Spyware / Malware / Virus Removal

[Closed] gaopdxserv.sys - Can't figure out how to remove

3 min read

Looking for the outcome? Ask AI

nora123_99 Topic Starter

Post #1May 23, 2009, 6:16 PM UTC

Hello…

I have been having a hard time getting rid of this thing. I'm getting 2 pop ups that come out on either side of my screen saying "Infiltration Alert!". The pop up tells me my computer is being attacked by an Internet Virus and asks if I want WinBlueSoft to block the attack.

I've ran Smitfraudfix and have a HJT log. I've also ran Malware Bytes Anti-Malware in safe mode; restarted my computer but I am still getting the pop ups and redirects in Mozilla and IE. It has also taken over my Windows Security Center and the Virus Protection is off… telling me I need to download WinBlueSoft to protect my computer. It also keeps telling me my memory is low. I've ran RootkitRepeal which found gaopdxserv.sys under hidden services. Any help would be greatly appreciated. Here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:49:24, on 5/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
H:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
H:\PROGRA~1\AVG\AVG8\avgfws8.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
H:\Program Files\Common Files\Motive\McciCMService.exe
H:\PROGRA~1\AVG\AVG8\avgam.exe
H:\WINDOWS\system32\svchost.exe
H:\PROGRA~1\AVG\AVG8\avgrsx.exe
H:\PROGRA~1\AVG\AVG8\avgnsx.exe
H:\Program Files\TVersity\Media Server\MediaServer.exe
H:\WINDOWS\system32\MsPMSPSv.exe
H:\PROGRA~1\AVG\AVG8\avgemc.exe
H:\Program Files\AVG\AVG8\avgcsrvx.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\AVG\AVG8\avgtray.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
H:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSMonitor.exe
H:\Program Files\iPod\bin\iPodService.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - H:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - H:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - H:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [AVG8_TRAY] H:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AVGIDS] "H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe"
O4 - HKLM\..\Run: [Malwarebytes Piracy] "H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /piracy
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinBlueSoft] H:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - Startup: Adobe Media Player.lnk = H:\Program Files\Adobe Media Player\Adobe Media Player.exe
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = H:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {3713F92E-2252-4A87-868E-C5F17704D4C6} (RockYou Image Uploader Control) - http://www.rockyou.com/RockYouImageUploader.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/sit…b?1214197635265
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1214182913484
O16 - DPF: {BCBC9371-9827-11DA-A72B-0800200C9A66} (View22RTEv4 Class) - http://merillat.view22.com/release_3_9_177/View22RTEv4.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - H:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - H:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - H:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - H:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - H:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - H:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: AVGIDSAgent - AVG - H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe
O23 - Service: AVGIDSWatcher - AVG - H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe
O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - H:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McciCMService - Motive Communications, Inc. - H:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: UYTIYQ - Sysinternals - www.sysinternals.com - H:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UYTIYQ.exe

–
End of file - 8148 bytes

CatByte

Post #2May 23, 2009, 7:05 PM UTC last edited May 23, 2009, 7:05 PM UTC

Hi,

I've ran Smitfraudfix and have a HJT log. I've also ran Malware Bytes Anti-Malware in safe mode; restarted my computer but I am still getting the pop ups and redirects in Mozilla and IE. It has also taken over my Windows Security Center and the Virus Protection is off… telling me I need to download WinBlueSoft to protect my computer. It also keeps telling me my memory is low. I've ran RootkitRepeal which found gaopdxserv.sys under hidden services.

Please post the other logs if you still have them.

NEXT

Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Double click on combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

nora123_99

Post #3May 24, 2009, 1:05 AM UTC

Thanks for the quick response.

Here is my SmitFraudFix log:

SmitFraudFix v2.416

Scan done at 21:53:30.90, Sat 05/23/2009
Run from H:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
H:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
H:\PROGRA~1\AVG\AVG8\avgfws8.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
H:\Program Files\Common Files\Motive\McciCMService.exe
H:\PROGRA~1\AVG\AVG8\avgam.exe
H:\WINDOWS\system32\svchost.exe
H:\PROGRA~1\AVG\AVG8\avgrsx.exe
H:\PROGRA~1\AVG\AVG8\avgnsx.exe
H:\Program Files\TVersity\Media Server\MediaServer.exe
H:\WINDOWS\system32\MsPMSPSv.exe
H:\PROGRA~1\AVG\AVG8\avgemc.exe
H:\Program Files\AVG\AVG8\avgcsrvx.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\AVG\AVG8\avgtray.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
H:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSMonitor.exe
H:\Program Files\iPod\bin\iPodService.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» H:\

»»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» H:\Documents and Settings\Administrator

»»»»»»»»»»»»»»»»»»»»»»»» H:\DOCUME~1\ADMINI~1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» H:\Documents and Settings\Administrator\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» H:\DOCUME~1\ADMINI~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» H:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="H:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

H:\WINDOWS\system32\drivers\opdxxkwxiokl.sys detected !
use a Rootkit scanner

H:\WINDOWS\system32\opdxcgndlrbv.dll detected !
use a Rootkit scanner

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{EA82DC7D-E723-483E-A84E-9EC691009E9A}: DhcpNameServer=192.168.1.254

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

and here is my RootkitRepeal log:

ROOTREPEAL © AD, 2007-2008
==================================================
Scan Time: 2009/05/23 14:08
Program Version: Version 1.2.3.0
Windows Version: Windows XP SP3
==================================================

Drivers
——————-
Name: albu.sys
Image Path: albu.sys
Address: 0xF7570000 Size: 61440 File Visible: No
Status: -

Name: dump_atapi.sys
Image Path: H:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF1CB9000 Size: 98304 File Visible: No
Status: -

Name: dump_WMILIB.SYS
Image Path: H:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B06000 Size: 8192 File Visible: No
Status: -

Name: rootrepeal.sys
Image Path: H:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEEB75000 Size: 45056 File Visible: No
Status: -

Hidden/Locked Files
——————-
Path: H:\WINDOWS\Prefetch\ROOTREPEAL.EXE-04BED643.pf
Status: Size mismatch (API: 14442, Raw: 14374)

Path: H:\WINDOWS\Temp\247caa74-48a1-4aa7-b979-86e56190c8c4.tmp
Status: Invisible to the Windows API!

Path: H:\WINDOWS\Temp\93088ffa-a60d-4543-8d51-0906977b7546.tmp
Status: Invisible to the Windows API!

Path: H:\WINDOWS\Temp\075f047b-8edf-4534-b246-cd1f231b5999.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\WINDOWS\Temp\217fd201-b2d8-47a3-a627-f7be751613ed.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\WINDOWS\Temp\28c1985e-a1ca-496e-a947-ea371db7f641.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\WINDOWS\Temp\8119676c-05f1-4aa3-87b1-e4a6bf047886.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\WINDOWS\Temp\986cc6e8-df0f-43df-85c3-6795acb1369e.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\WINDOWS\Temp\cb710993-2f1f-47a6-a769-c5f7c0b690c4.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\WINDOWS\Temp\d4bcaa20-6f22-4642-944e-80785813c244.tmp
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD354.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\9JPS4A4I.emf
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\aax5C8.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Albums
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\ArcUpdater
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\avgdiagex
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\BWCLHD0M.emf
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\CDM
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\CleaningLab Temporary Files
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\hsperfdata_Administrator
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\ins1.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\is-4IHGO.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\is-KDKL3.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\is-SUBB4.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\iss42A.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\PSSysChk.log
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\QuickCam_11.90.1263
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\RarSFX0
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd101.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd109.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd10E.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd112.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd11FD.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd13C.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd14.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD362.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD36B.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD371.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD380.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD3AB.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD3B4.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\TCD3B9.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\DT BDJ
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\DT IHD
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\en-us
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\7zS7.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\FL Studio
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\iss498.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\plugtmp-10
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\PSQuar
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd142B.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rd660.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\rdFC4.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\0MWOAIH8.emf
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\4LSFI0WF.emf
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\7zS1.tmp
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER8ae6.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER96f8.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WERf36d.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Temporary Directory 4 for DJ_Benzi-Kanye_West-Sky_High.zip
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Temporary Directory 4 for DJ_Chuck_T-Sexxxplicit_R&B_48.zip
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Temporary Directory 5 for DJ_Benzi-Kanye_West-Sky_High.zip
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Temporary Directory 5 for DJ_Chuck_T-Sexxxplicit_R&B_48.zip
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\view22
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER3421.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER345d.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER4534.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER7284.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER7365.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\WER7d10.dir00
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\item1.ico
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\item2.ico
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\item3.ico
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Logitech
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\mgxgroups
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\mgxlicense
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\NAV15.5.0.23
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\OIS
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\OneNoteRuntimeCache
Status: Invisible to the Windows API!

Path: H:\Documents and Settings\All Users\Application Data\avg8\Log\avgcore.log
Status: Size mismatch (API: 893590, Raw: 892814)

Path: H:\Documents and Settings\All Users\Application Data\avg8\Log\avglng.log
Status: Size mismatch (API: 258218, Raw: 232762)

Path: H:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009052320090524\index.dat
Status: Size mismatch (API: 65536, Raw: 49152)

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\16JK9WV1\index[1].htm
Status: Allocation size mismatch (API: 40960, Raw: 49152)

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\16JK9WV1\btn-product_comparison[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\16JK9WV1\icon-support[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1L79FRA0\navigation_940[1].css
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1L79FRA0\sub_threat_web_elevated[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1OSDEX3O\sub_threat_malware_elevated[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1OSDEX3O\title-tis_pro[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\29HJ82GG\icon-globe[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\29HJ82GG\trendwatch_subpage[1].jpg
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\31SEM0R3\bg_main[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\31SEM0R3\box-tis_pro[1].jpg
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3JPD2AHO\sub_threat_spam_high[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3JPD2AHO\tm_print[1].css
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4TFLXFEE\hijackthis_icon_50x49[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\4TFLXFEE\icon_email[1].gif
Status: Visible to the Windows API, but not on disk.

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Tapemasters_Inc_-Lil_Wayne-Young_Money_Millionaire_5\Tapemasters_Inc.-Lil_Wayne-Young_Money_Millionaire_5\07-Lil_Wayne_Feat._Drake_Jae_Millz_Gudda_Gudda_Mack_Maine-Every_Girl.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_2\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_2\01-Bun-B_Feat._C-Note_Big_Pokey_ESG_Lil_Keke_Trae_The_Truth_Z-Ro-Chopped_Screwed_H-Town_Remix_.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\01-Scarface_Feat._The_Product_Z-Ro-Soldier_Boyz.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\05-Willie_D_Of_The_Geto_Boys_-Fueling_My_Fire.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\06-Chamillionaire_Feat._Charlie_Boy_Tum_Tum-Chop_Chop.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\09-Tum_Tum_Feat._TBGz-Dallas_Starz_Shining.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\13-Trae_Tha_Truth_Feat._Yung_Joc-It_Ain_t_Nothin_.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\14-Bun-B_Feat._Mike_Jones_Slim_Thug-My_City.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_(The_Texas_Renaissance)\DJ_Chuck_T-Deep_In_The_Heart_Of_Texas_3_The_Texas_Renaissance_\20-PJ_Da_Rap_Hustla_Boss_Hogg_Outlawz_-Da_Man.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\03-Ice_Cube-Bitch_Is_A_Bitch.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\04-Ice_Cube-Straight_Outta_Compton.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\05-Ice_Cube-F_ck_The_Police.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\06-Ice_Cube-Gangsta_Gangsta.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\08-Ice_Cube-Nigga_You_Love_To_Hate.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\09-Ice_Cube-Summer_Vacation.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\12-Ice_Cube-Jackin_For_Beats.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\14-Ice_Cube-A_Bird_In_The_Hand.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\28-Ice_Cube-You_Know_How_We_Do_It_Remix_.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\31-Ice_Cube-Pushin_Rhymes_Like_Weight.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\32-Ice_Cube-Put_Ya_Ass_Into_It.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\34-Ice_Cube_Feat._NWA-Chin_Check.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\35-Ice_Cube_Feat._Snoop_Dogg-Go_To_Church.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\19-Ice_Cube_Feat._Ice_T-Trespass.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\20-Ice_Cube-My_Skin_Is_My_Sin.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\23-Ice_Cube-When_Will_They_Shoot_.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\25-Ice_Cube-Today_Was_A_Good_Day.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\Mr_Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_(The_Very_Best_Of_89-09)\Mr._Peter_Parker-Ice_Cube-No_Sleep_Til_Compton_The_Very_Best_Of_89-09_\27-Ice_Cube-Bop_Gun_1_Nation_.mp3:Zone.Identifier
Status: Locked to the Windows API!

Path: H:\Documents and Settings\Administrator\My Documents\My Music\mixtapes\The_Empire-Drake-The_Drought_Is_Over_(Friends_With_Money)\The_Empire-Drake-The_Drought_Is_Over_Friends_With_Money_\07-Drake_Feat._Lil_Wayne_Nut_Da_Kid-I_Want_This_Forever.mp3:Zone.Identifier
Status: Locked to the Windows API!

SSDT
——————-
#: 025 Function Name: NtClose
Status: Hooked by "H:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys" at address 0xf78998a0

#: 122 Function Name: NtOpenProcess
Status: Hooked by "H:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys" at address 0xf78998d0

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "H:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys" at address 0xf7899980

#: 258 Function Name: NtTerminateThread
Status: Hooked by "H:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys" at address 0xf7899a20

#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "H:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys" at address 0xf7899ac0

Hidden Services
——————-
Service Name: gaopdxserv.sys
Image Path: H:\WINDOWS\system32\drivers\gaopdxxkwxiokl.sys

So I'm fixing to download ComboFix and run HJT - will post new logs shortly.

Thanks again for all of your help.

–Nora

nora123_99

Post #4May 24, 2009, 1:47 AM UTC

Ok. Ran ComboFix… Here is my log:

ComboFix 09-05-23.04 - Administrator 05/23/2009 22:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.555 [GMT -5:00]
Running from: h:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Internet Security 3-pack *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\windows\100559zoj27.bin
h:\windows\10501wor95d6z.bin
h:\windows\1055spywaze2194.bin
h:\windows\10849not-a5zirus52e9.exe
h:\windows\1089addwa9z2155.cpl
h:\windows\10z85w5rm29f.ocx
h:\windows\1118zhac9to5l6f6.ocx
h:\windows\121259py2zf.dll
h:\windows\12205tea92874z.bin
h:\windows\12967worz589.ocx
h:\windows\13566not-z-virus65a9.bin
h:\windows\136es5arse259z.dll
h:\windows\137bt5r9at3z535.bin
h:\windows\13921no95a-virzs5cc.bin
h:\windows\14906v59uz7e0.dll
h:\windows\15183v9ruz1e8.dll
h:\windows\1523thizf9597.bin
h:\windows\1554spyw9rz339.dll
h:\windows\15559worm1za.dll
h:\windows\15584troz6669.dll
h:\windows\1559steal2z66.dll
h:\windows\155dbackdooz4599.ocx
h:\windows\15653haczto9l1fd.cpl
h:\windows\158ethief39z0.ocx
h:\windows\1617thre5t25391z.bin
h:\windows\1629addw5re7z2.cpl
h:\windows\16887wo5z9cf.dll
h:\windows\17046spzmbot54d9.dll
h:\windows\17156spy790z.dll
h:\windows\1729995yz5.ocx
h:\windows\174aspyzare25795.exe
h:\windows\179495iruzd.dll
h:\windows\1796z5acktool6db.dll
h:\windows\17d5addwar9976z.ocx
h:\windows\17z759ot-a-virus764.cpl
h:\windows\185dzddwar9962.cpl
h:\windows\19119wo5z2969.dll
h:\windows\19199spambot7z5.ocx
h:\windows\19436wozm57c5.exe
h:\windows\19877wozm359.ocx
h:\windows\1989tzrea910265.dll
h:\windows\1a3zthr5at170559.cpl
h:\windows\1d9bdoznloader2252.exe
h:\windows\1db3downzoa9er5972.cpl
h:\windows\1f559zr725.dll
h:\windows\1z122t9o56d2.exe
h:\windows\1z361worm95c.cpl
h:\windows\1z40thr5at252629.bin
h:\windows\1z479spy55f.dll
h:\windows\1z694not-a-v9rus75d.cpl
h:\windows\20359worz440.ocx
h:\windows\203805orm4fz9.ocx
h:\windows\205zspa9se2492.bin
h:\windows\207z3hack5o9l2db.exe
h:\windows\2136s5arze3239.bin
h:\windows\21553wo9m3caz.exe
h:\windows\2165not-a-zir9s248.cpl
h:\windows\21992wozm75c5.exe
h:\windows\221z19r5j479.cpl
h:\windows\22575viz9s115.exe
h:\windows\225zw9rm57d5.dll
h:\windows\22z41worm529.exe
h:\windows\23321zor5769.exe
h:\windows\2359pazbot8c.cpl
h:\windows\235ezackdoor3969.ocx
h:\windows\23711vir956z3.bin
h:\windows\2374z5acktool937.cpl
h:\windows\23764not-5-9irzs3e5.cpl
h:\windows\23b6backdoorz509.bin
h:\windows\23d2download59668z.exe
h:\windows\24745hackz59l8b.dll
h:\windows\25100w9zm6d6.dll
h:\windows\258425az9tool2a5.dll
h:\windows\2595thiefz859.dll
h:\windows\2597hac5tzo91fc.cpl
h:\windows\2597wo9m74z.dll
h:\windows\25eethze93189.dll
h:\windows\25z26hacktool2ba9.cpl
h:\windows\25z35spa9bot78e.exe
h:\windows\25z53spambot549.ocx
h:\windows\26z1backd95r2555.ocx
h:\windows\27884spa9bo57dz.cpl
h:\windows\2834d59nloaderz154.cpl
h:\windows\28392spyz285.ocx
h:\windows\285359orz657.ocx
h:\windows\28591worm27z.bin
h:\windows\28820spa95ot47z.bin
h:\windows\29255hack5ool23cz.cpl
h:\windows\2933zv5rus42e9.ocx
h:\windows\29353s5ambotz77.cpl
h:\windows\29434noz-5-virus4e0.exe
h:\windows\29542wozm989.dll
h:\windows\29584virus3zf9.bin
h:\windows\29695not-a-virzs642.exe
h:\windows\299thzef1055.exe
h:\windows\2a08dzw5loader8769.dll
h:\windows\2cevir1z759.ocx
h:\windows\2f95vzr3029.bin
h:\windows\2f99downlo5dzr2789.dll
h:\windows\2z998spy18e5.ocx
h:\windows\30355hacktozl2ca9.ocx
h:\windows\30f5spywaze1694.exe
h:\windows\31324hac5to9z430.ocx
h:\windows\3139ztroj550.exe
h:\windows\315z5hack5ool944.dll
h:\windows\32062ha5ktool62z9.bin
h:\windows\32390zpamb5tac.exe
h:\windows\3251zworm519.ocx
h:\windows\32558hackt9ol6za.bin
h:\windows\328zs9ywar53212.bin
h:\windows\3299tzoj5f.dll
h:\windows\3444z95rse3198.ocx
h:\windows\3509baczdoor13229.bin
h:\windows\3511zackdo9r1762.ocx
h:\windows\3566back9oorz159.exe
h:\windows\35dddow9z5ader2042.bin
h:\windows\35ddst9zl693.dll
h:\windows\35fzir309.exe
h:\windows\35z5backdoor389.dll
h:\windows\35zvir497.bin
h:\windows\3709b5ckzoor3005.ocx
h:\windows\372ab5zkdoor3982.dll
h:\windows\3747dow9lo5der20z8.cpl
h:\windows\385cthr9at2052z.exe
h:\windows\388dbackdo5r9691z.dll
h:\windows\39b5thief30z7.exe
h:\windows\3aethrza516901.dll
h:\windows\3b16szyw5re9179.ocx
h:\windows\3bf5spy9zre2883.ocx
h:\windows\3d9eba5zdo9r528.exe
h:\windows\3f69ste5l2z88.dll
h:\windows\3fd3add5arez695.ocx
h:\windows\3z46ba5kdoor1593.ocx
h:\windows\3z54downloa5er7459.exe
h:\windows\3z566s9ambot150.dll
h:\windows\3z6839ot-a-viru56f8.dll
h:\windows\3zef5hreat14978.bin
h:\windows\413dspzwar52946.bin
h:\windows\4176zackdoo5491.exe
h:\windows\41ccspzrs53299.exe
h:\windows\42895pz9are441.cpl
h:\windows\457downlo9d5z1855.cpl
h:\windows\45fthreatz29415.exe
h:\windows\45z6back9oor3205.dll
h:\windows\4665backdoorz259.exe
h:\windows\486ca9dwaz53002.ocx
h:\windows\4953viru973dz.exe
h:\windows\49e2adzwar5911.exe
h:\windows\4a955pzr9e2346.bin
h:\windows\4b61spywarz24359.dll
h:\windows\4c509ddwarez403.exe
h:\windows\4c9abz9kdo5r1191.ocx
h:\windows\4dfcb9ckdzo51476.bin
h:\windows\4fdzbackd9or5766.ocx
h:\windows\5019spzrse180.exe
h:\windows\5085tr9z550.dll
h:\windows\5121thr9at2922z5.dll
h:\windows\5175tr9z3b3.cpl
h:\windows\51abthreat2z109.dll
h:\windows\51z7vi5us11c9.bin
h:\windows\51z8not-a5virus9c.exe
h:\windows\52a3thi9fz22.dll
h:\windows\52aethief105z9.cpl
h:\windows\52d259ief1z88.exe
h:\windows\52zethief2859.bin
h:\windows\53104zirus5f19.dll
h:\windows\5376downl9zd5r1523.ocx
h:\windows\54635s9y542z.bin
h:\windows\548b9ackdoor5648z.dll
h:\windows\549ebackdoor8z25.cpl
h:\windows\54zeaddw9re1424.dll
h:\windows\5529baczdoor1184.ocx
h:\windows\5538spzmbot139.dll
h:\windows\5595vi521z89.ocx
h:\windows\55acthiez494.bin
h:\windows\55b1t9izf15.bin
h:\windows\55f2stez92937.ocx
h:\windows\564fs9arze12535.cpl
h:\windows\56920worm3z5.cpl
h:\windows\569aspzware907.exe
h:\windows\56e0vzr20029.dll
h:\windows\575cspzrse1197.exe
h:\windows\57bfadz5a9e1855.ocx
h:\windows\585369azktool255.bin
h:\windows\5873zr9j3e2.dll
h:\windows\5943wo5m69z.dll
h:\windows\595dbacz9oor674.dll
h:\windows\595e5hrzat30975.cpl
h:\windows\59717wormz8.bin
h:\windows\5975spywaze294.dll
h:\windows\59f4zdd5are2152.bin
h:\windows\59f75pywarz9272.dll
h:\windows\59zaddware2261.ocx
h:\windows\59zcba5kdoor3100.bin
h:\windows\5a99thrza528960.bin
h:\windows\5ac795zal3273.ocx
h:\windows\5bfzvir1195.exe
h:\windows\5c65thzef9970.ocx
h:\windows\5cd1th9eaz56114.ocx
h:\windows\5d5zbackdo9r3108.dll
h:\windows\5d66thief1z19.exe
h:\windows\5f57zte9l2191.cpl
h:\windows\5f61vzr94555.ocx
h:\windows\5fe9d5wnlozder296.dll
h:\windows\5z0esteal2519.cpl
h:\windows\5z38thie9175.cpl
h:\windows\5z4b59ief2228.dll
h:\windows\5z5caddware1915.dll
h:\windows\5z73worm97.exe
h:\windows\5z931troj945.bin
h:\windows\5zffdow9loa5er2495.exe
h:\windows\60275t9alz359.ocx
h:\windows\625895y65ez.bin
h:\windows\6385thzeat19048.exe
h:\windows\6395st9al1071z.cpl
h:\windows\654fsz9al2471.exe
h:\windows\655zspars92232.ocx
h:\windows\6590szeal2547.bin
h:\windows\65czs9arse156.ocx
h:\windows\65z99pa5bot697.bin
h:\windows\665f5ddz9re1818.exe
h:\windows\6719tzoj586.cpl
h:\windows\67f9zi95390.ocx
h:\windows\6829z9t-a-virus5e0.dll
h:\windows\6934zacktool57.dll
h:\windows\69559pamboz6955.dll
h:\windows\696haz5tool611.ocx
h:\windows\6a9btzief3571.exe
h:\windows\6acbspyw5ze9107.bin
h:\windows\6c95zpyware733.cpl
h:\windows\6ca0down5oader7z39.exe
h:\windows\6d159hief1153z.ocx
h:\windows\6e06b5ckdoor93z9.ocx
h:\windows\6f6espazse579.cpl
h:\windows\6z69back9o5r1309.exe
h:\windows\6zdc5teal4859.ocx
h:\windows\7057spyzare942.exe
h:\windows\7259thie9184z5.ocx
h:\windows\7353vir9s5e5z.cpl
h:\windows\7364spam5oz4b09.ocx
h:\windows\746zspyw9re516.cpl
h:\windows\75aavir590z9.bin
h:\windows\75b5addware2984z.ocx
h:\windows\75cfvir2891z.ocx
h:\windows\75efz5dware31979.dll
h:\windows\75z4spywar9574.dll
h:\windows\7731noz5a-viru961b.cpl
h:\windows\77d0v5r293z.ocx
h:\windows\77e5bzc9door673.bin
h:\windows\7911addwa5e1999z.exe
h:\windows\795bbac5z9or292.exe
h:\windows\7978adzwar52105.ocx
h:\windows\79d5thzef99.ocx
h:\windows\7a52zh9ef1599.dll
h:\windows\7b0steaz90495.exe
h:\windows\7bf3zd9ware2457.dll
h:\windows\7c98down59aderz063.cpl
h:\windows\7z329hre5t5150.cpl
h:\windows\8019zorm959.cpl
h:\windows\818thief9z55.bin
h:\windows\8392w9rm515z.cpl
h:\windows\8479not-a-vi95s572z.ocx
h:\windows\8591vir5z58f.dll
h:\windows\875spzware2599.cpl
h:\windows\8951sp95z7.ocx
h:\windows\8958not-a-5izus209.exe
h:\windows\896troz185.dll
h:\windows\8983z5cktool290.dll
h:\windows\8a9sparsz1352.ocx
h:\windows\8a9spyw5re5z7.cpl
