23D7-4693-A172-2B88696DCDA2.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSB13CCDCA-E4FA-414C-B15E-F05AC81287D4.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSB15937AF-4568-453A-B935-EFD62422E5F9.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSB28182C0-82BA-4C49-A301-E1867B66825F.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSB39F312F-1E39-42EF-A4E9-85A39915355D.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSB5650C47-206D-4C8F-B1BB-57E454FBA83A.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSB6417832-A257-4FF1-9E6E-EACA337A4AA3.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSB756E9DE-2F9C-47A4-82FF-8314B38D6334.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSBAD810A4-E279-4D25-B00B-3C0D8D762636.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSBB1DE943-C7AF-4D67-8F79-D91FCB23A4DB.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSBC1493C0-8186-4B11-BC53-3A64753A8E87.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSBC822A44-5BA1-40F5-BD43-2DC0F1121786.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSBEDDC674-9AF1-4E17-B51A-F76A1FE10596.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSBF145C25-F93E-42A5-A1FB-4C024D2C5EC9.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSBF685D04-7030-407C-8C15-6DAA001D512B.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSC1FCB527-BBD2-4DFB-87FA-EB77B1FE7A0D.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSC37CB5CD-E27A-4A8D-8205-C837786E9BEF.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSC3F0B87C-D94C-4054-B9B3-C750D9C65015.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSC4A5A670-4DDC-4EB3-BB35-AA767A7312C0.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSC507F7A7-F878-4B03-9F64-4CE95E96D9A8.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSC5C4B73D-7DE8-463C-A66E-40376451760F.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSC6C37789-00A6-4BEE-A8E3-85DCF5C01985.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSC88C7230-AE95-4A4C-B79F-9FEAF1BAE829.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSCB56A5DE-C36B-4B24-AB2D-3052E8641711.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSCE7C3BA5-B84C-46C8-8B02-6307A62758D3.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSCEED69C7-D9FD-457E-87B3-92ED285DFD9E.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSD1A9BCED-09AA-430F-933E-AACE173C00FC.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSD439D122-DEBF-4399-8DE0-A824C8277438.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSD461F463-E9AE-43EF-9063-52F0E4872B8E.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSD54F4A5E-1473-4D01-B7F1-A233527CE4DD.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSD5AD2796-57F1-472F-9DED-F14F098B831E.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSD80627A2-F425-4F75-9163-BB709FCEA451.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSD83A5212-E1BF-41F1-BD94-978E7B3B160F.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSD9A60A8A-F035-4FEB-B12F-6800DEDF1772.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSDA4B2858-8CE8-49E8-B4CF-45115BD13000.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSDA83E88C-9068-4308-802B-5792C15960E3.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSDC7472CA-C17C-4EA9-9641-04107C7DBB47.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSDD75CB09-B048-4941-A7B1-41AD356EE38D.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSDE62FB39-8756-47D0-826F-67490643544D.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSE388EBCE-BD46-4F72-9D54-4331E3FF4932.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSE3A5A1AC-90A9-4EAF-9C92-89A176806385.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSE3F6FE41-50BD-478B-89D8-18E04A16735B.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSE4FEC0D3-468F-4852-AB01-2589493FC715.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSE55409D5-4CB7-461E-B26F-1893D56DB1FC.tmp not found!
File C:\WINDOWS\temp\wrstemp\SSMSE674D116-A570-4AF2-B92C-447372BE2854.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSE7CFDD65-9A00-416B-9FF6-E2F9D703C7B6.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSE80D4337-B6BF-4848-896E-085E2F1BF4EC.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSE91BA4FC-A81F-4FF0-896E-28B5D7EA55BA.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSE94B6A6B-35EC-4645-B29E-A7A5713341E0.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSE9E460A5-8023-42B5-AA73-6C110537D761.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSEA25FD0B-26F6-43AB-9030-A2496B338FBA.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSEBD2AAC1-5112-45B6-A13C-C3B889FC6813.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSEC26114D-E841-4905-8746-58AEE07F1CE7.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSEFB2E8B3-AB7B-4BB1-AB43-C0F8215A34EA.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSF0559EF7-8766-4705-9653-8B67877D77A6.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSF15184AC-1315-445C-8944-A264A8E881BC.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSF2CE577D-E720-46AD-AB51-BE2B0CCCCDAD.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSF31B801D-9DD7-4692-A79B-9CD43D289243.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSF565BC45-2020-451B-8335-F396AB0C9ECB.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSF6091546-C579-48F2-90AD-6DE50AF793DA.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSF725DEC3-0BCE-472C-B3D5-068F0FEBB287.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSF7AD17CA-69A0-4487-B362-56A5F6137176.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSF7DA805A-E00E-429E-A62D-D15C85DE54C3.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSF874C70E-4D09-4BEC-8E88-B142A27EDEB1.tmp not found!
C:\WINDOWS\temp\wrstemp\SSMSF8DC8A67-1F17-46EF-8341-2293B17A07D5.tmp moved successfully.
C:\WINDOWS\temp\wrstemp\SSMSFC630CE1-1B25-4442-AEC3-C9BE0AFD0926.tmp moved successfully.
File C:\WINDOWS\temp\wrstemp\SSMSFE672750-FCA6-4763-AC2F-DE340EE5DCFE.tmp not found!
File C:\WINDOWS\temp\Perflib_Perfdata_74c.dat not found!
File C:\WINDOWS\temp\ZLT07ae1.TMP not found!

Logfile of HijackThis v1.99.1
Scan saved at 8:46:41 PM, on 3/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\S4F\filter7.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.majorgeeks.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80203
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_custom ... tbid=80203
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=del ... channel=us
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [S4F] "C:\Program Files\S4F\Filter7.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - http://support.f-secure.com/enu/home/on ... /fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm

Re: Banker trojan?

Unread postby Bio-Hazard » March 12th, 2009, 2:58 pm

Hello!

HijackThis is now in a right place.

How is your computer running now?
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 12th, 2009, 3:28 pm

Bio,

My computer has always ran fine, this all stems back to the banker trojan I got when running advanced care, was this a false virus, was this just them trying to get me to buy their product?
None of my other anti spyware showed a thing.
Thanks alot for all the help.
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm

Re: Banker trojan?

Unread postby Bio-Hazard » March 12th, 2009, 4:05 pm

Hello!

I would like to check that registry key, before i can answer to your question.

RegQuery by Noviciate

Please download RegQuery by Noviciate to your desktop
  • Copy the following registry keypath by highlighting the text and pressing CTRL and C at the same time
      HKEY_local_Machine\software\sos
  • Double click RegQuery.exe to run the program
  • Paste the text you have copied using CRTL and V, into the textbox
  • Click the Query button
  • A Notepad file will open. Please paste the contents in your next reply
  • You may now close the RegQuery program
User avatar
Bio-Hazard
MRU Master Emeritus
 
Posts: 4078
Joined: May 10th, 2007, 8:28 am
Location: Cornwall, UK

Re: Banker trojan?

Unread postby halbibabe » March 12th, 2009, 4:15 pm

here it is

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\sos]

[HKEY_LOCAL_MACHINE\software\sos\Internet Settings]
"ProxyEnable"=dword:00000000
"User"=""
"Password"=""
"Address"=""
"Port"=dword:00000000
"New Value #1"=hex(7):00,00

[HKEY_LOCAL_MACHINE\software\sos\LEAFIR]
"numberOfAsyncThreads"=dword:00000007
halbibabe
Active Member
 
Posts: 9
Joined: February 24th, 2009, 3:16 pm
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 46 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware