Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

New User: Sick PC.. What to do?

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

pc results

Unread postby heathermarie73 » August 23rd, 2007, 10:17 pm

My pc is still experiencing booting difficulties. I had to reboot 3 times, finally the only way I could get it to boot was to press the enter key about a billion times. Other than that.. it seems to be running okay so far.. The Opera part of the Run AFT Cleaner was not clickable. I was unable to utilize that part of the progam.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, August 23, 2007 7:31:58 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 23/08/2007
Kaspersky Anti-Virus database records: 388347
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\

Scan Statistics:
Total number of scanned objects: 36576
Number of viruses found: 11
Number of infected objects: 28
Number of suspicious objects: 6
Duration of the scan process: 02:42:08

Infected Object Name / Virus Name / Last Action
C:\B7.tmp/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\B7.tmp NSIS: infected - 1 skipped
C:\B8.tmp/stream/data0003 Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\B8.tmp/stream Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\B8.tmp NSIS: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PurityScan.zip/offun.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PurityScan.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip/retadpu72.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots\RegDPF-Global.reg Suspicious: Exploit.HTML.Mht skipped
C:\Documents and Settings\Heather\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Heather\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Heather\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Trend Micro\HijackThis\backups\backup-20070822-131402-338 Suspicious: Exploit.HTML.Mht skipped
C:\Program Files\Windows Media Player\hoqeri4444.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP193\change.log Object is locked skipped
C:\Temp\bY001.exe/data0002/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\Temp\bY001.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\Temp\bY001.exe/data0006 Infected: Virus.Win32.Virut.i skipped
C:\Temp\bY001.exe/data0007 Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Temp\bY001.exe/data0008 Infected: Trojan-Dropper.Win32.Agent.mu skipped
C:\Temp\bY001.exe NSIS: infected - 5 skipped
C:\VundoFix Backups\tuvuttr.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\EventCache\{D50619AF-DB76-4400-B95B-002F9FD8D5DA}.bin Object is locked skipped
C:\WINNT\SoftwareDistribution\EventCache\{E3E867A5-DDAC-4A5E-97C7-D691F2B1FEAF}.bin Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\system32\byxxyvv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\system.LOG Object is locked skipped
C:\WINNT\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINNT\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINNT\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINNT\system32\h323log.txt Object is locked skipped
C:\WINNT\system32\jpibdljd.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\myybenwd.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\okrdpkgx.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\opnomlm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINNT\system32\scqfrbgl.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\slqexlnf.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\vjjgnlli.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINNT\system32\X1\kmhp83122.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\WINNT\system32\X1\kmhp83122.exe NSIS: infected - 1 skipped
C:\WINNT\system32\xobxfnvg.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\WINNT\system32\yayvtqo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINNT\TTC-4444.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\WINNT\TTC-4444.exe NSIS: infected - 1 skipped
C:\WINNT\wiadebug.log Object is locked skipped
C:\WINNT\wiaservc.log Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped

Scan process completed.

ComboFix 07-08-17.2 - "Heather" 2007-08-23 19:53:48.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.67 [GMT -4:00]


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-23 19:34 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-23 17:19 <DIR> d-------- C:\WINNT\system32\SoftwareDistribution
2007-08-23 16:37 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2007-08-23 16:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-22 18:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PopCap
2007-08-21 13:30 <DIR> d-------- C:\WINNT\system32\PreInstall
2007-08-21 13:29 22,752 --a------ C:\WINNT\system32\spupdsvc.exe
2007-08-21 00:49 <DIR> d---s---- C:\DOCUME~1\ADMINI~1\UserData
2007-08-20 22:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Comodo
2007-08-20 17:30 <DIR> d-------- C:\VundoFix Backups
2007-08-20 17:26 <DIR> d-------- C:\DOCUME~1\Heather\APPLIC~1\Comodo
2007-08-20 17:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-08-20 17:19 <DIR> d-------- C:\Program Files\Comodo
2007-08-20 13:30 83,456 --a------ C:\WINNT\system32\mtxoci.dll
2007-08-20 13:30 64,512 --a------ C:\WINNT\system32\mtxclu.dll
2007-08-20 13:21 <DIR> d--h----- C:\WINNT\$hf_mig$
2007-08-20 13:04 <DIR> d-------- C:\WINNT\Prefetch
2007-08-20 11:42 <DIR> d-------- C:\WINNT\ServicePackFiles
2007-08-20 11:42 <DIR> d-------- C:\WINNT\ehome
2007-08-20 11:12 9,216 --a------ C:\WINNT\system32\wuauserv.dll
2007-08-20 11:12 86,016 --a------ C:\WINNT\system32\xactsrv.dll
2007-08-20 11:12 56,832 --a------ C:\WINNT\system32\wzcdlg.dll
2007-08-20 11:12 446,464 --a------ C:\WINNT\system32\wmvdmoe.dll
2007-08-20 11:12 38,912 --a------ C:\WINNT\system32\wsnmp32.dll
2007-08-20 11:12 264,704 --a------ C:\WINNT\system32\wzcsvc.dll
2007-08-20 11:12 247,808 --a------ C:\WINNT\system32\wow32.dll
2007-08-20 11:12 24,576 --------- C:\WINNT\system32\odbcbcp.dll
2007-08-20 11:12 23,552 --a------ C:\WINNT\system32\wzcsapi.dll
2007-08-20 11:12 172,664 --a------ C:\WINNT\system32\xenroll.dll
2007-08-20 11:12 17,408 --a------ C:\WINNT\system32\wtsapi32.dll
2007-08-20 11:12 13,312 --a------ C:\WINNT\system32\wship6.dll
2007-08-20 11:11 86,528 --a------ C:\WINNT\system32\wlnotify.dll
2007-08-20 11:11 77,824 --a------ C:\WINNT\system32\wmpstub.exe
2007-08-20 11:11 51,200 --a------ C:\WINNT\system32\wmerrenu.dll
2007-08-20 11:11 48,128 --a------ C:\WINNT\system32\winsta.dll
2007-08-20 11:11 311,327 --a------ C:\WINNT\system32\wmv8dmod.dll
2007-08-20 11:11 296,448 --a------ C:\WINNT\system32\wmstream.dll
2007-08-20 11:11 168,448 --a------ C:\WINNT\system32\wldap32.dll
2007-08-20 11:11 118,784 --a------ C:\WINNT\system32\wmsdmoe.dll
2007-08-20 11:10 9,856 --------- C:\WINNT\system32\drivers\tunmp.sys
2007-08-20 11:10 88,064 --a------ C:\WINNT\system32\tscfgwmi.dll
2007-08-20 11:10 81,920 --a------ C:\WINNT\system32\trkwks.dll
2007-08-20 11:10 61,952 --a------ C:\WINNT\system32\webclnt.dll
2007-08-20 11:10 60,416 --a------ C:\WINNT\system32\wextract.exe
2007-08-20 11:10 48,640 --a------ C:\WINNT\system32\vdmredir.dll
2007-08-20 11:10 479,261 --a------ C:\WINNT\system32\vbscript.dll
2007-08-20 11:10 47,616 --a------ C:\WINNT\system32\utilman.exe
2007-08-20 11:10 409,088 --a------ C:\WINNT\system32\vssapi.dll
2007-08-20 11:10 40,960 --a------ C:\WINNT\system32\tscupgrd.exe
2007-08-20 11:10 384,000 --a------ C:\WINNT\system32\themeui.dll
2007-08-20 11:10 339,456 --a------ C:\WINNT\system32\usp10.dll
2007-08-20 11:10 32,256 --a------ C:\WINNT\system32\umandlg.dll
2007-08-20 11:10 266,752 --a------ C:\WINNT\winhlp32.exe
2007-08-20 11:10 231,424 --a------ C:\WINNT\system32\upnpui.dll
2007-08-20 11:10 22,016 --a------ C:\WINNT\system32\udhisapi.dll
2007-08-20 11:10 203,264 --a------ C:\WINNT\system32\uxtheme.dll
2007-08-20 11:10 171,520 --a------ C:\WINNT\system32\winmm.dll
2007-08-20 11:10 165,376 --a------ C:\WINNT\system32\w32time.dll
2007-08-20 11:10 164,864 --a------ C:\WINNT\system32\upnphost.dll
2007-08-20 11:10 16,384 --a------ C:\WINNT\system32\watchdog.sys
2007-08-20 11:10 16,384 --a------ C:\WINNT\system32\ups.exe
2007-08-20 11:10 124,928 --a------ C:\WINNT\system32\webvw.dll
2007-08-20 11:10 120,320 --a------ C:\WINNT\system32\upnp.dll
2007-08-20 11:10 119,808 --a------ C:\WINNT\system32\wiadss.dll
2007-08-20 11:10 107,008 --a------ C:\WINNT\system32\umpnpmgr.dll
2007-08-20 11:10 10,752 --a------ C:\WINNT\system32\tracert.exe
2007-08-20 11:09 82,944 --a------ C:\WINNT\system32\smlogsvc.exe
2007-08-20 11:09 8,192 --a------ C:\WINNT\system32\scrnsave.scr
2007-08-20 11:09 75,912 --a------ C:\WINNT\system32\rdpwsx.dll
2007-08-20 11:09 74,240 --a------ C:\WINNT\system32\rtcshare.exe
2007-08-20 11:09 72,192 --a------ C:\WINNT\system32\telnet.exe
2007-08-20 11:09 71,168 --a------ C:\WINNT\system32\storprop.dll
2007-08-20 11:09 71,168 --a------ C:\WINNT\system32\sdbinst.exe
2007-08-20 11:09 674,816 --a------ C:\WINNT\system32\sxs.dll
2007-08-20 11:09 667,648 --a------ C:\WINNT\system32\ss3dfo.scr
2007-08-20 11:09 66,560 --a------ C:\WINNT\system32\spoolss.dll
2007-08-20 11:09 66,048 --a------ C:\WINNT\system32\sigverif.exe
2007-08-20 11:09 638,976 --a------ C:\WINNT\system32\sstext3d.scr
2007-08-20 11:09 63,488 --a------ C:\WINNT\system32\srclient.dll
2007-08-20 11:09 62,976 --a------ C:\WINNT\system32\shgina.dll
2007-08-20 11:09 61,952 --a------ C:\WINNT\system32\sti.dll
2007-08-20 11:09 60,416 --a------ C:\WINNT\system32\shimeng.dll
2007-08-20 11:09 6,144 --a------ C:\WINNT\system32\sensapi.dll
2007-08-20 11:09 569,344 --a------ C:\WINNT\system32\sspipes.scr
2007-08-20 11:09 56,320 --a------ C:\WINNT\system32\remotepg.dll
2007-08-20 11:09 534,016 --a------ C:\WINNT\system32\spider.exe
2007-08-20 11:09 52,224 --a------ C:\WINNT\system32\secur32.dll
2007-08-20 11:09 5,504 --------- C:\WINNT\system32\drivers\smbali.sys
2007-08-20 11:09 48,128 --a------ C:\WINNT\system32\reg.exe
2007-08-20 11:09 44,032 --a------ C:\WINNT\system32\regapi.dll
2007-08-20 11:09 43,008 --a------ C:\WINNT\system32\ssdpsrv.dll
2007-08-20 11:09 420,864 --a------ C:\WINNT\system32\shimgvw.dll
2007-08-20 11:09 364,544 --a------ C:\WINNT\system32\ssflwbox.scr
2007-08-20 11:09 36,352 --a------ C:\WINNT\system32\sens.dll
2007-08-20 11:09 334,848 --a------ C:\WINNT\system32\smlogcfg.dll
2007-08-20 11:09 33,280 --a------ C:\WINNT\system32\shmgrate.exe
2007-08-20 11:09 3,338 --a------ C:\WINNT\system32\redir.exe
2007-08-20 11:09 297,984 --a------ C:\WINNT\system32\scesrv.dll
2007-08-20 11:09 27,136 --a------ C:\WINNT\system32\ssdpapi.dll
2007-08-20 11:09 251,904 --a------ C:\WINNT\system32\strmdll.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-22 18:15 --------- d-------- C:\Program Files\Lx_cats
2007-08-21 12:22 --------- d-------- C:\Program Files\eGames
2007-08-21 12:12 --------- d-------- C:\Program Files\Chuzzle Deluxe
2007-08-20 14:43 --------- d-------- C:\Program Files\MSN Messenger
2007-08-20 11:53 2682 --a------ C:\WINNT\pchealth\HELPCTR\PackageStore\SkuStore.bin
2007-08-20 11:49 --------- d-------- C:\Program Files\Messenger
2007-08-20 11:41 --------- d-------- C:\Program Files\Movie Maker
2007-08-11 15:11 --------- d-------- C:\Program Files\Yahoo!
2007-08-10 14:47 --------- d-------- C:\Program Files\Common Files\Scanner
2007-08-07 19:50 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Wal-Mart Digital Photo Manager
2007-07-30 19:19 92504 --a------ C:\WINNT\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINNT\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINNT\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINNT\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINNT\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINNT\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINNT\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINNT\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINNT\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINNT\system32\wups.dll
2007-07-22 04:50 --------- d-------- C:\Program Files\Windows Live Toolbar
2007-07-22 03:15 --------- d-------- C:\Program Files\eMusic Download Manager
2007-07-21 01:15 --------- d-------- C:\Program Files\Real
2007-07-21 01:13 --------- d--h----- C:\Program Files\WindowsUpdate
2007-07-11 13:10 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Wal-Mart Digital Photo Viewer
2007-07-11 13:06 --------- d-------- C:\Program Files\Wal-Mart
2007-07-11 13:06 --------- d-------- C:\Program Files\Common Files\HP
2007-07-11 13:02 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-11 13:02 --------- d-------- C:\Program Files\aVinci
2007-07-11 13:02 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\InstallShield
2007-06-26 18:51 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Yahoo!
2007-06-26 14:16 --------- d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint
2007-03-12 17:44 271 ---hs---- C:\Program Files\desktop.ini
2007-03-12 17:44 21952 --ah-c--- C:\Program Files\folder.htt
2005-07-29 20:24:26 472 --sha-r C:\WINNT\VXNlcg\prh5w0.vbs


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C8C899C-437C-3FDD-2974-39B67F38F2C2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3D7DE6B8-603E-40A1-BB8F-585584718B00}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CE228ECA-E9DE-4D4F-BFC6-06449D1862D1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB570C0A-4881-4222-953F-FA1597452335}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E76CAA55-332F-41C6-B0CC-D03CF5078A03}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EFB96FBB-095A-422B-968B-68DBACC2B0CE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F64ADC5C-78F5-4B33-8EC1-EF1D51C949DC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2001-08-23 08:00 C:\WINNT\system32\mobsync.exe]
"lxctmon.exe"="C:\Program Files\Lexmark 5400 Series\lxctmon.exe" [2006-11-22 05:11]
"Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [2006-11-22 05:12]
"EzPrint"="C:\Program Files\Lexmark 5400 Series\ezprint.exe" [2006-11-22 05:11]
"LXCTCATS"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 08:27]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 10:31]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]
"Affntiog"="C:\Program Files\Common Files\??pPatch\w?crtupd.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Outlook Express\prolyzuqo.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxur]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuttr]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtutu]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

R3 neo20xx;neo20xx;C:\WINNT\System32\DRIVERS\neo20xx.sys
R3 W8335XP;3Com OfficeConnect Wireless 54Mbps 11g PC Card Driver;C:\WINNT\System32\DRIVERS\MRV8335XP.sys
R3 wdm_nm6;NeoMagic MagicMedia 256 + AC97 Driver (WDM);C:\WINNT\System32\drivers\nm6wdm.sys
S3 DLINK11G;D-Link AirPlus G Wireless Adapter;C:\WINNT\System32\DRIVERS\TNET1130.SYS
S3 DLKRCB;D-Link DFE-690TXD CardBus PC Card;C:\WINNT\System32\DRIVERS\DLKRCB.SYS
S3 maestro;ESS Maestro 3 Audio Driver (WDM);C:\WINNT\System32\drivers\es198x.sys
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINNT\System32\DRIVERS\usb8023.sys

*Newly Created Service* - ALG
*Newly Created Service* - CATCHME
*Newly Created Service* - IPNAT

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 19:56:36
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

C:\WINNT\system32\cmd.exe [3324] 0x8165D750


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 19:58:11
C:\ComboFix-quarantined-files.txt ... 2007-08-23 19:57
C:\ComboFix2.txt ... 2007-08-23 19:50

--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:39 PM, on 8/23/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\lxctcoms.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\wuauclt.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\good program.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.x/24
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {3964D8D6-86D0-493A-B460-A805B5401114} - (no file)
O2 - BHO: (no name) - {3C8C899C-437C-3FDD-2974-39B67F38F2C2} - (no file)
O2 - BHO: (no name) - {3D7DE6B8-603E-40A1-BB8F-585584718B00} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - (no file)
O2 - BHO: (no name) - {CE228ECA-E9DE-4D4F-BFC6-06449D1862D1} - (no file)
O2 - BHO: (no name) - {DB570C0A-4881-4222-953F-FA1597452335} - (no file)
O2 - BHO: (no name) - {E76CAA55-332F-41C6-B0CC-D03CF5078A03} - (no file)
O2 - BHO: (no name) - {EFB96FBB-095A-422B-968B-68DBACC2B0CE} - (no file)
O2 - BHO: (no name) - {F64ADC5C-78F5-4B33-8EC1-EF1D51C949DC} - (no file)
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Affntiog] "C:\Program Files\Common Files\??pPatch\w?crtupd.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZCxdm238MGUS
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: http://www.malwareremoval.com/forum
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/games/ ... /tt5_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/games/ ... poti_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... urrent.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resou ... NPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} -
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - Winlogon Notify: cbxur - C:\WINNT\
O20 - Winlogon Notify: tuvuttr - C:\WINNT\
O20 - Winlogon Notify: vtutu - C:\WINNT\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxct_device - - C:\WINNT\System32\lxctcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O24 - Desktop Component 0: (no name) - C:\Program Files\Outlook Express\prolyzuqo.html

--
End of file - 8032 bytes
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC
Advertisement
Register to Remove

Unread postby John B. » August 24th, 2007, 1:28 pm

Can you please post the contents of C:\ComboFix-quarantined-files.txt
User avatar
John B.
MRU Master Emeritus
 
Posts: 4568
Joined: May 14th, 2006, 5:05 am
Location: The Netherlands

ComboFix File

Unread postby heathermarie73 » August 24th, 2007, 9:37 pm

Dear John,

This file is empty. I have my settings for my files to even show all hidden files.. Do you want me to re-run ComboFix?

Sincerely,

HeatherMarie
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Unread postby John B. » August 25th, 2007, 4:09 am

The file should be empty ;) I found a lot of bad files and registery stuff, but to be sure I didn't miss anything I'll ask for a second opinion on the Kaspersky and ComboFix log. This may take a day.
User avatar
John B.
MRU Master Emeritus
 
Posts: 4568
Joined: May 14th, 2006, 5:05 am
Location: The Netherlands

Unread postby John B. » August 25th, 2007, 7:41 am

Hi,

Please follow my instructions carefully :)

Please copy the fix to Notepad/Word, or print it, because you won't always have internet access!

Step 1: Download and Run OiUninstaller
Download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Step 2: Remove bad HijackThis entries
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com

    R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

    O2 - BHO: (no name) - {3964D8D6-86D0-493A-B460-A805B5401114} - (no file)
    O2 - BHO: (no name) - {3C8C899C-437C-3FDD-2974-39B67F38F2C2} - (no file)
    O2 - BHO: (no name) - {3D7DE6B8-603E-40A1-BB8F-585584718B00} - (no file)

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - (no file)
    O2 - BHO: (no name) - {CE228ECA-E9DE-4D4F-BFC6-06449D1862D1} - (no file)
    O2 - BHO: (no name) - {DB570C0A-4881-4222-953F-FA1597452335} - (no file)
    O2 - BHO: (no name) - {E76CAA55-332F-41C6-B0CC-D03CF5078A03} - (no file)
    O2 - BHO: (no name) - {EFB96FBB-095A-422B-968B-68DBACC2B0CE} - (no file)
    O2 - BHO: (no name) - {F64ADC5C-78F5-4B33-8EC1-EF1D51C949DC} - (no file)

    O4 - HKCU\..\Run: [Affntiog] "C:\Program Files\Common Files\??pPatch\w?crtupd.exe"

    O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} -

    O20 - Winlogon Notify: cbxur - C:\WINNT\
    O20 - Winlogon Notify: tuvuttr - C:\WINNT\
    O20 - Winlogon Notify: vtutu - C:\WINNT\

    O24 - Desktop Component 0: (no name) - C:\Program Files\Outlook Express\prolyzuqo.html

  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.
Step 3: Delete bad folders
Use Explorer to navigate to and delete the following folders (if present):

C:\Program Files\Common Files\*pPatch\ << Note: The * means I don't know the whole foldername, but it ends with pPatch.
C:\Program Files\MCROSO*\ << Note: The * means I don't know the whole foldername.

Now just exit Explorer.

Step 4: Run CFScript
Open Notepad and copy/paste the text in the box into the window:

Code: Select all
File::
C:\B7.tmp
C:\B8.tmp
C:\Program Files\Outlook Express\prolyzuqo.html
C:\Program Files\Windows Media Player\hoqeri4444.dll
C:\Temp\bY001.exe
C:\WINNT\Downloaded Program Files\popcaploader.dll
C:\WINNT\system32\byxxyvv.dll
C:\WINNT\system32\jpibdljd.exe
C:\WINNT\system32\myybenwd.exe
C:\WINNT\system32\okrdpkgx.exe
C:\WINNT\system32\opnomlm.dll
C:\WINNT\system32\scqfrbgl.exe
C:\WINNT\system32\slqexlnf.exe
C:\WINNT\system32\vjjgnlli.exe
C:\WINNT\system32\xobxfnvg.exe
C:\WINNT\system32\yayvtqo.dll
C:\WINNT\TTC-4444.exe

Folder::
C:\Documents and Settings\All Users\Application Data\PopCap\
C:\Documents and Settings\Administrator\Application Data\Comodo\
C:\Documents and Settings\Heather\Application Data\Comodo\
C:\Documents and Settings\All Users\Application Data\Comodo\
C:\Program Files\Comodo\
C:\WINNT\system32\X1\ 
C:\WINNT\VXNlcg\


Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Step 5: Run ATF Cleaner
Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Step 6: Run Kaspersky Online Scan
Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky,
Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    • Scan using the following Anti-Virus database:
      Extended (if available otherwise Standard)
    • Scan Options:
      Scan Archives Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
      Select My Computer
  • The program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
Step 7: Download and Run Gmer
Download Gmer to your Desktop and unzip it to your Desktop.
http://www.gmer.net/gmer.zip

Disconnect from internet and close running programs.
There is a small chance this application may crash your computer so save any work you have open.
Double click gmer.exe.
Let the gmer.sys driver load if asked.
If it gives you a warning at program start about rootkit activity and asks if you want to run scan...say Ok.
If no warning....
Click the rootkit tab
To the right of the program you will see a bunch of boxes that have been checked... leave everything checked. Then click the Scan button. Wait for the scan to finish.
Once done click the Copy button.
Open Notepad and hit ctrl+v to paste the log. Save the log to your desktop please.

Step 8: Post logs
Please post the following logs in a reply to this topic (you may need several replies):
  • Tell me how your computer is running
  • ComboFix log
  • Kaspersky log
  • Gmer log
  • Fresh HijackThis log

Greets, John.
User avatar
John B.
MRU Master Emeritus
 
Posts: 4568
Joined: May 14th, 2006, 5:05 am
Location: The Netherlands

ComboFix Log

Unread postby heathermarie73 » August 26th, 2007, 5:58 pm

I did two of these because I had turned on my SpyBot and had forgotten, so I had to re-run it.
Here they are in order that I ran them.

ComboFix 07-08-17.2 - "Heather" 2007-08-25 12:20:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.80 [GMT -4:00]
Command switches used :: C:\Documents and Settings\Heather\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\B7.tmp
C:\B8.tmp
C:\Program Files\Outlook Express\prolyzuqo.html
C:\Program Files\Windows Media Player\hoqeri4444.dll
C:\Temp\bY001.exe
C:\WINNT\Downloaded Program Files\popcaploader.dll
C:\WINNT\system32\byxxyvv.dll
C:\WINNT\system32\jpibdljd.exe
C:\WINNT\system32\myybenwd.exe
C:\WINNT\system32\okrdpkgx.exe
C:\WINNT\system32\opnomlm.dll
C:\WINNT\system32\scqfrbgl.exe
C:\WINNT\system32\slqexlnf.exe
C:\WINNT\system32\vjjgnlli.exe
C:\WINNT\system32\xobxfnvg.exe
C:\WINNT\system32\yayvtqo.dll
C:\WINNT\TTC-4444.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\B7.tmp
C:\B8.tmp
C:\Documents and Settings\Administrator\Application Data\Comodo\
C:\Documents and Settings\Administrator\Application Data\Comodo\\PersonalFirewall\Data\TempFiles\clp_files_update.ini
C:\Documents and Settings\All Users\Application Data\Comodo\
C:\Documents and Settings\All Users\Application Data\PopCap\
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\_version.bin
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Chuzzle.dll
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Data\gamedata.cfg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Arial10Bold.txt
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Arial10Bold_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Bauhaus9314.txt
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Bauhaus9314_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Bauhaus9318.txt
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Bauhaus9318_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Bauhaus9328.txt
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\Bauhaus9328_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\TexasLED16.txt
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Fonts\TexasLED16_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\BadMove.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\BigBang.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\BigScore.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\BonusTing.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Bottled.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\BreakLock.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\bubble1.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\bubble2.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_badmove.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_bigbang.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_bigscore.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_bonusting.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_bottled.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_breaklock.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_bubble1.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_bubble2.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_cascadepop.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_chuzzled.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_chuzzleddoom.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_click.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_cough.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_eyebonus.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_eyesescape.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_flash.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_gameover.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_gameselect.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_go.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_hilite.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_hugesneeze.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_levelup.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_leveluppop.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_lockclank.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_lockit.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_manychuzzles.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_multipop.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_nomoremoves.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_oggleoggle.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_plugbottle.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_pokechuzzle.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_pop.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_pop2.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_pop3.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_pop4.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_pop5.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_popshriek1.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_popshriek2.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_popshriek3.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_popshriek4.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_popshriek5.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_popshriek6.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_ready.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_releasechuzzles.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_scramble.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_shakebottle.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_shuffle.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_smallsneeze.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_ting.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cached_transition.wav
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\CascadePop.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Chuzzled.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\ChuzzledDoom.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Click.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\cough.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\eyebonus.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\EyesEscape.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Flash.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\gameover.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\GameSelect.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Go.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Hilite.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\hugesneeze.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\LevelUp.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\LevelupPop.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\LockClank.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\lockit.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\ManyChuzzles.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Multipop.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\NoMoreMoves.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\oggleoggle.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PlugBottle.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\pokechuzzle.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Pop.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Pop2.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Pop3.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Pop4.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Pop5.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PopShriek1.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PopShriek2.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PopShriek3.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PopShriek4.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PopShriek5.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\PopShriek6.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Ready.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\ReleaseChuzzles.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Scramble.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\ShakeBottle.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Shuffle.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\smallsneeze.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Ting.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Sounds\Transition.ogg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg1.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg2.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg3.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg4.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg5.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg6.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg7.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg8.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Backdrops\bkg9.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Border.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Border_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Bottle.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Bottle_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\BottleFill_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Burst_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ChaBoom.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ChaBoom_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Chuzzle-Base.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Chuzzle-Base_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Chuzzle-Hilite_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Chuzzle-Splode.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Chuzzle-Splode_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ColorblindSymbols.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ColorblindSymbols_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Combo.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Combo_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Cork.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Cork_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Cursors.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\DialogBox.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\DialogBox_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Eyes.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Eyes_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\FizzyStar_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\GameOver.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\GameOver_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\GameOverCircle.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\GameOverCircle_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Go.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Go_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\HintArrow_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\HintButton.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\HintButton_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\HintButton_Halo_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\HintCircle_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelStar.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelStar_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelupBonus.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelupBonus_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelUpDisplay.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelUpDisplay_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelupDoors.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LevelupLight_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Lock.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Lock_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\LockGlints_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\MainMenuButton.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\MainMenuButton_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Marquee.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Marquee_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\MenuButton.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\MenuButton_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\NakedChuzzle.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\NakedChuzzle_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\NoMoreMovesCircle.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\NoMoreMovesCircle_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\NoMoreMovesText.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\NoMoreMovesText_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\OkayButton.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\OkayButton_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Paused.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Paused_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\playbutton.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\playbutton_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Pupils.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Pupils_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Rainbow.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\RainbowSplode.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\RainbowSplode_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Ready.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Ready_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ReleaseRainbow.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ReleaseRainbow_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\RetroCircle_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ScoreUp.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\ScoreUp_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\SodaPop_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Star_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\SuperEffect_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\TransitionStar1.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\TransitionStar1_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\TransitionStar2.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\TransitionStar2_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\TutorBorder.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\TutorBorder_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\tutorialbackground.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Wince.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\Wince_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\WonderGlare.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Textures\WonderGlare_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\upsell_dlver.txt
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\AdoptText.xml
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_BigChuzzleBase.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_BigChuzzleBase_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_BigChuzzleHilite.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_DLBtn.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_DLBtn_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_DownloadNowMarquee.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_DownloadNowMarquee_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_MorePage1.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_MorePage1_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_MorePage2.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_MorePage2_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_MorePage3.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_MorePage3_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_ReturnBtn.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_ReturnBtn_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_SadBlink.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_SadBlink_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_SadEyes.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_SadEyes_.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_SadPupils.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_SadPupils_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_Tears.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_Tears_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_TellMeBtn.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\Upsell_TellMeBtn_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\UpsellBG.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\UpsellLogo.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\UpsellLogo_.gif
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\UpsellOuter.jpg
C:\Documents and Settings\All Users\Application Data\PopCap\\PopCapLoader\yahoo\chuzzle\Upsells\UpsellOuter_.gif
C:\Documents and Settings\Heather\Application Data\Comodo\
C:\Program Files\Comodo\
C:\Temp\bY001.exe
C:\WINNT\Downloaded Program Files\popcaploader.dll
C:\WINNT\VXNlcg\
C:\WINNT\VXNlcg\\prh5w0.vbs


((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))


2007-08-23 19:34 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-23 17:19 <DIR> d-------- C:\WINNT\system32\SoftwareDistribution
2007-08-23 16:37 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2007-08-23 16:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-21 19:23 25,600 --------- C:\WINNT\system32\verclsid.exe
2007-08-21 19:09 82,432 --a------ C:\WINNT\system32\fldrclnr.dll
2007-08-21 19:09 700,928 --a------ C:\WINNT\system32\sxs.dll
2007-08-21 19:09 595,968 --a------ C:\WINNT\system32\xpsp2res.dll
2007-08-21 13:30 <DIR> d-------- C:\WINNT\system32\PreInstall
2007-08-21 13:29 22,752 --a------ C:\WINNT\system32\spupdsvc.exe
2007-08-21 00:49 <DIR> d---s---- C:\DOCUME~1\ADMINI~1\UserData
2007-08-20 17:30 <DIR> d-------- C:\VundoFix Backups
2007-08-20 13:30 83,456 --a------ C:\WINNT\system32\mtxoci.dll
2007-08-20 13:30 64,512 --a------ C:\WINNT\system32\mtxclu.dll
2007-08-20 13:21 <DIR> d--h----- C:\WINNT\$hf_mig$
2007-08-20 13:04 <DIR> d-------- C:\WINNT\Prefetch
2007-08-20 11:42 <DIR> d-------- C:\WINNT\ServicePackFiles
2007-08-20 11:42 <DIR> d-------- C:\WINNT\ehome
2007-08-20 11:12 9,216 --a------ C:\WINNT\system32\wuauserv.dll
2007-08-20 11:12 86,016 --a------ C:\WINNT\system32\xactsrv.dll
2007-08-20 11:12 56,832 --a------ C:\WINNT\system32\wzcdlg.dll
2007-08-20 11:12 446,464 --a------ C:\WINNT\system32\wmvdmoe.dll
2007-08-20 11:12 38,912 --a------ C:\WINNT\system32\wsnmp32.dll
2007-08-20 11:12 264,704 --a------ C:\WINNT\system32\wzcsvc.dll
2007-08-20 11:12 247,808 --a------ C:\WINNT\system32\wow32.dll
2007-08-20 11:12 24,576 --------- C:\WINNT\system32\odbcbcp.dll
2007-08-20 11:12 23,552 --a------ C:\WINNT\system32\wzcsapi.dll
2007-08-20 11:12 172,664 --a------ C:\WINNT\system32\xenroll.dll
2007-08-20 11:12 17,408 --a------ C:\WINNT\system32\wtsapi32.dll
2007-08-20 11:12 13,312 --a------ C:\WINNT\system32\wship6.dll
2007-08-20 11:11 86,528 --a------ C:\WINNT\system32\wlnotify.dll
2007-08-20 11:11 77,824 --a------ C:\WINNT\system32\wmpstub.exe
2007-08-20 11:11 51,200 --a------ C:\WINNT\system32\wmerrenu.dll
2007-08-20 11:11 48,128 --a------ C:\WINNT\system32\winsta.dll
2007-08-20 11:11 311,327 --a------ C:\WINNT\system32\wmv8dmod.dll
2007-08-20 11:11 296,448 --a------ C:\WINNT\system32\wmstream.dll
2007-08-20 11:11 168,448 --a------ C:\WINNT\system32\wldap32.dll
2007-08-20 11:11 118,784 --a------ C:\WINNT\system32\wmsdmoe.dll
2007-08-20 11:10 9,856 --------- C:\WINNT\system32\drivers\tunmp.sys
2007-08-20 11:10 88,064 --a------ C:\WINNT\system32\tscfgwmi.dll
2007-08-20 11:10 81,920 --a------ C:\WINNT\system32\trkwks.dll
2007-08-20 11:10 61,952 --a------ C:\WINNT\system32\webclnt.dll
2007-08-20 11:10 60,416 --a------ C:\WINNT\system32\wextract.exe
2007-08-20 11:10 48,640 --a------ C:\WINNT\system32\vdmredir.dll
2007-08-20 11:10 479,261 --a------ C:\WINNT\system32\vbscript.dll
2007-08-20 11:10 47,616 --a------ C:\WINNT\system32\utilman.exe
2007-08-20 11:10 409,088 --a------ C:\WINNT\system32\vssapi.dll
2007-08-20 11:10 40,960 --a------ C:\WINNT\system32\tscupgrd.exe
2007-08-20 11:10 384,000 --a------ C:\WINNT\system32\themeui.dll
2007-08-20 11:10 339,456 --a------ C:\WINNT\system32\usp10.dll
2007-08-20 11:10 32,256 --a------ C:\WINNT\system32\umandlg.dll
2007-08-20 11:10 266,752 --a------ C:\WINNT\winhlp32.exe
2007-08-20 11:10 231,424 --a------ C:\WINNT\system32\upnpui.dll
2007-08-20 11:10 22,016 --a------ C:\WINNT\system32\udhisapi.dll
2007-08-20 11:10 203,264 --a------ C:\WINNT\system32\uxtheme.dll
2007-08-20 11:10 171,520 --a------ C:\WINNT\system32\winmm.dll
2007-08-20 11:10 165,376 --a------ C:\WINNT\system32\w32time.dll
2007-08-20 11:10 164,864 --a------ C:\WINNT\system32\upnphost.dll
2007-08-20 11:10 16,384 --a------ C:\WINNT\system32\watchdog.sys
2007-08-20 11:10 16,384 --a------ C:\WINNT\system32\ups.exe
2007-08-20 11:10 124,928 --a------ C:\WINNT\system32\webvw.dll
2007-08-20 11:10 120,320 --a------ C:\WINNT\system32\upnp.dll
2007-08-20 11:10 119,808 --a------ C:\WINNT\system32\wiadss.dll
2007-08-20 11:10 10,752 --a------ C:\WINNT\system32\tracert.exe
2007-08-20 11:09 82,944 --a------ C:\WINNT\system32\smlogsvc.exe
2007-08-20 11:09 8,192 --a------ C:\WINNT\system32\scrnsave.scr
2007-08-20 11:09 75,912 --a------ C:\WINNT\system32\rdpwsx.dll
2007-08-20 11:09 74,240 --a------ C:\WINNT\system32\rtcshare.exe
2007-08-20 11:09 72,192 --a------ C:\WINNT\system32\telnet.exe
2007-08-20 11:09 71,168 --a------ C:\WINNT\system32\storprop.dll
2007-08-20 11:09 71,168 --a------ C:\WINNT\system32\sdbinst.exe
2007-08-20 11:09 667,648 --a------ C:\WINNT\system32\ss3dfo.scr
2007-08-20 11:09 66,560 --a------ C:\WINNT\system32\spoolss.dll
2007-08-20 11:09 66,048 --a------ C:\WINNT\system32\sigverif.exe
2007-08-20 11:09 638,976 --a------ C:\WINNT\system32\sstext3d.scr
2007-08-20 11:09 63,488 --a------ C:\WINNT\system32\srclient.dll
2007-08-20 11:09 62,976 --a------ C:\WINNT\system32\shgina.dll
2007-08-20 11:09 61,952 --a------ C:\WINNT\system32\sti.dll
2007-08-20 11:09 60,416 --a------ C:\WINNT\system32\shimeng.dll
2007-08-20 11:09 6,144 --a------ C:\WINNT\system32\sensapi.dll
2007-08-20 11:09 569,344 --a------ C:\WINNT\system32\sspipes.scr
2007-08-20 11:09 56,320 --a------ C:\WINNT\system32\remotepg.dll
2007-08-20 11:09 534,016 --a------ C:\WINNT\system32\spider.exe
2007-08-20 11:09 52,224 --a------ C:\WINNT\system32\secur32.dll
2007-08-20 11:09 5,504 --------- C:\WINNT\system32\drivers\smbali.sys
2007-08-20 11:09 48,128 --a------ C:\WINNT\system32\reg.exe
2007-08-20 11:09 44,032 --a------ C:\WINNT\system32\regapi.dll
2007-08-20 11:09 43,008 --a------ C:\WINNT\system32\ssdpsrv.dll
2007-08-20 11:09 420,864 --a------ C:\WINNT\system32\shimgvw.dll
2007-08-20 11:09 364,544 --a------ C:\WINNT\system32\ssflwbox.scr
2007-08-20 11:09 36,352 --a------ C:\WINNT\system32\sens.dll
2007-08-20 11:09 334,848 --a------ C:\WINNT\system32\smlogcfg.dll
2007-08-20 11:09 33,280 --a------ C:\WINNT\system32\shmgrate.exe
2007-08-20 11:09 3,338 --a------ C:\WINNT\system32\redir.exe
2007-08-20 11:09 297,984 --a------ C:\WINNT\system32\scesrv.dll
2007-08-20 11:09 27,136 --a------ C:\WINNT\system32\ssdpapi.dll
2007-08-20 11:09 251,904 --a------ C:\WINNT\system32\strmdll.dll
2007-08-20 11:09 24,064 --a------ C:\WINNT\system32\skeys.exe
2007-08-20 11:09 233,984 --a------ C:\WINNT\system32\tapisrv.dll
2007-08-20 11:09 22,528 --a------ C:\WINNT\system32\slayerxp.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-22 18:15 --------- d-------- C:\Program Files\Lx_cats
2007-08-21 12:22 --------- d-------- C:\Program Files\eGames
2007-08-21 12:12 --------- d-------- C:\Program Files\Chuzzle Deluxe
2007-08-20 14:43 --------- d-------- C:\Program Files\MSN Messenger
2007-08-20 11:53 2682 --a------ C:\WINNT\pchealth\HELPCTR\PackageStore\SkuStore.bin
2007-08-20 11:49 --------- d-------- C:\Program Files\Messenger
2007-08-20 11:41 --------- d-------- C:\Program Files\Movie Maker
2007-08-11 15:11 --------- d-------- C:\Program Files\Yahoo!
2007-08-10 14:47 --------- d-------- C:\Program Files\Common Files\Scanner
2007-08-07 19:50 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Wal-Mart Digital Photo Manager
2007-07-30 19:19 92504 --a------ C:\WINNT\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINNT\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINNT\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINNT\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINNT\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINNT\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINNT\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINNT\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINNT\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINNT\system32\wups.dll
2007-07-22 04:50 --------- d-------- C:\Program Files\Windows Live Toolbar
2007-07-22 03:15 --------- d-------- C:\Program Files\eMusic Download Manager
2007-07-21 01:15 --------- d-------- C:\Program Files\Real
2007-07-21 01:13 --------- d--h----- C:\Program Files\WindowsUpdate
2007-07-11 13:10 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Wal-Mart Digital Photo Viewer
2007-07-11 13:06 --------- d-------- C:\Program Files\Wal-Mart
2007-07-11 13:06 --------- d-------- C:\Program Files\Common Files\HP
2007-07-11 13:02 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-11 13:02 --------- d-------- C:\Program Files\aVinci
2007-07-11 13:02 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\InstallShield
2007-06-26 18:51 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Yahoo!
2007-06-26 14:16 --------- d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint
2007-03-12 17:44 271 ---hs---- C:\Program Files\desktop.ini
2007-03-12 17:44 21952 --ah-c--- C:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3964D8D6-86D0-493A-B460-A805B5401114}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C8C899C-437C-3FDD-2974-39B67F38F2C2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3D7DE6B8-603E-40A1-BB8F-585584718B00}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CE228ECA-E9DE-4D4F-BFC6-06449D1862D1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DB570C0A-4881-4222-953F-FA1597452335}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E76CAA55-332F-41C6-B0CC-D03CF5078A03}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EFB96FBB-095A-422B-968B-68DBACC2B0CE}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F64ADC5C-78F5-4B33-8EC1-EF1D51C949DC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2001-08-23 08:00 C:\WINNT\system32\mobsync.exe]
"lxctmon.exe"="C:\Program Files\Lexmark 5400 Series\lxctmon.exe" [2006-11-22 05:11]
"Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [2006-11-22 05:12]
"EzPrint"="C:\Program Files\Lexmark 5400 Series\ezprint.exe" [2006-11-22 05:11]
"LXCTCATS"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 08:27]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 10:31]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]
"Affntiog"="C:\Program Files\Common Files\??pPatch\w?crtupd.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxur]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuttr]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtutu]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

R3 neo20xx;neo20xx;C:\WINNT\System32\DRIVERS\neo20xx.sys
R3 wdm_nm6;NeoMagic MagicMedia 256 + AC97 Driver (WDM);C:\WINNT\System32\drivers\nm6wdm.sys
S3 DLINK11G;D-Link AirPlus G Wireless Adapter;C:\WINNT\System32\DRIVERS\TNET1130.SYS
S3 DLKRCB;D-Link DFE-690TXD CardBus PC Card;C:\WINNT\System32\DRIVERS\DLKRCB.SYS
S3 maestro;ESS Maestro 3 Audio Driver (WDM);C:\WINNT\System32\drivers\es198x.sys
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINNT\System32\DRIVERS\usb8023.sys
S3 W8335XP;3Com OfficeConnect Wireless 54Mbps 11g PC Card Driver;C:\WINNT\System32\DRIVERS\MRV8335XP.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-25 12:28:29
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-25 12:32:34 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-25 12:32
C:\ComboFix2.txt ... 2007-08-23 19:58
C:\ComboFix3.txt ... 2007-08-23 19:50

--- E O F ---


ComboFix 07-08-17.2 - "Heather" 2007-08-25 12:49:20.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.85 [GMT -4:00]
Command switches used :: C:\Documents and Settings\Heather\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\B7.tmp
C:\B8.tmp
C:\Program Files\Outlook Express\prolyzuqo.html
C:\Program Files\Windows Media Player\hoqeri4444.dll
C:\Temp\bY001.exe
C:\WINNT\Downloaded Program Files\popcaploader.dll
C:\WINNT\system32\byxxyvv.dll
C:\WINNT\system32\jpibdljd.exe
C:\WINNT\system32\myybenwd.exe
C:\WINNT\system32\okrdpkgx.exe
C:\WINNT\system32\opnomlm.dll
C:\WINNT\system32\scqfrbgl.exe
C:\WINNT\system32\slqexlnf.exe
C:\WINNT\system32\vjjgnlli.exe
C:\WINNT\system32\xobxfnvg.exe
C:\WINNT\system32\yayvtqo.dll
C:\WINNT\TTC-4444.exe


((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))


2007-08-23 19:34 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-23 17:19 <DIR> d-------- C:\WINNT\system32\SoftwareDistribution
2007-08-23 16:37 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2007-08-23 16:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-21 19:23 25,600 --------- C:\WINNT\system32\verclsid.exe
2007-08-21 19:09 82,432 --a------ C:\WINNT\system32\fldrclnr.dll
2007-08-21 19:09 700,928 --a------ C:\WINNT\system32\sxs.dll
2007-08-21 19:09 595,968 --a------ C:\WINNT\system32\xpsp2res.dll
2007-08-21 13:30 <DIR> d-------- C:\WINNT\system32\PreInstall
2007-08-21 13:29 22,752 --a------ C:\WINNT\system32\spupdsvc.exe
2007-08-21 00:49 <DIR> d---s---- C:\DOCUME~1\ADMINI~1\UserData
2007-08-20 17:30 <DIR> d-------- C:\VundoFix Backups
2007-08-20 13:30 83,456 --a------ C:\WINNT\system32\mtxoci.dll
2007-08-20 13:30 64,512 --a------ C:\WINNT\system32\mtxclu.dll
2007-08-20 13:21 <DIR> d--h----- C:\WINNT\$hf_mig$
2007-08-20 13:04 <DIR> d-------- C:\WINNT\Prefetch
2007-08-20 11:42 <DIR> d-------- C:\WINNT\ServicePackFiles
2007-08-20 11:42 <DIR> d-------- C:\WINNT\ehome
2007-08-20 11:12 9,216 --a------ C:\WINNT\system32\wuauserv.dll
2007-08-20 11:12 86,016 --a------ C:\WINNT\system32\xactsrv.dll
2007-08-20 11:12 56,832 --a------ C:\WINNT\system32\wzcdlg.dll
2007-08-20 11:12 446,464 --a------ C:\WINNT\system32\wmvdmoe.dll
2007-08-20 11:12 38,912 --a------ C:\WINNT\system32\wsnmp32.dll
2007-08-20 11:12 264,704 --a------ C:\WINNT\system32\wzcsvc.dll
2007-08-20 11:12 247,808 --a------ C:\WINNT\system32\wow32.dll
2007-08-20 11:12 24,576 --------- C:\WINNT\system32\odbcbcp.dll
2007-08-20 11:12 23,552 --a------ C:\WINNT\system32\wzcsapi.dll
2007-08-20 11:12 172,664 --a------ C:\WINNT\system32\xenroll.dll
2007-08-20 11:12 17,408 --a------ C:\WINNT\system32\wtsapi32.dll
2007-08-20 11:12 13,312 --a------ C:\WINNT\system32\wship6.dll
2007-08-20 11:11 86,528 --a------ C:\WINNT\system32\wlnotify.dll
2007-08-20 11:11 77,824 --a------ C:\WINNT\system32\wmpstub.exe
2007-08-20 11:11 51,200 --a------ C:\WINNT\system32\wmerrenu.dll
2007-08-20 11:11 48,128 --a------ C:\WINNT\system32\winsta.dll
2007-08-20 11:11 311,327 --a------ C:\WINNT\system32\wmv8dmod.dll
2007-08-20 11:11 296,448 --a------ C:\WINNT\system32\wmstream.dll
2007-08-20 11:11 168,448 --a------ C:\WINNT\system32\wldap32.dll
2007-08-20 11:11 118,784 --a------ C:\WINNT\system32\wmsdmoe.dll
2007-08-20 11:10 9,856 --------- C:\WINNT\system32\drivers\tunmp.sys
2007-08-20 11:10 88,064 --a------ C:\WINNT\system32\tscfgwmi.dll
2007-08-20 11:10 81,920 --a------ C:\WINNT\system32\trkwks.dll
2007-08-20 11:10 61,952 --a------ C:\WINNT\system32\webclnt.dll
2007-08-20 11:10 60,416 --a------ C:\WINNT\system32\wextract.exe
2007-08-20 11:10 48,640 --a------ C:\WINNT\system32\vdmredir.dll
2007-08-20 11:10 479,261 --a------ C:\WINNT\system32\vbscript.dll
2007-08-20 11:10 47,616 --a------ C:\WINNT\system32\utilman.exe
2007-08-20 11:10 409,088 --a------ C:\WINNT\system32\vssapi.dll
2007-08-20 11:10 40,960 --a------ C:\WINNT\system32\tscupgrd.exe
2007-08-20 11:10 384,000 --a------ C:\WINNT\system32\themeui.dll
2007-08-20 11:10 339,456 --a------ C:\WINNT\system32\usp10.dll
2007-08-20 11:10 32,256 --a------ C:\WINNT\system32\umandlg.dll
2007-08-20 11:10 266,752 --a------ C:\WINNT\winhlp32.exe
2007-08-20 11:10 231,424 --a------ C:\WINNT\system32\upnpui.dll
2007-08-20 11:10 22,016 --a------ C:\WINNT\system32\udhisapi.dll
2007-08-20 11:10 203,264 --a------ C:\WINNT\system32\uxtheme.dll
2007-08-20 11:10 171,520 --a------ C:\WINNT\system32\winmm.dll
2007-08-20 11:10 165,376 --a------ C:\WINNT\system32\w32time.dll
2007-08-20 11:10 164,864 --a------ C:\WINNT\system32\upnphost.dll
2007-08-20 11:10 16,384 --a------ C:\WINNT\system32\watchdog.sys
2007-08-20 11:10 16,384 --a------ C:\WINNT\system32\ups.exe
2007-08-20 11:10 124,928 --a------ C:\WINNT\system32\webvw.dll
2007-08-20 11:10 120,320 --a------ C:\WINNT\system32\upnp.dll
2007-08-20 11:10 119,808 --a------ C:\WINNT\system32\wiadss.dll
2007-08-20 11:10 10,752 --a------ C:\WINNT\system32\tracert.exe
2007-08-20 11:09 82,944 --a------ C:\WINNT\system32\smlogsvc.exe
2007-08-20 11:09 8,192 --a------ C:\WINNT\system32\scrnsave.scr
2007-08-20 11:09 75,912 --a------ C:\WINNT\system32\rdpwsx.dll
2007-08-20 11:09 74,240 --a------ C:\WINNT\system32\rtcshare.exe
2007-08-20 11:09 72,192 --a------ C:\WINNT\system32\telnet.exe
2007-08-20 11:09 71,168 --a------ C:\WINNT\system32\storprop.dll
2007-08-20 11:09 71,168 --a------ C:\WINNT\system32\sdbinst.exe
2007-08-20 11:09 667,648 --a------ C:\WINNT\system32\ss3dfo.scr
2007-08-20 11:09 66,560 --a------ C:\WINNT\system32\spoolss.dll
2007-08-20 11:09 66,048 --a------ C:\WINNT\system32\sigverif.exe
2007-08-20 11:09 638,976 --a------ C:\WINNT\system32\sstext3d.scr
2007-08-20 11:09 63,488 --a------ C:\WINNT\system32\srclient.dll
2007-08-20 11:09 62,976 --a------ C:\WINNT\system32\shgina.dll
2007-08-20 11:09 61,952 --a------ C:\WINNT\system32\sti.dll
2007-08-20 11:09 60,416 --a------ C:\WINNT\system32\shimeng.dll
2007-08-20 11:09 6,144 --a------ C:\WINNT\system32\sensapi.dll
2007-08-20 11:09 569,344 --a------ C:\WINNT\system32\sspipes.scr
2007-08-20 11:09 56,320 --a------ C:\WINNT\system32\remotepg.dll
2007-08-20 11:09 534,016 --a------ C:\WINNT\system32\spider.exe
2007-08-20 11:09 52,224 --a------ C:\WINNT\system32\secur32.dll
2007-08-20 11:09 5,504 --------- C:\WINNT\system32\drivers\smbali.sys
2007-08-20 11:09 48,128 --a------ C:\WINNT\system32\reg.exe
2007-08-20 11:09 44,032 --a------ C:\WINNT\system32\regapi.dll
2007-08-20 11:09 43,008 --a------ C:\WINNT\system32\ssdpsrv.dll
2007-08-20 11:09 420,864 --a------ C:\WINNT\system32\shimgvw.dll
2007-08-20 11:09 364,544 --a------ C:\WINNT\system32\ssflwbox.scr
2007-08-20 11:09 36,352 --a------ C:\WINNT\system32\sens.dll
2007-08-20 11:09 334,848 --a------ C:\WINNT\system32\smlogcfg.dll
2007-08-20 11:09 33,280 --a------ C:\WINNT\system32\shmgrate.exe
2007-08-20 11:09 3,338 --a------ C:\WINNT\system32\redir.exe
2007-08-20 11:09 297,984 --a------ C:\WINNT\system32\scesrv.dll
2007-08-20 11:09 27,136 --a------ C:\WINNT\system32\ssdpapi.dll
2007-08-20 11:09 251,904 --a------ C:\WINNT\system32\strmdll.dll
2007-08-20 11:09 24,064 --a------ C:\WINNT\system32\skeys.exe
2007-08-20 11:09 233,984 --a------ C:\WINNT\system32\tapisrv.dll
2007-08-20 11:09 22,528 --a------ C:\WINNT\system32\slayerxp.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-22 18:15 --------- d-------- C:\Program Files\Lx_cats
2007-08-21 12:22 --------- d-------- C:\Program Files\eGames
2007-08-21 12:12 --------- d-------- C:\Program Files\Chuzzle Deluxe
2007-08-20 14:43 --------- d-------- C:\Program Files\MSN Messenger
2007-08-20 11:53 2682 --a------ C:\WINNT\pchealth\HELPCTR\PackageStore\SkuStore.bin
2007-08-20 11:49 --------- d-------- C:\Program Files\Messenger
2007-08-20 11:41 --------- d-------- C:\Program Files\Movie Maker
2007-08-11 15:11 --------- d-------- C:\Program Files\Yahoo!
2007-08-10 14:47 --------- d-------- C:\Program Files\Common Files\Scanner
2007-08-07 19:50 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Wal-Mart Digital Photo Manager
2007-07-30 19:19 92504 --a------ C:\WINNT\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINNT\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINNT\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINNT\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINNT\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINNT\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINNT\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINNT\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINNT\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINNT\system32\wups.dll
2007-07-22 04:50 --------- d-------- C:\Program Files\Windows Live Toolbar
2007-07-22 03:15 --------- d-------- C:\Program Files\eMusic Download Manager
2007-07-21 01:15 --------- d-------- C:\Program Files\Real
2007-07-21 01:13 --------- d--h----- C:\Program Files\WindowsUpdate
2007-07-11 13:10 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Wal-Mart Digital Photo Viewer
2007-07-11 13:06 --------- d-------- C:\Program Files\Wal-Mart
2007-07-11 13:06 --------- d-------- C:\Program Files\Common Files\HP
2007-07-11 13:02 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-11 13:02 --------- d-------- C:\Program Files\aVinci
2007-07-11 13:02 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\InstallShield
2007-06-26 18:51 --------- d-------- C:\DOCUME~1\Heather\APPLIC~1\Yahoo!
2007-06-26 14:16 --------- d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint
2007-03-12 17:44 271 ---hs---- C:\Program Files\desktop.ini
2007-03-12 17:44 21952 --ah-c--- C:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2001-08-23 08:00 C:\WINNT\system32\mobsync.exe]
"lxctmon.exe"="C:\Program Files\Lexmark 5400 Series\lxctmon.exe" [2006-11-22 05:11]
"Lexmark 5400 Series Fax Server"="C:\Program Files\Lexmark 5400 Series\fm3032.exe" [2006-11-22 05:12]
"EzPrint"="C:\Program Files\Lexmark 5400 Series\ezprint.exe" [2006-11-22 05:11]
"LXCTCATS"="C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 08:27]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 10:31]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