h:\windows\8dedo5nloaz9r1964.ocx
h:\windows\90453virzs49c.dll
h:\windows\9047s9amzo5c4.exe
h:\windows\90659zroj71a.bin
h:\windows\90741wor5ze2.exe
h:\windows\90892zi5us586.bin
h:\windows\90951sp5z5b.exe
h:\windows\9180n9t-a-zi5us741.cpl
h:\windows\929zvir1058.ocx
h:\windows\940szy55f.cpl
h:\windows\953viruz22b.bin
h:\windows\95716not-a-vzrus255.bin
h:\windows\965aspywarz2897.bin
h:\windows\9697s5y77az.ocx
h:\windows\96999spzmbot25.exe
h:\windows\969zsparse3805.ocx
h:\windows\96z9backdoo51047.cpl
h:\windows\971z4spambot5d9.bin
h:\windows\9760zr9j315.exe
h:\windows\98065acktozl6f99.exe
h:\windows\99740nzt-a-virus1c5.cpl
h:\windows\999z5spambot15d.bin
h:\windows\99abac5dozr2732.dll
h:\windows\9b5aazdware1279.dll
h:\windows\9bfathre5t91z7.ocx
h:\windows\9d42threat1452z.dll
h:\windows\9d79bzck5oor1696.bin
h:\windows\9dzaddware17845.dll
h:\windows\9e3s5zwar92996.dll
h:\windows\9f9zvir1345.exe
h:\windows\9fa0add5are1z67.ocx
h:\windows\9fa2t5iefz887.bin
h:\windows\9z9aspywa5e503.ocx
h:\windows\9z9v95us5a3.exe
h:\windows\9zf4backdoor2561.cpl
h:\windows\b5ct9izf2067.exe
h:\windows\b9adz5are761.cpl
h:\windows\c5bac5d9or2z3.dll
h:\windows\d92threat5z659.dll
h:\windows\e93zteal945.exe
h:\windows\f23th5ef15z19.exe
h:\windows\f7s5ezl19989.bin
h:\windows\fd9thrzat51457.dll
h:\windows\system32\1045z5y7b99.dll
h:\windows\system32\1059stealz529.cpl
h:\windows\system32\10840szy3945.ocx
h:\windows\system32\114985pambzt353.bin
h:\windows\system32\115ebac59oor162z.dll
h:\windows\system32\11690troj55z9.exe
h:\windows\system32\11960s5y3fz.dll
h:\windows\system32\11aba9k5oor191z.dll
h:\windows\system32\12419spy359z.cpl
h:\windows\system32\12598s5ambzt97e.ocx
h:\windows\system32\12599spambot56z5.ocx
h:\windows\system32\129zste9l529.exe
h:\windows\system32\1349s5ambotzef9.ocx
h:\windows\system32\1369no5-a-virus76z.ocx
h:\windows\system32\13960w5zm36f.exe
h:\windows\system32\13det9iefz85.cpl
h:\windows\system32\13z5sp9rse1498.exe
h:\windows\system32\1417ztr5j599.ocx
h:\windows\system32\1425sp5zse2019.bin
h:\windows\system32\14335spy9d5z.cpl
h:\windows\system32\143495rojz9f.bin
h:\windows\system32\15151spz9bb.dll
h:\windows\system32\15211zp9479.bin
h:\windows\system32\152275pzmbot692.exe
h:\windows\system32\152959pyz9.exe
h:\windows\system32\1529virus29z.dll
h:\windows\system32\1537thre9t257z9.bin
h:\windows\system32\1537zac9doo52323.bin
h:\windows\system32\1538z9orm6fb.dll
h:\windows\system32\15414w5z92c9.dll
h:\windows\system32\15473worm9z.cpl
h:\windows\system32\15592ha5ktooz39a.exe
h:\windows\system32\15679zoj373.exe
h:\windows\system32\156dspyw5ze2927.dll
h:\windows\system32\15753h5ckt9ol7zf.bin
h:\windows\system32\158539orm4az.exe
h:\windows\system32\15z90not-a9virus15d.bin
h:\windows\system32\15zevir1294.ocx
h:\windows\system32\1605tzoj799.exe
h:\windows\system32\16209z9y155.ocx
h:\windows\system32\16450t5zj4bf9.cpl
h:\windows\system32\16505spy9z8.bin
h:\windows\system32\16554viruszc89.dll
h:\windows\system32\165z495rus82.exe
h:\windows\system32\1751wo9m2ebz.cpl
h:\windows\system32\17d9spzware2265.cpl
h:\windows\system32\18352n9t-a5viruz36d.exe
h:\windows\system32\187dsz9al19865.bin
h:\windows\system32\18ztr9j3595.cpl
h:\windows\system32\19147w5rmzb.dll
h:\windows\system32\19149vi59z24.cpl
h:\windows\system32\192499ot-a-virus25z.cpl
h:\windows\system32\19593ziru55c9.bin
h:\windows\system32\1959stea52522z.ocx
h:\windows\system32\1959zpyware1727.bin
h:\windows\system32\195asparse2450z.cpl
h:\windows\system32\1995zworm45a9.ocx
h:\windows\system32\1eecs9ea544z.dll
h:\windows\system32\1f25spzrse2794.bin
h:\windows\system32\1fc2azdwar59953.dll
h:\windows\system32\1z891hacktool45d.bin
h:\windows\system32\2079backd5zr1366.ocx
h:\windows\system32\209165zoj15d.dll
h:\windows\system32\20971wor5z65.bin
h:\windows\system32\209755pa9bot6zb.dll
h:\windows\system32\20z935py752.dll
h:\windows\system32\21239zpa9bot2075.cpl
h:\windows\system32\2145zspy939.cpl
h:\windows\system32\22792not5a-virus1z7.bin
h:\windows\system32\23207sp5zbot49e.dll
h:\windows\system32\232zsteal9065.cpl
h:\windows\system32\23zbdo9nloade51491.dll
h:\windows\system32\25153sp9351z.bin
h:\windows\system32\252359oj52z.cpl
h:\windows\system32\25544szy759.cpl
h:\windows\system32\2558ztro95ca.ocx
h:\windows\system32\25846spy12z9.ocx
h:\windows\system32\25869spy3z9.cpl
h:\windows\system32\25879woz57459.exe
h:\windows\system32\2589sparze9755.cpl
h:\windows\system32\26215zr9j353.exe
h:\windows\system32\26589wo5mzd3.bin
h:\windows\system32\26671nz5-a-9irus3a6.ocx
h:\windows\system32\26891spzm95t25.dll
h:\windows\system32\27033zpy59c5.bin
h:\windows\system32\2755zworm495.exe
h:\windows\system32\275625ormz96.exe
h:\windows\system32\27d1downl9adez9425.dll
h:\windows\system32\2851ztr9j11e.ocx
h:\windows\system32\28539viru911az.exe
h:\windows\system32\2868ztro5905.bin
h:\windows\system32\288059acktooz558.ocx
h:\windows\system32\29026tzoj559.cpl
h:\windows\system32\29259spamb5t51ez.cpl
h:\windows\system32\2932vzr28875.dll
h:\windows\system32\2950zspy650.ocx
h:\windows\system32\2952t5ojzb89.exe
h:\windows\system32\295z2ha5ktool392.dll
h:\windows\system32\296z9vi9u5358.ocx
h:\windows\system32\2973zworm259.cpl
h:\windows\system32\298cspars51944z.cpl
h:\windows\system32\29995szy975.bin
h:\windows\system32\2a54backdoor394z5.dll
h:\windows\system32\2ae9a5zware1965.dll
h:\windows\system32\2azath9eat513.bin
h:\windows\system32\2azcs5ars91097.ocx
h:\windows\system32\2b15z9r5645.dll
h:\windows\system32\2b56zhreat184729.bin
h:\windows\system32\2c9azir5255.ocx
h:\windows\system32\2de5downlzader9294.ocx
h:\windows\system32\2fz5spywa9e12835.exe
h:\windows\system32\2z1545ot-a-vi9us57.dll
h:\windows\system32\2z30259oj79a.cpl
h:\windows\system32\2z353spam5o9516.cpl
h:\windows\system32\2z36ha9kt5ol7ab.cpl
h:\windows\system32\2z385spy509.exe
h:\windows\system32\2z73s9ywar51094.dll
h:\windows\system32\2z966sp514f.exe
h:\windows\system32\30275notza-5i9us292.dll
h:\windows\system32\3043659t-a-virus5z1.bin
h:\windows\system32\30498zi95s3ff.ocx
h:\windows\system32\305225pyz6f9.exe
h:\windows\system32\3059not9a-virus3zb.cpl
h:\windows\system32\306785zt-a-vir9s1cb.bin
h:\windows\system32\3091virz8095.ocx
h:\windows\system32\3105th9ez12285.ocx
h:\windows\system32\31445not-9-virus3bz.ocx
h:\windows\system32\31785own9oadez3191.dll
h:\windows\system32\31855troj6z19.exe
h:\windows\system32\319edownloader19z5.ocx
h:\windows\system32\31z35spy679.dll
h:\windows\system32\32026hacktozl9ad5.exe
h:\windows\system32\32157szambot5e9.ocx
h:\windows\system32\3249dow9lozder253.exe
h:\windows\system32\3355wor97ze.ocx
h:\windows\system32\3393not-a-vi95z130.bin
h:\windows\system32\339zst5al8229.bin
h:\windows\system32\346thi9527z4.ocx
h:\windows\system32\349fdownlo5zer2123.exe
h:\windows\system32\3589thzef2996.dll
h:\windows\system32\35e09ddwzre2005.ocx
h:\windows\system32\35e3s9yzare1896.bin
h:\windows\system32\35e7spa9se1119z.cpl
h:\windows\system32\35z1spar5e789.exe
h:\windows\system32\35z9download9r2844.ocx
h:\windows\system32\3680z5oj1f29.bin
h:\windows\system32\36dzadd5ar9496.dll
h:\windows\system32\3877s59az795.bin
h:\windows\system32\390bv5r16z2.exe
h:\windows\system32\390z7worm4b5.ocx
h:\windows\system32\3922backzoor1452.exe
h:\windows\system32\39349wozm51a.bin
h:\windows\system32\397cb9ckdo5r3054z.ocx
h:\windows\system32\3c16ste9l154z5.dll
h:\windows\system32\3c9ado5nlozder520.cpl
h:\windows\system32\3da9zddwa5e2863.bin
h:\windows\system32\3db5dzw95oader2765.ocx
h:\windows\system32\3ddfzhief19695.cpl
h:\windows\system32\3e27s59rsez473.bin
h:\windows\system32\3e59addwar53102z.dll
h:\windows\system32\3ea7ste5z1599.dll
h:\windows\system32\3ef7s5yware1969z.exe
h:\windows\system32\3z094spy35e.cpl
h:\windows\system32\3z364t95j63c.exe
h:\windows\system32\3za25ddw9re218.cpl
h:\windows\system32\404Fix.exe
h:\windows\system32\4170worm5z79.dll
h:\windows\system32\4249spzr5e96.cpl
h:\windows\system32\42aebzckdoo51349.ocx
h:\windows\system32\42zfste5l9211.exe
h:\windows\system32\44289hrea5z0701.dll
h:\windows\system32\44z7not-9-vi5us2fe.ocx
h:\windows\system32\4535threa924364z.cpl
h:\windows\system32\4573s9zmbot752.bin
h:\windows\system32\45czbackdo5r952.ocx
h:\windows\system32\46czspywar59366.exe
h:\windows\system32\470zsteal1590.bin
h:\windows\system32\4809t5ief1z79.bin
h:\windows\system32\48709ownzoad5r369.bin
h:\windows\system32\496fszywa5e513.exe
h:\windows\system32\4975bzckdoor11569.exe
h:\windows\system32\49z0sparse25495.exe
h:\windows\system32\4b9dt5reatz1391.bin
h:\windows\system32\4ca3z9reat15289.bin
h:\windows\system32\4d59bac5dooz53.bin
h:\windows\system32\4dc0sp9wzre7315.exe
h:\windows\system32\4e65d9wnzoader525.ocx
h:\windows\system32\4ebezdd9ar5782.cpl
h:\windows\system32\50439hacktoolze7.exe
h:\windows\system32\506athr9at299z6.bin
h:\windows\system32\50929hazkt9ol6a3.bin
h:\windows\system32\5095addza9e2890.bin
h:\windows\system32\51215hizf1965.exe
h:\windows\system32\5182spy589z.bin
h:\windows\system32\5193trzj4f4.ocx
h:\windows\system32\51b1z9i5f1850.cpl
h:\windows\system32\52794not-a-virus13ez.exe
h:\windows\system32\52f0v9r1z31.cpl
h:\windows\system32\5339v5r29z1.ocx
h:\windows\system32\5365spy9are149z.dll
h:\windows\system32\5392ste5z2525.ocx
h:\windows\system32\53czdownloa9er2769.exe
h:\windows\system32\53e1addw9rz2043.cpl
h:\windows\system32\54539o5mz8.cpl
h:\windows\system32\546b9hief1z80.dll
h:\windows\system32\55194s9ambotzd9.bin
h:\windows\system32\5522backdooz9834.dll
h:\windows\system32\552hazkt9ol45a.ocx
h:\windows\system32\5535not-a-vir9s67bz.ocx
h:\windows\system32\556ethief9z92.ocx
h:\windows\system32\5593not-a-virus56z9.bin
h:\windows\system32\566bthzef2593.exe
h:\windows\system32\567dd9wnlo5der12z.cpl
h:\windows\system32\5715steal97z2.exe
h:\windows\system32\5731s9yz66.dll
h:\windows\system32\573zworm659.ocx
h:\windows\system32\58495zr427.ocx
h:\windows\system32\5862ha5zt9olfa.ocx
h:\windows\system32\58caz9r2996.ocx
h:\windows\system32\59130no9za-virus5e1.cpl
h:\windows\system32\59259zy2d5.ocx
h:\windows\system32\593zvirus59d9.dll
h:\windows\system32\59469spzm9ot6bb.bin
h:\windows\system32\5946spzc2.cpl
h:\windows\system32\5947zspy57b9.ocx
h:\windows\system32\59959zr1455.ocx
h:\windows\system32\59c5spyware909z.bin
h:\windows\system32\59ddspyware3215z.cpl
h:\windows\system32\59spzrse12.dll
h:\windows\system32\59z5not-a-virus3b5.exe
h:\windows\system32\5b26backdo9r850z.bin
h:\windows\system32\5b92d5wn9oadez75.exe
h:\windows\system32\5bz09h5eat18895.bin
h:\windows\system32\5c25bac9zoor280.ocx
h:\windows\system32\5c5cspy9are1362z.ocx
h:\windows\system32\5cd05h9ezt5890.cpl
h:\windows\system32\5ce3z9ief684.bin
h:\windows\system32\5cz9vir1860.dll
h:\windows\system32\5d359o5zloader1783.ocx
h:\windows\system32\5e66downzoade59771.ocx
h:\windows\system32\5e69threatz945.exe
h:\windows\system32\5e93szeal5153.cpl
h:\windows\system32\5f1f5t9al483z.bin
h:\windows\system32\5fc9zackdoor2533.ocx
h:\windows\system32\5fdb5zwnlo9der2744.exe
h:\windows\system32\5z055ir1809.exe
h:\windows\system32\5z39ad9w5re2506.cpl
h:\windows\system32\5zfthreat5959.bin
h:\windows\system32\6029hrzat272945.dll
h:\windows\system32\603zsp5rs91032.bin
h:\windows\system32\6059downloader5z39.bin
h:\windows\system32\6523s9ea5149z.exe
h:\windows\system32\6554t9reat1z120.bin
h:\windows\system32\6557worm79dz.ocx
h:\windows\system32\655edoznloader9087.cpl
h:\windows\system32\65fcv9rz632.cpl
h:\windows\system32\6756spa9sz2589.dll
h:\windows\system32\678s95mbotzc3.ocx
h:\windows\system32\688ebzckdo9r5470.ocx
h:\windows\system32\6919h5cktool48z.cpl
h:\windows\system32\6955backdoorz725.cpl
h:\windows\system32\6962backdoorz4605.exe
h:\windows\system32\699ethz5at16719.ocx
h:\windows\system32\69z4stea91985.ocx
h:\windows\system32\69z5vir1282.cpl
h:\windows\system32\6b53zackd9or2020.cpl
h:\windows\system32\6bz59ackdoor557.exe
h:\windows\system32\6d19downzoad9r2365.exe
h:\windows\system32\6dab5pyware97z3.dll
h:\windows\system32\6e0f5teal199z.ocx
h:\windows\system32\6eb5thief27z9.cpl
h:\windows\system32\6ed6bzckdo9r3835.bin
h:\windows\system32\6f59thiefz2259.bin
h:\windows\system32\6z02t5reat146319.exe
h:\windows\system32\6zaath59f894.dll
h:\windows\system32\70b69zeal592.cpl
h:\windows\system32\7108baczd9or5470.cpl
h:\windows\system32\727zhack5ool2539.bin
h:\windows\system32\72d95ownloaderz18.ocx
h:\windows\system32\738z9ownloa5er2162.cpl
h:\windows\system32\74969ackd5or14z9.bin
h:\windows\system32\767a9aczdoor952.dll
h:\windows\system32\7712s9ambot5a3z.ocx
h:\windows\system32\779faddwa5z2161.exe
h:\windows\system32\785fthi9fz34.cpl
h:\windows\system32\7a85s5eal39z6.bin
h:\windows\system32\7b4fbac9door1z54.ocx
h:\windows\system32\7d18s9ar5ez054.bin
h:\windows\system32\7d1cback9ooz915.cpl
h:\windows\system32\7d5zth9ef953.exe
h:\windows\system32\7d7zaddwar51091.bin
h:\windows\system32\7ezsparse5519.cpl
h:\windows\system32\7f59spyzare425.bin
h:\windows\system32\7fb5viz659.cpl
h:\windows\system32\7z7athrea557109.bin
h:\windows\system32\7z945teal1998.cpl
h:\windows\system32\7z95bac5door3170.exe
h:\windows\system32\7zfbdown5oa9er874.exe
h:\windows\system32\8327sp549z.cpl
h:\windows\system32\89z25pambot141.ocx
h:\windows\system32\8a4sz9a52624.cpl
h:\windows\system32\8z80ha9k5ool345.exe
h:\windows\system32\91007virus2a5z.exe
h:\windows\system32\91cevi52984z.exe
h:\windows\system32\924385py6z9.cpl
h:\windows\system32\9259sparse2747z.dll
h:\windows\system32\93b3downzoader18385.exe
h:\windows\system32\93d1addwarz1155.bin
h:\windows\system32\941z5ackdoor285.bin
h:\windows\system32\9453zpyware509.dll
h:\windows\system32\945ztroj2f3.ocx
h:\windows\system32\947caddz5re2511.exe
h:\windows\system32\94973noz-a-5irus16.dll
h:\windows\system32\949worm2z5.bin
h:\windows\system32\954359z539.cpl
h:\windows\system32\9575wo5m7z3.cpl
h:\windows\system32\9595zief1704.exe
h:\windows\system32\96157spa5zot397.bin
h:\windows\system32\96spa9ze1975.dll
h:\windows\system32\98051not-a-ziru5535.dll
h:\windows\system32\982virz1725.bin
h:\windows\system32\98728zackto5l4d9.ocx
h:\windows\system32\9914zownloader503.dll
h:\windows\system32\9940addwar52z45.ocx
h:\windows\system32\9994vizus555.exe
h:\windows\system32\9afaddwa95z968.bin
h:\windows\system32\9c2d5hief126z.dll
h:\windows\system32\9cffspzware7605.bin
h:\windows\system32\9d3dzddware2165.cpl
h:\windows\system32\9d5thr9at2z117.exe
h:\windows\system32\9e05thzeat25997.ocx
h:\windows\system32\9z3dthief2965.exe
h:\windows\system32\9zadownloade51736.dll
h:\windows\system32\9zafdownloader2355.bin
h:\windows\system32\aa5dow9loa5erz552.dll
h:\windows\system32\Agent.OMZ.Fix.exe
h:\windows\system32\b3vi9z565.dll
h:\windows\system32\bc5tezl889.ocx
h:\windows\system32\c1bthie529z99.ocx
h:\windows\system32\d22threat1519z.dll
h:\windows\system32\da4ad5w9re9z5.dll
h:\windows\system32\dumphive.exe
h:\windows\system32\e805pyw9re27z1.bin
h:\windows\system32\f15backdoor8z9.exe
h:\windows\system32\f3sparse9165z.dll
h:\windows\system32\f91szyw5re546.dll
h:\windows\system32\IEDFix.C.exe
h:\windows\system32\IEDFix.exe
h:\windows\system32\o4Patch.exe
h:\windows\system32\Process.exe
h:\windows\system32\SrchSTS.exe
h:\windows\system32\tmp.reg
h:\windows\system32\VACFix.exe
h:\windows\system32\VCCLSID.exe
h:\windows\system32\WS2Fix.exe
h:\windows\system32\z15eth9ef913.bin
h:\windows\system32\z1881spa9b5te0.exe
h:\windows\system32\z219spar5e235.dll
h:\windows\system32\z2591not-5-virus690.cpl
h:\windows\system32\z2859wor9f3.ocx
h:\windows\system32\z38455ro95d2.bin
h:\windows\system32\z3b59yware57.exe
h:\windows\system32\z543ba5kdoor18629.ocx
h:\windows\system32\z5595teal2579.dll
h:\windows\system32\z559spy5are1216.dll
h:\windows\system32\z5789roj3ea.dll
h:\windows\system32\z5809acktool80.cpl
h:\windows\system32\z591not-a-virus495.ocx
h:\windows\system32\z592ha9ktool7e5.dll
h:\windows\system32\z5avir9539.ocx
h:\windows\system32\z6981spy4165.exe
h:\windows\system32\z863v9r3015.cpl
h:\windows\system32\z8976not5a-virus2d9.ocx
h:\windows\system32\z978wo9m1f75.exe
h:\windows\system32\zbb85ir3193.bin
h:\windows\system32\zca159ief727.dll
h:\windows\system32\zdacthre9t6581.bin
h:\windows\system32\zdc79hre5t1044.exe
h:\windows\system32\zfb89ir985.ocx
h:\windows\z0584tr5j33c9.cpl
h:\windows\z0857worm975.bin
h:\windows\z11639iru56d0.ocx
h:\windows\z19bsteal9551.bin
h:\windows\z29vir31725.ocx
h:\windows\z34055pa9bot539.dll
h:\windows\z398do5nload9r2014.ocx
h:\windows\z427spy4c95.cpl
h:\windows\z4924tr5j793.ocx
h:\windows\z5652spy95b.dll
h:\windows\z59dthief578.bin
h:\windows\z5f5thief970.exe
h:\windows\z6535worm695.cpl
h:\windows\z7965acktoold8.dll
h:\windows\z8e2s9arse1589.cpl
h:\windows\z9574v5ru929b.dll
h:\windows\z97535rojd6.exe
h:\windows\z977thief1952.bin
h:\windows\z999addware1558.bin
h:\windows\za45threat19500.bin
h:\windows\zbbbspar9e5188.bin
h:\windows\zbbcdow9loader5709.bin
h:\windows\zd265a9kdoor2963.exe
h:\windows\zdcfth9eat40235.dll
h:\windows\ze0bs5ars93256.bin
h:\windows\ze34thief29695.exe
h:\windows\zf65v9r3176.dll
h:\windows\zf97sparse18625.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gaopdxserv.sys

((((((((((((((((((((((((( Files Created from 2009-04-24 to 2009-05-24 )))))))))))))))))))))))))))))))
.

2009-05-24 03:21 . 2009-05-24 03:21 ——– d—–w h:\documents and settings\Administrator\log
2009-05-23 20:08 . 2009-05-23 20:08 ——– d—–w h:\program files\ERUNT
2009-05-22 23:49 . 2008-06-19 22:24 28544 —-a-w h:\windows\system32\drivers\pavboot.sys
2009-05-22 23:49 . 2009-05-22 23:49 ——– d—–w h:\program files\Panda Security
2009-05-22 23:35 . 2009-05-22 23:35 ——– d—–w h:\documents and settings\LocalService\Application Data\Malwarebytes
2009-05-21 04:46 . 2007-04-19 20:15 7277568 —-a-w h:\windows\system32\3gpcore.dll
2009-05-21 04:46 . 2007-02-16 12:10 60273 —-a-w h:\windows\system32\pthreadGC2.dll
2009-05-21 04:46 . 2006-12-31 15:16 313344 —-a-w h:\windows\system32\avisynth.dll
2009-05-21 04:46 . 2006-10-18 03:29 487479 —-a-w h:\windows\system32\SkinMagic.dll
2009-05-21 04:46 . 2004-05-27 01:37 719872 —-a-w h:\windows\system32\devil.dll
2009-05-21 04:46 . 2009-05-21 04:46 ——– d—–w h:\windows\system32\avsplugin
2009-05-21 04:46 . 2009-05-21 04:46 ——– d—–w h:\program files\Smallvideosoft
2009-05-20 13:30 . 2009-04-27 14:42 312088 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-20 13:30 . 2009-04-27 14:42 1437464 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-20 05:08 . 2009-05-20 05:08 ——– d—–w h:\program files\WebEx
2009-05-20 00:18 . 1995-08-01 09:44 212480 —-a-w h:\windows\PCDLIB32.DLL
2009-05-19 23:10 . 2009-05-19 23:10 ——– d—–w h:\documents and settings\Administrator\Local Settings\Application Data\ArcSoft
2009-05-19 23:10 . 2009-05-21 03:14 ——– d—–w h:\documents and settings\Administrator\Application Data\ArcSoft
2009-05-19 23:09 . 2009-05-22 03:05 ——– d—–w h:\documents and settings\All Users\Application Data\ArcSoft
2009-05-19 23:09 . 2006-11-10 20:05 18688 —-a-w h:\windows\system32\drivers\afc.sys
2009-05-19 23:08 . 2009-05-20 00:18 ——– d—–w h:\program files\ArcSoft
2009-05-19 23:08 . 2007-04-19 14:39 256768 —-a-w h:\windows\system32\MSLURT.dll
2009-05-19 23:08 . 2007-04-19 14:39 400128 —-a-w h:\windows\system32\MSLUP60.dll
2009-05-19 23:08 . 2009-05-19 23:08 ——– d—–w h:\program files\Common Files\ArcSoft
2009-05-15 02:17 . 2009-05-15 02:17 2051864 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-15 02:17 . 2009-04-27 14:43 2302232 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-15 02:17 . 2009-04-27 14:43 3399960 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-15 02:17 . 2009-04-27 14:43 486168 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-15 02:17 . 2009-04-27 14:42 1224472 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgspmui.dll
2009-05-15 02:17 . 2009-04-27 14:42 3288344 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-15 02:17 . 2009-04-27 14:42 424472 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-15 02:17 . 2009-04-27 14:42 1262880 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll
2009-05-15 02:17 . 2009-04-27 14:42 177432 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-15 02:17 . 2009-04-27 14:42 2291992 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgfwui.dll
2009-05-15 02:17 . 2009-04-27 14:42 1083672 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe
2009-05-15 02:17 . 2009-04-27 14:42 755992 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-15 00:12 . 2009-04-06 20:32 15504 —-a-w h:\windows\system32\drivers\mbam.sys
2009-05-15 00:12 . 2009-04-06 20:32 38496 —-a-w h:\windows\system32\drivers\mbamswissarmy.sys
2009-05-11 07:42 . 2009-05-14 06:26 ——– d—–w h:\program files\VirtualDJ
2009-05-11 06:55 . 2009-05-11 06:55 ——– d—–w h:\documents and settings\Administrator\Application Data\Sony Setup
2009-05-11 06:55 . 2009-05-11 06:55 ——– d—–w h:\program files\Sony Setup
2009-05-10 06:47 . 2009-05-10 06:47 ——– d—–w h:\program files\QuickTime
2009-05-04 13:23 . 2009-04-27 14:43 78080 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\vmAVGConnector.dll
2009-05-04 13:23 . 2009-04-27 14:43 563456 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\dtuser.exe
2009-05-04 13:23 . 2009-04-27 14:43 2227968 —-a-w h:\documents and settings\All Users\Application Data\avg8\update\backup\avgtoolbar.dll
2009-05-03 17:09 . 2009-05-03 17:09 ——– d—–w h:\program files\Common Files\DivX Shared
2009-05-03 16:40 . 2009-05-03 16:40 ——– d—–w h:\documents and settings\Administrator\Local Settings\Application Data\WinZip
2009-05-03 16:40 . 2009-05-15 00:22 ——– d—–w h:\documents and settings\All Users\Application Data\WinZip
2009-04-29 08:01 . 2009-04-29 08:01 ——– d—–w h:\windows\system32\KB905474
2009-04-29 08:01 . 2009-03-11 03:26 1403264 —-a-w h:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-29 08:01 . 2009-03-11 03:18 453512 —-a-w h:\windows\system32\KB905474\wgasetup.exe
2009-04-25 07:12 . 2001-05-16 22:54 309616 —-a-w h:\windows\system32\wmv8dmod.dll
2009-04-25 07:12 . 2001-05-11 18:18 420240 —-a-w h:\windows\system32\mpg4c32.dll
2009-04-25 07:12 . 2009-04-25 07:12 ——– d—–w h:\program files\Common Files\MAGIX Shared
2009-04-25 03:09 . 2009-04-25 03:09 ——– d—–w h:\documents and settings\Administrator\Local Settings\Application Data\view22
2009-04-25 03:06 . 2007-10-17 13:58 155648 —-a-w h:\documents and settings\All Users\Application Data\View22\version_4\imagelib.dll
2009-04-25 03:06 . 2007-10-17 13:57 2985984 —-a-w h:\documents and settings\All Users\Application Data\View22\version_4\RoomDesign.dll
2009-04-25 03:06 . 2009-04-25 03:06 ——– d—–w h:\documents and settings\All Users\Application Data\View22
2009-04-25 03:06 . 2006-05-02 18:37 1706800 —-a-w h:\documents and settings\All Users\Application Data\View22\version_4\gdiplus.dll
2009-04-25 03:06 . 2006-05-02 18:37 1706800 —-a-w h:\windows\system32\gdiplus.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-24 03:06 . 2008-11-08 03:47 168864 —-a-w h:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tjco591x.default\FlashGot.exe
2009-05-24 02:46 . 2008-06-24 05:50 ——– d—–w h:\documents and settings\Administrator\Application Data\LimeWire
2009-05-22 03:05 . 2008-06-23 04:58 ——– d–h–w h:\program files\InstallShield Installation Information
2009-05-21 05:05 . 2009-03-08 20:23 ——– d—–w h:\program files\Lavasoft
2009-05-21 05:05 . 2009-03-07 17:57 ——– d—–w h:\documents and settings\All Users\Application Data\Lavasoft
2009-05-19 23:01 . 2008-06-23 04:58 ——– d—–w h:\program files\Common Files\InstallShield
2009-05-15 22:23 . 2008-06-22 21:54 48416 —-a-w h:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-15 08:03 . 2008-07-14 02:11 ——– d—–w h:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-15 00:31 . 2008-06-23 05:34 ——– d—–w h:\program files\LimeWire
2009-05-15 00:12 . 2009-03-08 18:50 ——– d—–w h:\program files\Malwarebytes' Anti-Malware
2009-05-10 06:46 . 2008-06-27 01:35 ——– d—–w h:\program files\Common Files\Apple
2009-05-04 07:48 . 2009-03-08 21:39 ——– d—–w h:\documents and settings\Administrator\Application Data\AVGTOOLBAR
2009-05-03 17:09 . 2008-06-27 02:22 ——– d—–w h:\program files\DivX
2009-04-27 14:43 . 2009-03-08 21:39 11952 —-a-w h:\windows\system32\avgrsstx.dll
2009-04-27 14:43 . 2009-03-08 21:39 325896 —-a-w h:\windows\system32\drivers\avgldx86.sys
2009-04-27 14:43 . 2009-03-08 21:39 27784 —-a-w h:\windows\system32\drivers\avgmfx86.sys
2009-04-27 14:42 . 2009-03-08 21:38 50968 —-a-w h:\windows\system32\avgfwdx.dll
2009-04-27 14:42 . 2009-03-08 21:38 29208 —-a-w h:\windows\system32\drivers\avgfwdx.sys
2009-04-27 14:42 . 2009-03-08 21:39 12552 —-a-w h:\windows\system32\drivers\avgrkx86.sys
2009-04-27 14:42 . 2009-03-08 21:39 108552 —-a-w h:\windows\system32\drivers\avgtdix.sys
2009-04-25 07:11 . 2008-08-01 03:16 ——– d—–w h:\program files\MAGIX
2009-04-25 02:53 . 2008-07-11 20:56 ——– d—–w h:\program files\Common Files\Adobe
2009-04-24 23:37 . 2009-01-09 02:30 ——– d—–w h:\documents and settings\Administrator\Application Data\BitTorrent
2009-04-16 06:39 . 2009-03-28 08:13 ——– d—–w h:\program files\Fastream IQ Web FTP Server Engine
2009-04-05 00:42 . 2008-11-08 20:12 ——– d—–w h:\documents and settings\Administrator\Application Data\Skype
2009-04-04 23:01 . 2008-11-08 21:26 ——– d—–w h:\documents and settings\Administrator\Application Data\skypePM
2009-04-04 20:56 . 2009-04-04 20:55 ——– d—–w h:\program files\ATT-PRT22-WISE
2009-04-04 20:55 . 2009-04-04 20:55 ——– d—–w h:\program files\att-prt22
2009-04-04 20:55 . 2009-04-04 20:55 ——– d—–w h:\program files\Common Files\Motive
2009-04-04 20:55 . 2009-04-04 20:55 ——– d—–w h:\documents and settings\All Users\Application Data\Motive
2009-03-28 22:01 . 2009-03-28 22:01 ——– d—–w h:\program files\CONEXANT
2009-03-28 08:08 . 2009-03-28 06:32 ——– d—–w h:\program files\WWW File Share Pro
2009-03-06 14:22 . 2004-08-04 05:56 284160 —-a-w h:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-04 05:56 826368 —-a-w h:\windows\system32\wininet.dll
2009-02-26 19:46 . 2009-02-26 19:46 74760 —-a-w h:\windows\system32\drivers\UniversalDD.sys
2009-02-26 19:46 . 2009-02-26 19:46 25608 —-a-w h:\windows\system32\drivers\AVGIDSErHr.sys
2009-02-24 19:34 . 2009-02-24 19:34 1044480 —-a-w h:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 —-a-w h:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="h:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-27 1947928]
"AVGIDS"="h:\program files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe" [2009-02-26 1579528]
"Malwarebytes Piracy"="h:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-04-06 1277584]
"Adobe Reader Speed Launcher"="h:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="h:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"ArcSoft Connection Service"="h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-04-29 188728]

h:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 1000 series.lnk - h:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-9 147456]
hpoddt01.exe.lnk - h:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]
Logitech Desktop Messenger.lnk - h:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-11-8 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-27 14:43 11952 —-a-w h:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"enablefirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"h:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"h:\\Program Files\\LimeWire\\LimeWire.exe"=
"h:\\Program Files\\iTunes\\iTunes.exe"=
"h:\\Documents and Settings\\Administrator\\Desktop\\af2TV.exe"=
"h:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"h:\\Program Files\\DNA\\btdna.exe"=
"h:\\Program Files\\BitTorrent\\bittorrent.exe"=
"h:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"h:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"h:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"h:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"h:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 AVGIDSErHr;AVGIDSErHr;h:\windows\system32\drivers\AVGIDSErHr.sys [2/26/2009 2:46 PM 25608]
R0 AvgRkx86;avgrkx86.sys;h:\windows\system32\drivers\avgrkx86.sys [3/8/2009 4:39 PM 12552]
R0 pavboot;pavboot;h:\windows\system32\drivers\pavboot.sys [5/22/2009 6:49 PM 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;h:\windows\system32\drivers\avgldx86.sys [3/8/2009 4:39 PM 325896]
R1 AvgTdiX;AVG8 Network Redirector;h:\windows\system32\drivers\avgtdix.sys [3/8/2009 4:39 PM 108552]
R1 GearAspiSys;GearAspiSys;h:\windows\system32\drivers\GEARASPISYS.SYS [6/29/2008 4:55 PM 53412]
R2 avg8emc;AVG8 E-mail Scanner;h:\progra~1\AVG\AVG8\avgemc.exe [4/27/2009 9:42 AM 908568]
R2 avg8wd;AVG8 WatchDog;h:\progra~1\AVG\AVG8\avgwdsvc.exe [3/8/2009 4:39 PM 298776]
R2 avgfws8;AVG8 Firewall;h:\progra~1\AVG\AVG8\avgfws8.exe [4/27/2009 9:42 AM 1366904]
R2 AVGIDSWatcher;AVGIDSWatcher;h:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe [2/26/2009 2:46 PM 563720]
R3 Avgfwdx;Avgfwdx;h:\windows\system32\drivers\avgfwdx.sys [3/8/2009 4:38 PM 29208]
R3 AVGIDSDriver;AVGIDSDriver;h:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys [2/26/2009 2:46 PM 121352]
R3 AVGIDSFilter;AVGIDSFilter;h:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys [2/26/2009 2:46 PM 30216]
R3 AVGIDSShim;AVGIDSShim;h:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys [2/26/2009 2:46 PM 27232]
S0 Lbd;Lbd;h:\windows\system32\DRIVERS\Lbd.sys –> h:\windows\system32\DRIVERS\Lbd.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;h:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe [2/26/2009 2:46 PM 5576712]
S3 Avgfwfd;AVG network filter service;h:\windows\system32\drivers\avgfwdx.sys [3/8/2009 4:38 PM 29208]
S3 UYTIYQ;UYTIYQ;h:\docume~1\ADMINI~1\LOCALS~1\Temp\UYTIYQ.exe –> h:\docume~1\ADMINI~1\LOCALS~1\Temp\UYTIYQ.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2009-05-22 h:\windows\Tasks\AppleSoftwareUpdate.job
- h:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2008-10-25 h:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 1200 series272A572217594EBCF1CEE215E352B92AD073FDE4217009125.job
- h:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 00:56]

2009-05-24 h:\windows\Tasks\WGASetup.job
- h:\windows\system32\KB905474\wgasetup.exe [2009-04-29 03:18]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-WinBlueSoft - h:\program files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe
SafeBoot-procexp90.Sys

.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - h:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {3713F92E-2252-4A87-868E-C5F17704D4C6} - hxxp://www.rockyou.com/RockYouImageUploader.cab
DPF: {BCBC9371-9827-11DA-A72B-0800200C9A66} - hxxp://merillat.view22.com/release_3_9_177/View22RTEv4.cab
FF - ProfilePath - h:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tjco591x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?fr=fptb-frz_cb5f
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
FF - component: h:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
FF - component: h:\documents and settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
FF - component: h:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: h:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - component: h:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: h:\program files\Mozilla Firefox\plugins\npbittorrent.dll

—- FIREFOX POLICIES —-
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-23 22:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(792)
h:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(7912)
h:\windows\TEMP\logishrd\LVPrcInj01.dll
h:\windows\system32\WPDShServiceObj.dll
h:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
h:\windows\system32\ati2evxx.exe
h:\windows\system32\ati2evxx.exe
h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
h:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
h:\program files\Java\jre6\bin\jqs.exe
h:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
h:\program files\Common Files\Motive\McciCMService.exe
h:\progra~1\AVG\AVG8\avgam.exe
h:\program files\AVG\AVG8\avgrsx.exe
h:\progra~1\AVG\AVG8\avgnsx.exe
h:\program files\TVersity\Media Server\MediaServer.exe
h:\windows\system32\MsPMSPSv.exe
h:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
h:\program files\AVG\AVG8\avgcsrvx.exe
h:\windows\system32\HPZipm12.exe
h:\program files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
h:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-24 22:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-24 03:35

Pre-Run: 226,872,090,624 bytes free
Post-Run: 228,486,025,216 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

989 — E O F — 2009-05-15 08:03

and here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38:49, on 5/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
H:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
H:\PROGRA~1\AVG\AVG8\avgfws8.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
H:\Program Files\Common Files\Motive\McciCMService.exe
H:\PROGRA~1\AVG\AVG8\avgam.exe
H:\PROGRA~1\AVG\AVG8\avgrsx.exe
H:\PROGRA~1\AVG\AVG8\avgnsx.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\TVersity\Media Server\MediaServer.exe
H:\WINDOWS\system32\MsPMSPSv.exe
H:\PROGRA~1\AVG\AVG8\avgemc.exe
H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
H:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
H:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
H:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
H:\Program Files\AVG\AVG8\avgcsrvx.exe
H:\WINDOWS\system32\HPZipm12.exe
H:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\explorer.exe
H:\WINDOWS\system32\notepad.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - H:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - H:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - H:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [AVG8_TRAY] H:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AVGIDS] "H:\Program Files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe"
O4 - HKLM\..\Run: [Malwarebytes Piracy] "H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /piracy
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - Startup: Adobe Media Player.lnk = H:\Program Files\Adobe Media Player\Adobe Media Player.exe
O4 - Startup: ERUNT AutoBackup.lnk = H:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = H:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {3713F92E-2252-4A87-868E-C5F17704D4C6} (RockYou Image Uploader Control) - http://www.rockyou.com/RockYouImageUploader.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/sit…b?1214197635265
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1214182913484
O16 - DPF: {BCBC9371-9827-11DA-A72B-0800200C9A66} (View22RTEv4 Class) - http://merillat.view22.com/release_3_9_177/View22RTEv4.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - H:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - H:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - H:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - H:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - H:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - H:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: AVGIDSAgent - AVG - H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe
O23 - Service: AVGIDSWatcher - AVG - H:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe
O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - H:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McciCMService - Motive Communications, Inc. - H:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TVersityMediaServer - Unknown owner - H:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: UYTIYQ - Unknown owner - H:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UYTIYQ.exe (file missing)

–
End of file - 8488 bytes

Thanks!

–Nora

CatByte

Post #5May 24, 2009, 9:41 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

File::
h:\docume~1\ADMINI~1\LOCALS~1\Temp\UYTIYQ.exe

Driver::
UYTIYQ

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Download Rooter.exe to your desktop

Doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have installed Windows).
Post that in your next reply.

In your next reply I need:

ComboFix Log
Rooter Log

CatByte

Post #6May 29, 2009, 3:06 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] gaopdxserv.sys - Can't figure out how to remove

✨ Ask AI

Ask AI