R3 neo20xx;neo20xx;C:\WINNT\System32\DRIVERS\neo20xx.sys
R3 wdm_nm6;NeoMagic MagicMedia 256 + AC97 Driver (WDM);C:\WINNT\System32\drivers\nm6wdm.sys
S3 DLINK11G;D-Link AirPlus G Wireless Adapter;C:\WINNT\System32\DRIVERS\TNET1130.SYS
S3 DLKRCB;D-Link DFE-690TXD CardBus PC Card;C:\WINNT\System32\DRIVERS\DLKRCB.SYS
S3 maestro;ESS Maestro 3 Audio Driver (WDM);C:\WINNT\System32\drivers\es198x.sys
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINNT\System32\DRIVERS\usb8023.sys
S3 W8335XP;3Com OfficeConnect Wireless 54Mbps 11g PC Card Driver;C:\WINNT\System32\DRIVERS\MRV8335XP.sys


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-25 12:53:08
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-25 12:54:43
C:\ComboFix-quarantined-files.txt ... 2007-08-25 12:54
C:\ComboFix2.txt ... 2007-08-25 12:32
C:\ComboFix3.txt ... 2007-08-23 19:58

--- E O F ---
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Kaspersky Report

Unread postby heathermarie73 » August 26th, 2007, 6:00 pm

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, August 26, 2007 5:10:00 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 26/08/2007
Kaspersky Anti-Virus database records: 391736
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\

Scan Statistics:
Total number of scanned objects: 35962
Number of viruses found: 13
Number of infected objects: 46
Number of suspicious objects: 6
Duration of the scan process: 02:13:32

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PurityScan.zip/offun.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PurityScan.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip/retadpu72.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\Heather\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Heather\Desktop\OiUninstaller.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\Documents and Settings\Heather\Desktop\OiUninstaller.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\Documents and Settings\Heather\Desktop\OiUninstaller.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Heather\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\History\History.IE5\MSHist012007082620070827\index.dat Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\Temp\~DF32B4.tmp Object is locked skipped
C:\Documents and Settings\Heather\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Heather\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Heather\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Trend Micro\HijackThis\backups\backup-20070822-131402-338 Suspicious: Exploit.HTML.Mht skipped
C:\QooBox\Quarantine\C\B7.tmp.vir/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\QooBox\Quarantine\C\B7.tmp.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\B8.tmp.vir/stream/data0003 Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\QooBox\Quarantine\C\B8.tmp.vir/stream Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\QooBox\Quarantine\C\B8.tmp.vir NSIS: infected - 2 skipped
C:\QooBox\Quarantine\C\Program Files\Windows Media Player\hoqeri4444.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0002/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0006 Infected: Virus.Win32.Virut.i skipped
C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0007 Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\Temp\bY001.exe.vir/data0008 Infected: Trojan-Dropper.Win32.Agent.mu skipped
C:\QooBox\Quarantine\C\Temp\bY001.exe.vir NSIS: infected - 5 skipped
C:\QooBox\Quarantine\C\WINNT\Downloaded Program Files\popcaploader.dll.vir Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
C:\QooBox\Quarantine\C\WINNT\system32\byxxyvv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINNT\system32\jpibdljd.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\myybenwd.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\okrdpkgx.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\opnomlm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINNT\system32\scqfrbgl.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\slqexlnf.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\vjjgnlli.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\X1\kmhp83122.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\QooBox\Quarantine\C\WINNT\system32\X1\kmhp83122.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\WINNT\system32\xobxfnvg.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINNT\system32\yayvtqo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINNT\TTC-4444.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\QooBox\Quarantine\C\WINNT\TTC-4444.exe.vir NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082455.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082456.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082457.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082458.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082459.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082460.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082461.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082462.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082463.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082464.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082465.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082466.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082466.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082469.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0082469.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP194\A0084441.reg Suspicious: Exploit.HTML.Mht skipped
C:\System Volume Information\_restore{B9A206C5-A712-4FA9-9E8A-C0F5C8DB174D}\RP208\change.log Object is locked skipped
C:\VundoFix Backups\tuvuttr.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\EventCache\{104D9799-6C67-4363-85F2-B41780E02613}.bin Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\system.LOG Object is locked skipped
C:\WINNT\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINNT\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINNT\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINNT\system32\h323log.txt Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINNT\wiadebug.log Object is locked skipped
C:\WINNT\wiaservc.log Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped

Scan process completed.
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Gmer Log

Unread postby heathermarie73 » August 26th, 2007, 6:01 pm

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-08-26 17:51:14
Windows 5.1.2600 Service Pack 1


---- Devices - GMER 1.0.13 ----

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F9F83404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F9F83404] avg7rsw.sys

---- EOF - GMER 1.0.13 ----
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Fresh HiJackThis Log

Unread postby heathermarie73 » August 26th, 2007, 6:02 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:05 PM, on 8/26/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\lxctcoms.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINNT\system32\taskmgr.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\good program.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.x/24
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZCxdm238MGUS
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: http://www.malwareremoval.com/forum
O15 - Trusted Zone: http://www.outerinfo.com
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/games/ ... /tt5_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/games/ ... poti_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... urrent.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resou ... NPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxct_device - - C:\WINNT\System32\lxctcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)

--
End of file - 6502 bytes
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

ATF Cleaner and other notes

Unread postby heathermarie73 » August 26th, 2007, 6:09 pm

Dear John,

As was the last time I ran this cleaner, this time I was unable to run the Opera portion. The tab did not allow me to click on it.

The link for the OiUnstaller did not work. Here is the one I used instead:
http://www.outerinfo.com/consumers.uninstalloi.html

The bad files you instructed me to delete were not found. : )

Also, I was having much difficulty using my pc, and I had homework that needed to be submitted for college. Hence, I ran SpyBot and AVG to search for anything that could be fixed by me. SpyBot came up with 10 items and deleted them. AVG came up with nothing.

I hope you are having a nice day. Sorry this took me so long to reply back, but I had to get my homework turned in first. I remembered that some of these programs you had me run before too hours, and I didn't have that kind of time to spare yesterday.

I look forward to hearing from you and again... Thank you so much for all your help with me and my sick pc..

Kind Regards,

HeatherMarie
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Unread postby John B. » August 27th, 2007, 8:30 am

Hi Heather,

heathermarie73 wrote:I hope you are having a nice day. Sorry this took me so long to reply back, but I had to get my homework turned in first. I remembered that some of these programs you had me run before too hours, and I didn't have that kind of time to spare yesterday.

Real life goes first, especially when it's about school!

It looks like your computer is clean, but it seems like your still having problems?
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    R3 - URLSearchHook: (no name) - - (no file)

    O15 - Trusted Zone: http://www.outerinfo.com

  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

Then delete OiUninstaller.exe from your desktop.

Please post a fresh HijackThis log and let me know if you still have any problems. Tell it in a much detail as you can.

Greets, John.
User avatar
John B.
MRU Master Emeritus
 
Posts: 4568
Joined: May 14th, 2006, 5:05 am
Location: The Netherlands

HiJackThis Log and additional information

Unread postby heathermarie73 » August 27th, 2007, 2:51 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:54 PM, on 8/27/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\lxctcoms.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.x/24
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZCxdm238MGUS
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: http://www.malwareremoval.com/forum
O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/games/ ... /tt5_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/games/ ... poti_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... urrent.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resou ... NPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxct_device - - C:\WINNT\System32\lxctcoms.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)

--
End of file - 6412 bytes


Also, my computer seems to be running an aweful lot of processes in the background. Some of them I understand, but others, I am not sure. Could you please look over these and see if any of them are possible bugs? My system is still running quite slow and the programs are still sticking. Again, thank you so much for all your time and help! I greatly appreciate it more than you know! : )

Image Name User Name Mem Usage
WLLoginProxy.exe Heather 624
taskmgr.exe Heather 2024
iexplore.exe Heather 18512
wuauclt.exe System 15724
wuauclt.exe Heather 144
EXCEL.EXE Heather 7584
wdfmgr.exe LOCAL SERVICE 40
svchost.exe System 1600
lxctcoms.exe System 1488
avgupsvc.exe System 124
avgamsvr.exe System 364
alg.exxe LOCAL SERVICE 108
aawservice.exe System 300
a2service.exe System 260
avgcc.exe Heather 224
ezprint.exe Heather 472
lxctmon.exe Heather 1268
explorer.exe Heather 7480
spoolsv.exe System 396
svchost.exe LOCAL SERVICE 1788
svchost.exe Network Service 836
avgw.exe Heather 32728
svchost.exe System 18168
svchost.exe System 1724
lsass.exe System 1272
services.exe System 1628
winlogon.exe System 1592
csrss.exe System 1228
smss.exe System 48
System System 32
System Idle Process System 16

Kind Regards,

Heather
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Unread postby John B. » August 28th, 2007, 7:54 am

Hi Heather,

You can check all your Running Processes here:
http://www.processlibrary.com/
You'll see that all of the processes are legit.

Step 1: Remove bad HijackThis entry
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside the item listed below (if present):

    O8 - Extra context menu item: &Search - ?p=ZCxdm238MGUS
  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

Step 2: Disable and Enable System Restore
Turn off System Restore.
On the Desktop, right-click My Computer
Click Properties
Click the System Restore tab
Check Turn off System Restore
Click Apply, and then click OK

Reboot.

Turn on System Restore.
On the Desktop, right-click My Computer
Click Properties
Click the System Restore tab
Uncheck Turn off System Restore
Click Apply, and then click OK
NOTE: only do this ONCE, NOT on a regular basis!

Step 3: Run ATF Cleaner
Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Step 4: Defrag your system
Disk fragmentation slows the overall performance of your system. When files are fragmented, the computer must search the hard disk when a file is opened. Disk Defragmenter consolidates fragmented files and folders on the hard disk so that each occupies a single space on the disk. This speeds up reading and writing to the disk. Read The Importance of Disk Defragmentation for instructions.

Now tell me how your computer is running.

Greets, John.
User avatar
John B.
MRU Master Emeritus
 
Posts: 4568
Joined: May 14th, 2006, 5:05 am
Location: The Netherlands

PC Condition

Unread postby heathermarie73 » September 1st, 2007, 3:06 pm

Dear John,

Thank you so very much for helping me with my pc! : )
It is back in working order once again! : )
Even my issue with booting has been restored! : )

I now have my Spybot and Comodo Firewall turned on (they have been on for a few days). All is doing great! : )

Thank you!! Thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! thank you!!! Thank you!!! THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!THANK YOU!!!!

So Very Much! : )

Eternally Grateful,

Heather : )
heathermarie73
Regular Member
 
Posts: 28
Joined: August 16th, 2007, 9:45 pm
Location: Laurens, SC

Unread postby John B. » September 2nd, 2007, 6:22 am

Hi Heather,

Glad to hear everything is working fine.

This is my normal post for when you are clear - which you now are - or seem to be.
Please advise of any problems you still have. If you think you're clean please give one more reply so that I can archive this topic.

Can you please disable Teatimer one more time because you still have to upgrade to Windows XP Service Pack 2.
It's a very big install so you have two choices:
Download and Install it using Microsoft Update
Order it for free and get a CD

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Remove dangerous tools - Because some tools we used can be dangerous if they're used in the wrong way we have to remove some of them. Please remove the following tools:
    C:\VundoFix Backups
    CFScript
    ComboFix
    Gmer
    VundoFix

  • Disable and Enable System Restore - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
    Turn off System Restore.
    On the Desktop, right-click My Computer
    Click Properties
    Click the System Restore tab
    Check Turn off System Restore
    Click Apply, and then click OK

    Reboot.

    Turn on System Restore.
    On the Desktop, right-click My Computer
    Click Properties
    Click the System Restore tab
    Uncheck Turn off System Restore
    Click Apply, and then click OK
    NOTE: only do this ONCE, NOT on a regular basis!
  • Re hide your system files To do so, please follow the steps below:
    • Double-click My Computer.
    • Click the Tools menu, and then click Folder Options.
    • Click the View tab.
    • Put a check by "Hide file extensions for known file types."
    • Under the "Hidden files" folder, select "Do not show hidden files and folders."
    • Check "Hide protected operating system files."
    • Click Apply, and then click OK.
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialise and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
  • Visit Microsoft's Update Site Frequently - It is important that you visit http://update.microsoft.com/ regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
    Computer Safety on line - Anti-Malware

Follow this list and your potential for being infected again will reduce dramatically.

Stand Up and Be Counted!
Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints called Malware Complaints. Please register there first! Then follow the instructions here:
http://images.malwarecomplaints.info/We ... infixer=on

>> Here << you can see how you can help us.

May your God go with you..

John.




This topic is now closed.

If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Gary R
User avatar
John B.
MRU Master Emeritus
 
Posts: 4568
Joined: May 14th, 2006, 5:05 am
Location: The Netherlands
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 486 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware