What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] trojan- nothing is working right. Please help

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Three hours trying to post this. Keeping it short. Trojan…IE not working right. Tell me what to post and how to do it and lets try to go from there. Thank you
Post #2 last edited
Hi IAmSusie3,

:welcome:



Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–

Double click on Combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.
Post #3
I keep trying to run the combo fix and a whole bunch of stuff is on there, but then my computer will go haywire…either freeze up or my icons all go off the screen and I can't save. Should I try it in safe mode? I'm gonna try again in a few minutes…if it works, I forgot how to post it for you…can you refresh my memory? Thanks
Post #4
Hi IAmSusie3,

If ComboFix does not work go ahead and try running it in safe mode.

To post it just copy/paste the log it gives and post it here by clicking on the Reply Button
Post #5
Ok, I will try again in safe mode…I have been doing it the regular way and safe mode many times today. I disabled all firewalls and Norton Security, but just when combo fix begins to run, a securtiy warning from Norton comes up saying it has halted my computer and then it freezes up. I try to tell it to run just this one time…I think it's the combo-fix trying to open..I don't know. Anyway, then I will try to delete it and it won't let me. Then I do control-alt-delete to pull up the task bar to end process and I don't see it as running. And it usually pops up just as Combo Fix seems to be getting done….It goes through the 50 stages and lists all these address, that all have "zango" listed in them….I know that is a problem I've had before. Anyway, every once in a while, if I keep clicking the Norton thing, I can turn it off, but by then, the computer either freezes or combo-fix disappears and there is nothing to show that it did anything. I have done this twenty times today at least. UGH. My yahoo browser works, but then internet explorer keeps popping up with all these stupid ads. And when I click on the history button, sometimes, it doesn't even show where I've just been….but there are a lot of ads….places I haven't been. IE will flick on and off a few times and sometimes disappear. It is driving me crazy. But I will restart in safe mode and try it again. Wish me luck!
Post #6
FINALLY!!!! I can't believe it….let me know what's next…Thanks

ComboFix 09-07-14.08 - Owner 07/16/2009 23:05.17.1 - NTFSx86 NETWORK
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1296 [VPS 090211-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.

2009-07-17 03:17 . 2009-07-17 04:00 ——– d-s—w- C:\ComboFix
2009-07-16 23:30 . 2009-07-16 23:30 ——– d—–w- c:\windows\LastGood
2009-07-16 16:06 . 2009-07-16 16:07 ——– d—–w- C:\32788R22FWJFW.1.tmp
2009-07-15 19:38 . 2009-07-15 19:38 ——– d—–w- c:\program files\Convar
2009-07-15 19:38 . 1998-06-14 03:53 44544 —-a-w- c:\windows\system32\Gif89.dll
2009-07-15 19:38 . 2003-07-18 18:58 516784 —-a-r- c:\windows\system32\XceedCry.dll
2009-07-15 19:38 . 2002-02-28 14:46 217088 —-a-w- c:\windows\system32\DartSock.dll
2009-07-15 19:38 . 2002-02-21 15:12 118784 —-a-w- c:\windows\system32\DartWeb.dll
2009-07-15 03:23 . 2009-07-15 19:39 ——– d—–w- c:\program files\Stellar Phoenix Photo Recovery
2009-07-14 04:45 . 2009-07-14 04:46 ——– d—–w- C:\32788R22FWJFW.0.tmp
2009-07-13 19:19 . 2009-07-13 19:19 ——– d-s—w- c:\documents and settings\Administrator\UserData
2009-07-13 19:01 . 2009-07-13 14:37 2054424 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-07-13 14:36 . 2009-07-13 14:36 ——– d—–w- c:\program files\AVG
2009-07-13 14:03 . 2009-07-13 14:03 ——– d—–w- c:\documents and settings\Owner\Application Data\AVG8
2009-07-13 13:55 . 2009-07-16 19:45 ——– d-sh–w- c:\windows\system32\SystemX86
2009-07-13 08:12 . 2009-07-13 08:12 ——– d—–w- c:\program files\NortonInstaller
2009-07-13 08:02 . 2009-07-13 08:02 ——– d—–w- c:\program files\iPod
2009-07-13 08:02 . 2009-07-13 08:03 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-13 07:56 . 2009-07-13 07:56 ——– d—–w- c:\program files\Bonjour
2009-07-11 01:41 . 2009-07-11 01:42 ——– d—–w- c:\program files\Holly 2 - Magic Land
2009-07-07 05:51 . 2009-07-07 05:52 ——– d—–w- c:\program files\Jessica's Cupcake Cafe
2009-07-07 04:48 . 2009-07-07 04:48 ——– d—–w- c:\program files\Vibrant Pool

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-16 23:29 . 2006-09-18 16:22 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-07-16 21:54 . 2009-07-13 14:06 108 —-a-w- c:\documents and settings\Owner\udpcrawl.tmp
2009-07-15 19:38 . 2006-09-18 16:20 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-14 00:16 . 2009-02-17 17:20 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-07-13 08:03 . 2006-12-18 05:35 ——– d—–w- c:\program files\iTunes
2009-07-13 08:02 . 2007-09-08 01:32 ——– d—–w- c:\program files\Common Files\Apple
2009-07-13 07:55 . 2006-12-18 05:31 ——– d—–w- c:\program files\QuickTime
2009-07-13 07:15 . 2009-02-13 12:25 ——– d—–w- c:\program files\LimeWire
2009-07-13 06:53 . 2009-02-13 09:42 ——– d—–w- c:\documents and settings\Owner\Application Data\LimeWire
2009-07-13 06:19 . 2006-12-18 05:27 ——– d—–w- c:\program files\Apple Software Update
2009-07-12 23:03 . 2009-04-02 13:36 ——– d—–w- c:\program files\Norton Security Scan
2009-07-11 01:43 . 2007-07-30 05:53 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-06 22:49 . 2007-12-16 04:05 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-06-29 16:56 . 2006-09-20 07:07 66360 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-16 14:01 . 2006-09-20 07:07 13372 —-a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2009-06-09 19:37 . 2009-06-09 19:34 ——– d—–w- c:\program files\The Hardy Boys - The Perfect Crime
2009-06-09 19:34 . 2009-06-09 19:25 95292200 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F5018T1L1\setup_gF5018T1L1_d548968572_l1_s1.exe
2009-06-05 18:57 . 2009-06-05 18:57 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-03 18:00 . 2009-06-03 18:00 ——– d—–w- c:\program files\MSECache
2009-05-31 22:35 . 2008-11-16 06:58 ——– d—–w- c:\documents and settings\Owner\Application Data\Artogon
2009-05-31 18:12 . 2007-12-16 04:05 ——– d—–w- c:\program files\bfgclient
2009-05-25 18:41 . 2009-05-24 20:48 ——– d—–w- c:\documents and settings\Owner\Application Data\RobinsonCrusoe
2009-05-25 05:13 . 2009-05-25 05:13 ——– d—–w- c:\documents and settings\Owner\Application Data\HiT-MM
2009-05-24 18:49 . 2009-03-29 04:42 ——– d—–w- c:\program files\RealArcade
2009-05-24 04:46 . 2009-05-24 04:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Fashion Finder
2009-05-24 01:59 . 2009-05-24 01:57 ——– d—–w- c:\program files\Fashion Finder - Secrets of Fashion NYC Edition
2009-05-24 01:57 . 2009-05-24 01:49 55972904 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F2982T1L1\setup_gF2982T1L1_d532733980_l1_s1.exe
2009-05-24 01:51 . 2009-05-24 01:51 ——– d—–w- c:\documents and settings\Owner\Application Data\BigFishv1002
2009-05-23 05:01 . 2009-05-23 04:57 ——– d—–w- c:\program files\Something Special
2009-05-23 04:08 . 2008-08-15 10:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Slapdash Games
2009-05-23 04:07 . 2009-05-23 04:05 ——– d—–w- c:\program files\Yard Sale Hidden Treasures - Lucky Junction
2009-05-23 04:05 . 2009-05-23 03:58 84633656 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F5032T1L1\setup_gF5032T1L1_d531770133_l1_s1.exe
2009-05-20 00:56 . 2009-05-20 00:56 ——– d—–w- c:\documents and settings\Owner\Application Data\CyberLink
2009-05-20 00:23 . 2009-05-20 00:23 ——– d—–w- c:\documents and settings\Owner\Application Data\Skunk Studios
2009-05-19 22:10 . 2009-05-19 22:10 143864 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\jessicas-cupcake-cafe_s1_l1_gF5027T1L1_d572801037.exe
2009-05-19 22:10 . 2009-05-19 22:10 143864 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\JESSIC~1.exe
2009-05-19 22:10 . 2009-05-19 22:10 143864 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\holly-2_s1_l1_gF5076T1L1_d576341421.exe
2009-05-18 16:42 . 2009-05-18 15:05 ——– d—–w- c:\program files\Registry_Cleaner_Pro
2009-05-18 15:21 . 2008-05-16 04:25 ——– d—–w- c:\program files\Mystery Cookbook
2009-05-18 15:16 . 2009-01-15 04:58 ——– d—–w- c:\program files\House Of Wonders The Kitty Kat Wedding
2009-05-07 15:44 . 2006-03-24 03:16 344064 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:31 . 2006-03-24 03:17 668160 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:31 . 2006-03-24 03:15 81920 —-a-w- c:\windows\system32\ieencode.dll
2008-03-12 15:10 . 2008-03-12 15:10 0 -c–a-w- c:\program files\temp01
2006-12-19 00:21 . 2006-12-19 00:22 774144 -c–a-w- c:\program files\RngInterstitial.dll
2006-11-11 23:06 . 2006-11-11 23:06 1727833 -c–a-w- c:\program files\ChayceAndRoland.JPG
2008-05-29 20:09 . 2008-06-23 05:49 134144 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-16_22.59.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-16 23:09 . 2009-07-16 23:09 24576 c:\windows\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\neodesk\e42ab0fd\2e9ffd2\xwvwadkf.dll
+ 2009-07-16 23:08 . 2009-07-16 23:08 3072 c:\windows\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\neodesk\e42ab0fd\2e9ffd2\wdmwd_8l.dll
+ 2009-07-16 23:09 . 2009-07-16 23:09 4096 c:\windows\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\neodesk\e42ab0fd\2e9ffd2\pbpzemsw.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-01-02 16:06 365960 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-01-02 365960]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-01-02 365960]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Registry_Cleaner_ProMFCT"="c:\progra~1\REGIST~1\Registry_Cleaner_Pro.exe" [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"RealArcade"="c:\program files\Real\RealArcade\RNArcade.exe" [2008-08-10 188416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-03-15 966656]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"LXCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [BU]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-08-27 58488]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ShutterflyStudio"=c:\program files\Shutterfly\Studio\BIN\SFlyStudio.exe /trayonly

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158597562\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\browser\\ybrowser.exe"=
"c:\\Program Files\\MostFun\\Bin\\MostFun.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection; [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-01-02 234888]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-09-08 38528]

.
Contents of the 'Scheduled Tasks' folder

2009-07-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-07-16 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]

2009-07-15 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2004-08-30 18:34]

2009-07-12 c:\windows\Tasks\Norton Security Scan for Owner.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 22:20]

2009-07-15 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-09-18 00:26]
.
- - - - ORPHANS REMOVED - - - -

Notify-__c0023BA4 - c:\windows\system32\__c0023BA4.dat
Notify-a0c41a76638 - (no file)
Notify-__c0092100 - (no file)


.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://yahoo.sbc.com/dial
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to miniMEDIA Video Converter… - c:\program files\Tiger Electronics\miniMEDIA\AMVConverter\grab.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?da9fb24d82bf41f28a3bb81f4fd0ec6f
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?da9fb24d82bf41f28a3bb81f4fd0ec6f
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3zed4fg3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

—- FIREFOX POLICIES —-
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-16 23:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-868124140-14978509-3927912021-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2009-07-17 1:02
ComboFix-quarantined-files.txt 2009-07-17 06:02
ComboFix2.txt 2008-09-28 10:16

Pre-Run: 68,209,696,768 bytes free
Post-Run: 68,198,424,576 bytes free

211 — E O F — 2009-06-13 18:22
Post #7
Hi IAmSusie3,


1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\documents and settings\Owner\udpcrawl.tmp
C:\32788R22FWJFW.1.tmp
C:\32788R22FWJFW.0.tmp

Folder::
c:\program files\AskBarDis

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-

Driver::
ASKUpgrade


Save this as CFScript.txt, in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Post #8
Ok, Here you go….ComboFix 09-07-14.08 - Owner 07/18/2009 23:56.18.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.495.188 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090211-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"C:\32788R22FWJFW.0.tmp"
"C:\32788R22FWJFW.1.tmp"
"c:\documents and settings\Owner\udpcrawl.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\udpcrawl.tmp
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\AskSplash.exe
c:\program files\AskBarDis\bar\bin\AskTBApp.exe
c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\0030B00C
c:\program files\AskBarDis\bar\Cache\00AABA7B
c:\program files\AskBarDis\bar\Cache\0139D0EA
c:\program files\AskBarDis\bar\Cache\0139DC92.bin
c:\program files\AskBarDis\bar\Cache\0139E84A.bin
c:\program files\AskBarDis\bar\Cache\0139FEC0.bin
c:\program files\AskBarDis\bar\Cache\013A0047.bin
c:\program files\AskBarDis\bar\Cache\013A0112.bin
c:\program files\AskBarDis\bar\Cache\013A024A.bin
c:\program files\AskBarDis\bar\Cache\013A0335.bin
c:\program files\AskBarDis\bar\Cache\013A040F.bin
c:\program files\AskBarDis\bar\Cache\013A04DA.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\AskLogo.ico
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\bar\Settings\prevCfg2.htm
c:\program files\AskBarDis\unins00.exe
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASKUPGRADE
——-\Service_ASKUpgrade


((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 )))))))))))))))))))))))))))))))
.

2009-07-17 03:17 . 2009-07-17 04:00 ——– d-s—w- C:\ComboFix
2009-07-16 16:06 . 2009-07-16 16:07 ——– d—–w- C:\32788R22FWJFW.1.tmp
2009-07-15 19:38 . 2009-07-15 19:38 ——– d—–w- c:\program files\Convar
2009-07-15 19:38 . 1998-06-14 03:53 44544 —-a-w- c:\windows\system32\Gif89.dll
2009-07-15 19:38 . 2003-07-18 18:58 516784 —-a-r- c:\windows\system32\XceedCry.dll
2009-07-15 19:38 . 2002-02-28 14:46 217088 —-a-w- c:\windows\system32\DartSock.dll
2009-07-15 19:38 . 2002-02-21 15:12 118784 —-a-w- c:\windows\system32\DartWeb.dll
2009-07-15 03:23 . 2009-07-15 19:39 ——– d—–w- c:\program files\Stellar Phoenix Photo Recovery
2009-07-14 04:45 . 2009-07-14 04:46 ——– d—–w- C:\32788R22FWJFW.0.tmp
2009-07-13 19:19 . 2009-07-13 19:19 ——– d-s—w- c:\documents and settings\Administrator\UserData
2009-07-13 19:01 . 2009-07-13 14:37 2054424 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-07-13 14:36 . 2009-07-13 14:36 ——– d—–w- c:\program files\AVG
2009-07-13 14:03 . 2009-07-13 14:03 ——– d—–w- c:\documents and settings\Owner\Application Data\AVG8
2009-07-13 13:55 . 2009-07-16 19:45 ——– d-sh–w- c:\windows\system32\SystemX86
2009-07-13 08:12 . 2009-07-13 08:12 ——– d—–w- c:\program files\NortonInstaller
2009-07-13 08:02 . 2009-07-13 08:02 ——– d—–w- c:\program files\iPod
2009-07-13 08:02 . 2009-07-13 08:03 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-13 07:56 . 2009-07-13 07:56 ——– d—–w- c:\program files\Bonjour
2009-07-11 01:41 . 2009-07-11 01:42 ——– d—–w- c:\program files\Holly 2 - Magic Land
2009-07-07 05:51 . 2009-07-07 05:52 ——– d—–w- c:\program files\Jessica's Cupcake Cafe
2009-07-07 04:48 . 2009-07-07 04:48 ——– d—–w- c:\program files\Vibrant Pool

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-19 00:03 . 2006-09-18 16:22 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-07-15 19:38 . 2006-09-18 16:20 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-14 00:16 . 2009-02-17 17:20 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-07-13 08:03 . 2006-12-18 05:35 ——– d—–w- c:\program files\iTunes
2009-07-13 08:02 . 2007-09-08 01:32 ——– d—–w- c:\program files\Common Files\Apple
2009-07-13 07:55 . 2006-12-18 05:31 ——– d—–w- c:\program files\QuickTime
2009-07-13 07:15 . 2009-02-13 12:25 ——– d—–w- c:\program files\LimeWire
2009-07-13 06:53 . 2009-02-13 09:42 ——– d—–w- c:\documents and settings\Owner\Application Data\LimeWire
2009-07-13 06:19 . 2006-12-18 05:27 ——– d—–w- c:\program files\Apple Software Update
2009-07-12 23:03 . 2009-04-02 13:36 ——– d—–w- c:\program files\Norton Security Scan
2009-07-11 01:43 . 2007-07-30 05:53 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-06 22:49 . 2007-12-16 04:05 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-06-29 16:56 . 2006-09-20 07:07 66360 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-16 14:55 . 2006-03-24 03:17 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2006-03-24 03:15 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:01 . 2006-09-20 07:07 13372 —-a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2009-06-09 19:37 . 2009-06-09 19:34 ——– d—–w- c:\program files\The Hardy Boys - The Perfect Crime
2009-06-09 19:34 . 2009-06-09 19:25 95292200 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F5018T1L1\setup_gF5018T1L1_d548968572_l1_s1.exe
2009-06-05 18:57 . 2009-06-05 18:57 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-03 19:27 . 2006-03-24 03:17 1290752 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 18:00 . 2009-06-03 18:00 ——– d—–w- c:\program files\MSECache
2009-05-31 22:35 . 2008-11-16 06:58 ——– d—–w- c:\documents and settings\Owner\Application Data\Artogon
2009-05-31 18:12 . 2007-12-16 04:05 ——– d—–w- c:\program files\bfgclient
2009-05-25 18:41 . 2009-05-24 20:48 ——– d—–w- c:\documents and settings\Owner\Application Data\RobinsonCrusoe
2009-05-25 05:13 . 2009-05-25 05:13 ——– d—–w- c:\documents and settings\Owner\Application Data\HiT-MM
2009-05-24 18:49 . 2009-03-29 04:42 ——– d—–w- c:\program files\RealArcade
2009-05-24 04:46 . 2009-05-24 04:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Fashion Finder
2009-05-24 01:59 . 2009-05-24 01:57 ——– d—–w- c:\program files\Fashion Finder - Secrets of Fashion NYC Edition
2009-05-24 01:57 . 2009-05-24 01:49 55972904 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F2982T1L1\setup_gF2982T1L1_d532733980_l1_s1.exe
2009-05-24 01:51 . 2009-05-24 01:51 ——– d—–w- c:\documents and settings\Owner\Application Data\BigFishv1002
2009-05-23 05:01 . 2009-05-23 04:57 ——– d—–w- c:\program files\Something Special
2009-05-23 04:08 . 2008-08-15 10:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Slapdash Games
2009-05-23 04:07 . 2009-05-23 04:05 ——– d—–w- c:\program files\Yard Sale Hidden Treasures - Lucky Junction
2009-05-23 04:05 . 2009-05-23 03:58 84633656 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\GameManager\GameDB\F5032T1L1\setup_gF5032T1L1_d531770133_l1_s1.exe
2009-05-19 22:10 . 2009-05-19 22:10 143864 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\jessicas-cupcake-cafe_s1_l1_gF5027T1L1_d572801037.exe
2009-05-19 22:10 . 2009-05-19 22:10 143864 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\JESSIC~1.exe
2009-05-19 22:10 . 2009-05-19 22:10 143864 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\holly-2_s1_l1_gF5076T1L1_d576341421.exe
2009-05-07 15:44 . 2006-03-24 03:16 344064 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:31 . 2006-03-24 03:17 668160 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:31 . 2006-03-24 03:15 81920 —-a-w- c:\windows\system32\ieencode.dll
2008-03-12 15:10 . 2008-03-12 15:10 0 -c–a-w- c:\program files\temp01
2006-12-19 00:21 . 2006-12-19 00:22 774144 -c–a-w- c:\program files\RngInterstitial.dll
2006-11-11 23:06 . 2006-11-11 23:06 1727833 -c–a-w- c:\program files\ChayceAndRoland.JPG
2008-05-29 20:09 . 2008-06-23 05:49 134144 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-16_22.59.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-16 23:02 . 2009-07-16 23:02 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-19 04:53 . 2009-07-19 04:53 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-19 03:13 . 2009-07-19 03:13 16384 c:\windows\temp\Perflib_Perfdata_a6c.dat
+ 2009-07-19 03:08 . 2009-07-19 03:08 16384 c:\windows\temp\Perflib_Perfdata_2f0.dat
+ 2009-07-19 04:53 . 2009-07-19 04:53 32768 c:\windows\temp\History\History.IE5\index.dat
- 2009-07-16 23:02 . 2009-07-16 23:02 16384 c:\windows\temp\Cookies\index.dat
+ 2009-07-19 04:53 . 2009-07-19 04:53 16384 c:\windows\temp\Cookies\index.dat
+ 2006-12-26 17:30 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
- 2006-12-26 17:30 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll
+ 2006-03-24 03:15 . 2009-06-16 14:55 82432 c:\windows\system32\dllcache\fontsub.dll
+ 2009-07-19 03:14 . 2009-07-19 03:14 24576 c:\windows\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\neodesk\e42ab0fd\2e9ffd2\hvrwa89m.dll
+ 2006-09-18 16:30 . 2009-07-17 19:37 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-09-18 16:30 . 2009-07-17 19:37 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2006-09-18 16:30 . 2009-07-17 19:37 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-09-18 16:30 . 2009-07-17 19:37 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-07-19 03:14 . 2009-07-19 03:14 4096 c:\windows\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\neodesk\e42ab0fd\2e9ffd2\fl07cbud.dll
+ 2009-07-19 03:13 . 2009-07-19 03:13 3072 c:\windows\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\neodesk\e42ab0fd\2e9ffd2\d5gombgs.dll
+ 2006-09-18 16:30 . 2009-07-17 19:37 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2006-03-24 03:17 . 2009-06-16 14:55 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2006-09-18 16:30 . 2009-07-17 19:37 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2006-09-18 16:30 . 2009-07-17 19:37 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2006-09-18 16:30 . 2009-07-17 19:37 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2009-06-12 12:35 . 2009-06-12 12:35 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-06-12 12:35 . 2009-07-17 19:37 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-09-18 16:30 . 2009-07-17 19:37 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2006-09-18 16:30 . 2009-06-12 12:35 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2006-03-24 03:17 . 2009-06-03 19:27 1290752 c:\windows\system32\dllcache\quartz.dll
+ 2009-06-30 16:30 . 2009-06-30 16:30 5520384 c:\windows\Installer\2dedd3f.msp
+ 2006-09-20 15:40 . 2009-07-07 15:10 24539592 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"Registry_Cleaner_ProMFCT"="c:\progra~1\REGIST~1\Registry_Cleaner_Pro.exe" [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"RealArcade"="c:\program files\Real\RealArcade\RNArcade.exe" [2008-08-10 188416]
"SWHelper"="c:\windows\system32\Macromed\Shockwave 10\PostUpdate.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-03-15 966656]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"LXCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [BU]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-08-27 58488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [BU]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Install Pending Files.LNK - c:\program files\SIFXINST\SIFXINST.EXE [2006-9-18 729088]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-2-20 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\a0c41a76638]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c0023BA4]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c0092100]
[BU]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ShutterflyStudio"=c:\program files\Shutterfly\Studio\BIN\SFlyStudio.exe /trayonly

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158597562\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\browser\\ybrowser.exe"=
"c:\\Program Files\\MostFun\\Bin\\MostFun.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/13/2008 11:08 PM 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/13/2008 11:08 PM 20560]
S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys –> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/28/2008 5:57 AM 38528]
.
Contents of the 'Scheduled Tasks' folder

2009-07-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-07-19 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]

2009-07-15 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2004-08-30 18:34]

2009-07-12 c:\windows\Tasks\Norton Security Scan for Owner.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 22:20]

2009-07-15 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-09-18 00:26]
.
- - - - ORPHANS REMOVED - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
Toolbar-{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
WebBrowser-{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)


.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://yahoo.sbc.com/dial
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to miniMEDIA Video Converter… - c:\program files\Tiger Electronics\miniMEDIA\AMVConverter\grab.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?da9fb24d82bf41f28a3bb81f4fd0ec6f
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?da9fb24d82bf41f28a3bb81f4fd0ec6f
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542}
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3zed4fg3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google

—- FIREFOX POLICIES —-
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-19 00:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-868124140-14978509-3927912021-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3504)
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Common Files\aolshare\aolshcpy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Norton Internet Security\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\system32\snmp.exe
c:\program files\Common Files\Symantec Shared\Security Center\SymWSC.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Symantec Shared\Security Center\SymSCUI.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
c:\windows\system32\dumprep.exe
c:\windows\system32\dumprep.exe
c:\program files\Messenger\msmsgs.exe
c:\windows\system32\dwwin.exe
c:\windows\system32\dwwin.exe
.
**************************************************************************
.
Completion time: 2009-07-19 0:28 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-19 05:28
ComboFix2.txt 2009-07-17 06:02
ComboFix3.txt 2008-09-28 10:16

Pre-Run: 67,630,227,456 bytes free
Post-Run: 67,572,625,408 bytes free

320 — E O F — 2009-07-17 19:38
Post #9
Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    o Click Preferences, then click the Statistics/Logs tab.
    o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    o Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
Post #11
OK…here's the malware bytes log. I'm starting the next thing you asked for right now. Malwarebytes' Anti-Malware 1.39 Database version: 2477 Windows 5.1.2600 Service Pack 2 7/22/2009 8:20:02 AM mbam-log-2009-07-22 (08-20-02).txt Scan type: Quick Scan Objects scanned: 109316 Time elapsed: 17 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 32 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0023ba4 (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092100 (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\WINDOWS\system32\SystemX86 (Worm.Archive) -> Quarantined and deleted successfully. Files Infected: c:\WINDOWS\system32\systemx86\213.crack.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\213.crack.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\214.keygen.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\214.keygen.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\215.serial.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\215.serial.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\216.setup.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\216.setup.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\217.music.au (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\217.music.au.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\218.music2.au (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\218.music2.au.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\219.music3.au (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\219.music3.au.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\220.music.snd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\220.music.snd.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\221.crack.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\221.crack.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\222.keygen.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\222.keygen.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\223.serial.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\223.serial.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\224.setup.zip (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\224.setup.zip.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\225.music.au (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\225.music.au.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\226.music2.au (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\226.music2.au.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\227.music3.au (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\227.music3.au.kwd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\228.music.snd (Worm.Archive) -> Quarantined and deleted successfully. c:\WINDOWS\system32\systemx86\228.music.snd.kwd (Worm.Archive) -> Quarantined and deleted successfully.
Post #12
OK…here is the SUPER AntiSpyware thing…

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/22/2009 at 11:12 AM

Application Version : 4.26.1006

Core Rules Database Version : 4010
Trace Rules Database Version: 1950

Scan type : Complete Scan
Total Scan Time : 02:13:40

Memory items scanned : 607
Memory threats detected : 0
Registry items scanned : 7548
Registry threats detected : 1
File items scanned : 123338
File threats detected : 47

Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\[removed][1].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt
C:\Documents and Settings\Owner\Cookies\owner@adcentriconline[2].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt
C:\Documents and Settings\Owner\Cookies\owner@oasn04.247realmedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt
C:\Documents and Settings\Owner\Cookies\[removed]-sys[1].txt
C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[2].txt
C:\Documents and Settings\Owner\Cookies\owner@realmedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt
C:\Documents and Settings\Owner\Cookies\owner@specificclick[3].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt
C:\Documents and Settings\Owner\Cookies\owner@socialmedia[2].txt
C:\Documents and Settings\Owner\Cookies\[removed][1].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt
C:\Documents and Settings\Owner\Cookies\[removed][2].txt
C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt
C:\Documents and Settings\Owner\Cookies\owner@collective-media[1].txt
C:\Documents and Settings\Owner\Cookies\[removed][1].txt
C:\Documents and Settings\Owner\Cookies\owner@insightexpressai[2].txt
C:\Documents and Settings\Owner\Cookies\owner@electronicarts.112.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[1].txt
C:\Documents and Settings\Owner\Cookies\[removed][1].txt
C:\Documents and Settings\Owner\Cookies\[removed][3].txt
C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@specificclick[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@specificmedia[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt
C:\Documents and Settings\Guest\Cookies\[removed][1].txt
C:\Documents and Settings\Guest\Cookies\guest@gateway.122.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\[removed][1].txt
C:\Documents and Settings\Owner\Cookies\[removed][1].txt
C:\Documents and Settings\Owner\Cookies\[removed][4].txt
C:\Documents and Settings\Owner\Cookies\owner@specificclick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\owner@2o7[2].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\[removed][1].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\[removed][2].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\owner@adserver[2].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\owner@media6degrees[1].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\owner@statcounter[1].txt.vir
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt.vir

Adware.ClickSpring/Outer Info Network
HKU\S-1-5-21-868124140-14978509-3927912021-1003\Software\OINAnalytics
Post #13
Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Post #14
ok…here's the LopSD log thing….


——————–\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel® Celeron® CPU 2.93GHz )
BIOS : BIOS Date: 12/15/04 23:53:45 Ver: 08.00.10
USER : Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 090211-0] 4.8.1296 (Not Activated)
Firewall : Norton Internet Security 2005 (Activated)
C:\ (Local Disk) - NTFS - Total:88 Go (Free:61 Go)
D:\ (Local Disk) - FAT32 - Total:4 Go (Free:2 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( Thu 07/23/2009| 8:29 )

——————–\\ Listing folders in APPLIC~1

[04/30/2008|12:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Macromedia
[04/18/2009|02:54] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Malwarebytes
[07/13/2009|09:32] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft
[09/18/2006|11:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\ SampleView
[07/13/2009|02:37] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sun
[04/30/2008|05:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\ SUPERAntiSpyware.com
[04/30/2008|12:26] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Uniblue
[09/18/2006|11:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\ You've Got Pictures Screensaver

[12/17/2008|05:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {55A29068-F2CE-456C-9148-C869879E2357}
[07/13/2009|03:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[02/27/2007|01:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ 55-68-75-p7-62-qr
[07/20/2008|11:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[01/14/2009|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AdventureChronicles1
[12/26/2008|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Alawar Stargaze
[06/10/2008|08:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[09/07/2007|08:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[12/18/2006|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[05/17/2008|11:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Astar Games
[07/13/2009|07:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg8
[07/07/2008|04:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BigFish
[07/06/2009|05:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BigFishGamesCache
[07/17/2008|01:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ blg
[09/19/2006|04:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CyberLink
[06/05/2008|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ EA
[01/05/2009|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ eGames
[11/14/2008|06:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ERS G-Studio
[05/23/2009|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Fashion Finder
[07/05/2008|09:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Fitn17
[10/26/2008|02:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Flood Light Games
[02/22/2009|10:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Fugazo
[07/07/2007|05:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ FunGames
[02/20/2009|07:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GameHouse
[04/21/2008|03:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Gogii
[05/31/2008|02:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Gogii Games
[09/07/2008|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Gold Casual Games
[10/19/2006|12:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[12/11/2006|01:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[04/10/2008|12:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Interama
[06/05/2008|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ iWin
[05/13/2008|12:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kaspersky Lab
[03/22/2009|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[04/01/2008|10:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ludia
[04/28/2008|06:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[04/01/2009|02:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[04/07/2008|01:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MostFun
[12/28/2006|11:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Motive
[01/05/2008|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Mozilla
[10/19/2008|01:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MumboJumbo
[10/04/2008|01:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MysteryChronicles
[08/04/2007|03:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ n7-89-o9-3r-4t-r9
[09/18/2006|11:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Napster
[12/02/2008|01:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NeptunesAdve
[07/22/2009|06:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Norton
[05/10/2009|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NortonInstaller
[07/20/2008|11:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NOS
[06/17/2008|11:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Oberon Games
[12/24/2006|11:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Office Genuine Advantage
[01/28/2009|02:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PlayFirst
[07/07/2008|01:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Playtonium Games
[03/29/2009|12:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PoBros
[09/18/2006|11:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Prism Deploy
[09/18/2006|11:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[12/11/2006|04:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[06/05/2008|07:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Sandlot Games
[05/22/2009|11:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Slapdash Games
[09/06/2006|07:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Sony Corporation
[01/12/2009|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SpecialBit
[07/08/2008|04:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SpinTop Games
[06/07/2008|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SpinTopV1005
[12/13/2008|04:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[04/30/2008|05:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SUPERAntiSpyware.com
[07/22/2009|06:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[07/10/2009|08:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[08/03/2008|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ The Revills Games
[08/04/2008|01:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TheRace_dev
[10/04/2006|09:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Trymedia
[12/17/2008|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TuneUp Software
[06/18/2008|12:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Valusoft
[09/27/2008|04:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[02/13/2009|03:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WildTangent
[09/20/2006|10:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[12/26/2006|05:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Live Toolbar
[01/28/2008|02:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo!
[07/11/2007|02:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion
[05/05/2008|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Zylom

[06/10/2008|08:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ AOL
[09/18/2006|10:57] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[09/18/2006|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[09/18/2006|11:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ SampleView
[09/18/2006|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ You've Got Pictures Screensaver

[08/14/2008|08:51] C:\DOCUME~1\Guest\APPLIC~1\ Adobe
[06/10/2008|08:28] C:\DOCUME~1\Guest\APPLIC~1\ AOL
[09/18/2006|10:57] C:\DOCUME~1\Guest\APPLIC~1\ Identities
[09/26/2006|09:52] C:\DOCUME~1\Guest\APPLIC~1\ Macromedia
[08/14/2008|08:50] C:\DOCUME~1\Guest\APPLIC~1\ mail.com Toolbar
[07/13/2009|07:17] C:\DOCUME~1\Guest\APPLIC~1\ Microsoft
[09/18/2006|11:39] C:\DOCUME~1\Guest\APPLIC~1\ SampleView
[08/14/2008|08:49] C:\DOCUME~1\Guest\APPLIC~1\ Yahoo!
[09/18/2006|11:41] C:\DOCUME~1\Guest\APPLIC~1\ You've Got Pictures Screensaver

[10/11/2007|10:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Google
[11/06/2006|07:02] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Help
[07/15/2009|06:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[10/11/2007|10:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Yahoo!

[07/13/2009|07:17] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
[07/20/2009|05:52] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Symantec

[04/01/2009|05:07] C:\DOCUME~1\Owner\APPLIC~1\ Adobe
[07/11/2008|05:29] C:\DOCUME~1\Owner\APPLIC~1\ AdobeUM
[07/17/2008|01:23] C:\DOCUME~1\Owner\APPLIC~1\ Alawar
[06/10/2008|08:28] C:\DOCUME~1\Owner\APPLIC~1\ AOL
[12/25/2008|01:48] C:\DOCUME~1\Owner\APPLIC~1\ Apple Computer
[05/31/2009|05:35] C:\DOCUME~1\Owner\APPLIC~1\ Artogon
[07/13/2009|09:03] C:\DOCUME~1\Owner\APPLIC~1\ AVG8
[08/25/2008|01:46] C:\DOCUME~1\Owner\APPLIC~1\ BFG_JanesRealty
[09/08/2008|12:14] C:\DOCUME~1\Owner\APPLIC~1\ Big Fish Games
[07/07/2008|04:57] C:\DOCUME~1\Owner\APPLIC~1\ BigFish
[05/23/2009|08:51] C:\DOCUME~1\Owner\APPLIC~1\ BigFishv1002
[07/17/2008|01:35] C:\DOCUME~1\Owner\APPLIC~1\ blg
[01/16/2008|06:07] C:\DOCUME~1\Owner\APPLIC~1\ BloodTies
[04/11/2009|02:40] C:\DOCUME~1\Owner\APPLIC~1\ Boomzap
[11/23/2008|07:06] C:\DOCUME~1\Owner\APPLIC~1\ cerasus.media
[07/20/2008|11:43] C:\DOCUME~1\Owner\APPLIC~1\ com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[02/01/2009|11:32] C:\DOCUME~1\Owner\APPLIC~1\ Coyotes Tale
[05/19/2009|07:56] C:\DOCUME~1\Owner\APPLIC~1\ CyberLink
[12/19/2006|10:13] C:\DOCUME~1\Owner\APPLIC~1\ Digital Album Organizer
[12/21/2006|12:02] C:\DOCUME~1\Owner\APPLIC~1\ DivX
[02/20/2009|12:35] C:\DOCUME~1\Owner\APPLIC~1\ Donut Games
[10/29/2008|01:49] C:\DOCUME~1\Owner\APPLIC~1\ Dragon Altar Games
[06/05/2008|12:24] C:\DOCUME~1\Owner\APPLIC~1\ EA
[01/05/2009|10:20] C:\DOCUME~1\Owner\APPLIC~1\ eGames
[12/30/2007|09:31] C:\DOCUME~1\Owner\APPLIC~1\ Eyeblaster
[01/12/2009|12:20] C:\DOCUME~1\Owner\APPLIC~1\ Fabulous Finds
[10/26/2008|02:27] C:\DOCUME~1\Owner\APPLIC~1\ Flood Light Games
[07/21/2008|01:26] C:\DOCUME~1\Owner\APPLIC~1\ ForgottenRiddles2
[01/23/2009|01:42] C:\DOCUME~1\Owner\APPLIC~1\ Friday's games
[03/29/2009|06:23] C:\DOCUME~1\Owner\APPLIC~1\ Fuel Industries
[09/25/2008|08:42] C:\DOCUME~1\Owner\APPLIC~1\ funkitron
[05/15/2008|11:48] C:\DOCUME~1\Owner\APPLIC~1\ Gaijin Ent
[11/14/2008|06:07] C:\DOCUME~1\Owner\APPLIC~1\ GameHouse
[08/16/2008|01:33] C:\DOCUME~1\Owner\APPLIC~1\ Gamelab
[06/08/2008|12:23] C:\DOCUME~1\Owner\APPLIC~1\ GamesCafe
[07/12/2008|09:34] C:\DOCUME~1\Owner\APPLIC~1\ GARMIN
[08/12/2008|11:37] C:\DOCUME~1\Owner\APPLIC~1\ GetRightToGo
[05/31/2008|02:09] C:\DOCUME~1\Owner\APPLIC~1\ Gogii Games
[08/16/2008|01:02] C:\DOCUME~1\Owner\APPLIC~1\ Go-Go Gourmet Chef of the Year
[09/07/2008|10:22] C:\DOCUME~1\Owner\APPLIC~1\ Gold Casual Games
[11/04/2006|03:43] C:\DOCUME~1\Owner\APPLIC~1\ Google
[09/28/2006|03:29] C:\DOCUME~1\Owner\APPLIC~1\ Help
[05/25/2009|12:13] C:\DOCUME~1\Owner\APPLIC~1\ HiT-MM
[09/29/2008|11:03] C:\DOCUME~1\Owner\APPLIC~1\ Home Sweet Home 2
[09/18/2006|10:57] C:\DOCUME~1\Owner\APPLIC~1\ Identities
[01/14/2009|12:26] C:\DOCUME~1\Owner\APPLIC~1\ IOMediaSupport6SZZ001s
[06/04/2008|10:25] C:\DOCUME~1\Owner\APPLIC~1\ ITTNord
[11/02/2008|01:12] C:\DOCUME~1\Owner\APPLIC~1\ iWin
[05/15/2008|11:43] C:\DOCUME~1\Owner\APPLIC~1\ iWinArcade
[08/16/2008|01:05] C:\DOCUME~1\Owner\APPLIC~1\ Jane s Hotel
[02/28/2009|10:36] C:\DOCUME~1\Owner\APPLIC~1\ Jetsetter
[10/07/2008|11:08] C:\DOCUME~1\Owner\APPLIC~1\ JoyBits
[03/26/2008|01:52] C:\DOCUME~1\Owner\APPLIC~1\ Leadertech
[07/22/2009|08:14] C:\DOCUME~1\Owner\APPLIC~1\ LimeWire
[03/28/2009|04:34] C:\DOCUME~1\Owner\APPLIC~1\ Lost in the City
[04/01/2008|10:18] C:\DOCUME~1\Owner\APPLIC~1\ Ludia
[09/05/2006|10:23] C:\DOCUME~1\Owner\APPLIC~1\ Macromedia
[08/27/2008|11:04] C:\DOCUME~1\Owner\APPLIC~1\ mail.com Toolbar
[04/28/2008|06:01] C:\DOCUME~1\Owner\APPLIC~1\ Malwarebytes
[07/03/2008|04:03] C:\DOCUME~1\Owner\APPLIC~1\ Meridian93
[05/18/2009|10:22] C:\DOCUME~1\Owner\APPLIC~1\ Microsoft
[12/28/2006|11:37] C:\DOCUME~1\Owner\APPLIC~1\ Motive
[02/01/2009|11:35] C:\DOCUME~1\Owner\APPLIC~1\ Mousechief
[06/23/2008|12:50] C:\DOCUME~1\Owner\APPLIC~1\ Mozilla
[09/18/2006|01:28] C:\DOCUME~1\Owner\APPLIC~1\ MSNInstaller
[10/22/2008|08:09] C:\DOCUME~1\Owner\APPLIC~1\ Mushroom Age
[08/02/2007|10:48] C:\DOCUME~1\Owner\APPLIC~1\ My Games
[05/16/2008|12:56] C:\DOCUME~1\Owner\APPLIC~1\ MysteryStudio
[10/23/2007|08:27] C:\DOCUME~1\Owner\APPLIC~1\ NH0UZLLC
[06/17/2008|11:32] C:\DOCUME~1\Owner\APPLIC~1\ Oberon Games
[10/14/2008|02:40] C:\DOCUME~1\Owner\APPLIC~1\ panoramik
[04/07/2008|02:13] C:\DOCUME~1\Owner\APPLIC~1\ Pi Eye Games
[01/28/2009|02:38] C:\DOCUME~1\Owner\APPLIC~1\ PlayFirst
[03/29/2009|12:11] C:\DOCUME~1\Owner\APPLIC~1\ PoBros
[11/21/2008|11:00] C:\DOCUME~1\Owner\APPLIC~1\ Pogo Games
[01/08/2008|12:57] C:\DOCUME~1\Owner\APPLIC~1\ Printer Info Cache
[09/08/2008|12:16] C:\DOCUME~1\Owner\APPLIC~1\ Purple Patch Games
[11/29/2007|03:25] C:\DOCUME~1\Owner\APPLIC~1\ Real
[06/04/2008|11:45] C:\DOCUME~1\Owner\APPLIC~1\ Restorer
[05/25/2009|01:41] C:\DOCUME~1\Owner\APPLIC~1\ RobinsonCrusoe
[04/24/2009|09:54] C:\DOCUME~1\Owner\APPLIC~1\ Roxio
[09/18/2006|11:39] C:\DOCUME~1\Owner\APPLIC~1\ SampleView
[06/05/2008|02:19] C:\DOCUME~1\Owner\APPLIC~1\ SBTT
[10/26/2008|02:32] C:\DOCUME~1\Owner\APPLIC~1\ SecretIslandEng
[12/08/2008|03:44] C:\DOCUME~1\Owner\APPLIC~1\ Shape games
[12/11/2007|12:15] C:\DOCUME~1\Owner\APPLIC~1\ Shutterfly
[05/19/2009|07:23] C:\DOCUME~1\Owner\APPLIC~1\ Skunk Studios
[04/23/2007|03:04] C:\DOCUME~1\Owner\APPLIC~1\ Snapfish
[09/06/2006|07:51] C:\DOCUME~1\Owner\APPLIC~1\ Sony Corporation
[01/14/2009|12:26] C:\DOCUME~1\Owner\APPLIC~1\ Spinapse
[05/15/2008|09:26] C:\DOCUME~1\Owner\APPLIC~1\ SpinTop
[11/23/2008|06:34] C:\DOCUME~1\Owner\APPLIC~1\ SpinTop Games
[06/11/2008|08:44] C:\DOCUME~1\Owner\APPLIC~1\ Sudden Games
[06/02/2008|02:54] C:\DOCUME~1\Owner\APPLIC~1\ SultansLabyrinth
[11/07/2006|11:43] C:\DOCUME~1\Owner\APPLIC~1\ Sun
[07/22/2009|08:45] C:\DOCUME~1\Owner\APPLIC~1\ SUPERAntiSpyware.com
[01/14/2009|12:27] C:\DOCUME~1\Owner\APPLIC~1\ Suspects and Clues Players
[01/14/2009|12:26] C:\DOCUME~1\Owner\APPLIC~1\ Suspects and Clues Prefs
[06/10/2008|09:18] C:\DOCUME~1\Owner\APPLIC~1\ Symantec
[01/05/2008|12:49] C:\DOCUME~1\Owner\APPLIC~1\ Talkback
[12/22/2006|09:46] C:\DOCUME~1\Owner\APPLIC~1\ Template
[08/24/2008|03:22] C:\DOCUME~1\Owner\APPLIC~1\ TMInc
[04/09/2009|05:29] C:\DOCUME~1\Owner\APPLIC~1\ Total Eclipse
[12/17/2008|05:43] C:\DOCUME~1\Owner\APPLIC~1\ TuneUp Software
[04/30/2008|12:35] C:\DOCUME~1\Owner\APPLIC~1\ Uniblue
[06/18/2008|12:10] C:\DOCUME~1\Owner\APPLIC~1\ Valusoft
[12/14/2007|11:24] C:\DOCUME~1\Owner\APPLIC~1\ Viewpoint
[02/02/2009|12:04] C:\DOCUME~1\Owner\APPLIC~1\ ViquaSoft
[01/29/2008|12:19] C:\DOCUME~1\Owner\APPLIC~1\ vlc
[07/14/2007|10:52] C:\DOCUME~1\Owner\APPLIC~1\ Walgreens
[01/08/2008|12:56] C:\DOCUME~1\Owner\APPLIC~1\ Wal-Mart Digital Photo Viewer
[07/11/2007|02:11] C:\DOCUME~1\Owner\APPLIC~1\ Yahoo!
[08/31/2007|05:34] C:\DOCUME~1\Owner\APPLIC~1\ Yahoo! Messenger
[09/18/2006|11:41] C:\DOCUME~1\Owner\APPLIC~1\ You've Got Pictures Screensaver

——————–\\ Scheduled Tasks located in C:\windows\Tasks

[07/22/2009 06:08 PM][–a——] C:\windows\tasks\Norton Security Scan for Owner.job
[07/23/2009 08:25 AM][–a——] C:\windows\tasks\Symantec NetDetect.job
[07/15/2009 06:36 PM][–a——] C:\windows\tasks\Norton AntiVirus - Scan my computer - Owner.job
[07/13/2009 01:19 AM][–a——] C:\windows\tasks\AppleSoftwareUpdate.job
[07/23/2009 08:29 AM][–a——] C:\windows\tasks\Check Updates for Windows Live Toolbar.job
[07/22/2009 04:00 PM][–ah—–] C:\windows\tasks\SA.DAT
[08/04/2004 02:00 PM][-r-h—–] C:\windows\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[03/10/2009|12:22] C:\Program Files\ 2Wire
[07/20/2008|11:39] C:\Program Files\ Adobe
[09/18/2006|11:17] C:\Program Files\ Ahead
[09/07/2008|02:26] C:\Program Files\ Alawar
[10/14/2007|05:53] C:\Program Files\ Alwil Software
[05/09/2008|02:37] C:\Program Files\ America Online 9.0
[05/04/2008|12:59] C:\Program Files\ AOL Games
[07/13/2009|01:19] C:\Program Files\ Apple Software Update
[07/13/2009|09:36] C:\Program Files\ AVG
[12/31/2006|12:48] C:\Program Files\ AWS
[08/19/2007|11:54] C:\Program Files\ Barbie
[04/28/2008|07:20] C:\Program Files\ BFG
[05/31/2009|01:12] C:\Program Files\ bfgclient
[07/02/2007|10:12] C:\Program Files\ BigFix
[07/13/2009|02:56] C:\Program Files\ Bonjour
[03/27/2008|08:24] C:\Program Files\ CardRecovery
[07/22/2009|08:44] C:\Program Files\ Common Files
[07/28/2005|12:38] C:\Program Files\ ComPlus Applications
[09/18/2006|11:09] C:\Program Files\ CONEXANT
[07/15/2009|02:38] C:\Program Files\ Convar
[12/17/2008|05:38] C:\Program Files\ Crawler
[09/18/2006|11:34] C:\Program Files\ CyberLink
[05/09/2008|02:37] C:\Program Files\ Digital Media Reader
[03/26/2008|12:36] C:\Program Files\ Digital Photo Recovery
[10/16/2006|07:40] C:\Program Files\ Disney
[12/21/2006|01:56] C:\Program Files\ DivX
[02/20/2009|12:34] C:\Program Files\ Donut Games
[07/23/2008|10:33] C:\Program Files\ Dream Day First Home
[04/22/2009|11:48] C:\Program Files\ Escape Rosecliff Island
[02/18/2009|11:42] C:\Program Files\ Fenomen Games Downloader
[10/06/2007|11:38] C:\Program Files\ Foto-Mosaik
[12/19/2006|09:19] C:\Program Files\ Fujifilm e-Systems
[02/13/2009|07:13] C:\Program Files\ GameHouse
[04/02/2008|02:21] C:\Program Files\ Games
[12/11/2007|03:12] C:\Program Files\ Google
[10/15/2007|08:32] C:\Program Files\ Grisoft
[05/18/2009|10:16] C:\Program Files\ House Of Wonders The Kitty Kat Wedding
[02/13/2009|03:00] C:\Program Files\ Incomplete
[07/15/2009|02:38] C:\Program Files\ InstallShield Installation Information
[09/18/2006|11:21] C:\Program Files\ Intel
[06/13/2009|01:07] C:\Program Files\ Internet Explorer
[07/13/2009|03:02] C:\Program Files\ iPod
[07/13/2009|03:03] C:\Program Files\ iTunes
[06/10/2008|08:56] C:\Program Files\ Java
[07/07/2009|12:52] C:\Program Files\ Jessica's Cupcake Cafe
[02/04/2008|12:06] C:\Program Files\ Knowledge Adventure
[03/22/2009|11:08] C:\Program Files\ Kodak
[07/22/2009|08:47] C:\Program Files\ LimeWire
[02/20/2009|07:24] C:\Program Files\ Little Shop - Memories
[01/29/2009|10:20] C:\Program Files\ Lx_cats
[11/11/2008|12:27] C:\Program Files\ Mahjong Towers Eternity
[07/22/2009|03:24] C:\Program Files\ Malwarebytes' Anti-Malware
[02/18/2009|11:27] C:\Program Files\ Mattel Interactive
[08/13/2008|03:04] C:\Program Files\ Messenger
[09/18/2006|11:30] C:\Program Files\ Microsoft ActiveSync
[06/16/2007|03:03] C:\Program Files\ Microsoft CAPICOM 2.1.0.2
[09/18/2006|11:36] C:\Program Files\ Microsoft Digital Image 2006
[09/18/2006|10:57] C:\Program Files\ microsoft frontpage
[02/18/2009|11:47] C:\Program Files\ Microsoft LifeCam
[12/08/2008|12:31] C:\Program Files\ Microsoft Money 2005
[06/03/2009|01:01] C:\Program Files\ Microsoft Office
[03/30/2009|10:08] C:\Program Files\ Microsoft Works
[09/18/2006|11:29] C:\Program Files\ Microsoft.NET
[04/09/2008|11:48] C:\Program Files\ MostFun
[09/18/2006|11:03] C:\Program Files\ Movie Maker
[05/13/2009|05:16] C:\Program Files\ Mozilla Firefox
[06/03/2009|01:00] C:\Program Files\ MSECache
[09/18/2006|01:27] C:\Program Files\ MSN
[09/18/2006|11:38] C:\Program Files\ MSN Encarta Plus
[09/18/2006|10:57] C:\Program Files\ MSN Gaming Zone
[11/16/2006|03:36] C:\Program Files\ MSXML 4.0
[02/18/2009|06:35] C:\Program Files\ Mystery Case Files - Huntsville
[05/18/2009|10:21] C:\Program Files\ Mystery Cookbook
[12/29/2006|06:09] C:\Program Files\ MyWebSearchWB
[12/04/2006|11:45] C:\Program Files\ Napster
[09/18/2006|11:03] C:\Program Files\ NetMeeting
[05/09/2008|02:37] C:\Program Files\ Norton Internet Security
[07/22/2009|06:08] C:\Program Files\ Norton Security Scan
[07/22/2009|06:03] C:\Program Files\ NortonInstaller
[07/20/2008|11:27] C:\Program Files\ NOS
[09/18/2006|10:57] C:\Program Files\ Online Services
[07/13/2007|11:45] C:\Program Files\ Outlook Express
[01/17/2008|02:53] C:\Program Files\ Photo Viewer
[09/18/2006|11:40] C:\Program Files\ Pure Networks
[07/13/2009|02:55] C:\Program Files\ QuickTime
[11/29/2007|03:27] C:\Program Files\ Real
[05/24/2009|01:49] C:\Program Files\ RealArcade
[02/04/2007|01:48] C:\Program Files\ ReflexiveArcade
[05/18/2009|11:42] C:\Program Files\ Registry_Cleaner_Pro
[09/18/2006|02:23] C:\Program Files\ SBC Yahoo!
[01/08/2008|01:11] C:\Program Files\ SequoiaMG
[03/30/2009|12:13] C:\Program Files\ Shockwave.com
[08/18/2008|02:49] C:\Program Files\ Shutterfly
[09/18/2006|11:35] C:\Program Files\ SIFXINST
[09/06/2006|07:37] C:\Program Files\ Sony
[12/07/2008|08:44] C:\Program Files\ Spybot - Search & Destroy
[07/15/2009|02:39] C:\Program Files\ Stellar Phoenix Photo Recovery
[07/22/2009|08:46] C:\Program Files\ SUPERAntiSpyware
[09/18/2006|11:25] C:\Program Files\ Symantec
[06/09/2009|02:37] C:\Program Files\ The Hardy Boys - The Perfect Crime
[12/25/2006|02:59] C:\Program Files\ Tiger Electronics
[08/24/2008|03:19] C:\Program Files\ Treasure Masters, Inc
[05/04/2008|04:37] C:\Program Files\ Trend Micro
[04/20/2008|09:30] C:\Program Files\ Tropix
[09/08/2008|12:16] C:\Program Files\ Tropix 2 - The Quest for the Golden Banana
[10/07/2008|12:09] C:\Program Files\ Tropix 2 Quest For The Golden Banana
[10/07/2006|03:55] C:\Program Files\ TryMedia
[01/09/2009|07:42] C:\Program Files\ TuneUp Utilities 2009
[07/28/2005|12:38] C:\Program Files\ Uninstall Information
[07/06/2009|11:48] C:\Program Files\ Vibrant Pool
[01/29/2008|12:12] C:\Program Files\ VideoLAN
[12/21/2006|01:58] C:\Program Files\ Wal-Mart Music Downloads Store
[02/18/2009|11:53] C:\Program Files\ WildGames
[04/01/2009|06:21] C:\Program Files\ Windows Desktop Search
[12/19/2008|08:38] C:\Program Files\ Windows Live Safety Center
[12/11/2007|03:12] C:\Program Files\ Windows Live Toolbar
[12/26/2006|12:27] C:\Program Files\ Windows Media Connect 2
[02/13/2009|10:46] C:\Program Files\ Windows Media Player
[09/18/2006|11:03] C:\Program Files\ Windows NT
[07/28/2005|12:38] C:\Program Files\ WindowsUpdate
[12/19/2006|11:47] C:\Program Files\ Wondershare
[09/18/2006|10:58] C:\Program Files\ xerox
[01/28/2008|02:05] C:\Program Files\ Yahoo!
[05/22/2009|11:07] C:\Program Files\ Yard Sale Hidden Treasures - Lucky Junction
[08/12/2008|11:40] C:\Program Files\ ZEMNOTT

——————–\\ Listing Folders in C:\Program Files\Common Files

[07/11/2008|05:32] C:\Program Files\Common Files\ Adobe
[07/20/2008|11:30] C:\Program Files\Common Files\ Adobe AIR
[09/18/2006|11:16] C:\Program Files\Common Files\ Ahead
[06/10/2008|08:28] C:\Program Files\Common Files\ AOL
[12/11/2007|03:01] C:\Program Files\Common Files\ aolshare
[07/13/2009|03:02] C:\Program Files\Common Files\ Apple
[09/18/2006|11:30] C:\Program Files\Common Files\ DESIGNER
[12/13/2008|10:41] C:\Program Files\Common Files\ Download Manager
[12/11/2006|01:32] C:\Program Files\Common Files\ InstallShield
[06/10/2008|08:55] C:\Program Files\Common Files\ Java
[03/22/2009|11:05] C:\Program Files\Common Files\ Kodak
[06/03/2009|01:01] C:\Program Files\Common Files\ Microsoft Shared
[09/18/2006|10:57] C:\Program Files\Common Files\ MSSoap
[09/18/2006|11:14] C:\Program Files\Common Files\ New Boundary
[09/18/2006|11:40] C:\Program Files\Common Files\ Nullsoft
[09/18/2006|10:57] C:\Program Files\Common Files\ ODBC
[11/29/2007|03:27] C:\Program Files\Common Files\ Real
[09/18/2006|11:37] C:\Program Files\Common Files\ Roxio Shared
[09/18/2006|11:03] C:\Program Files\Common Files\ Services
[09/06/2006|07:35] C:\Program Files\Common Files\ Sony Shared
[09/18/2006|10:57] C:\Program Files\Common Files\ SpeechEngines
[01/05/2009|10:20] C:\Program Files\Common Files\ SWF Studio
[07/23/2009|12:56] C:\Program Files\Common Files\ Symantec Shared
[07/13/2007|11:45] C:\Program Files\Common Files\ System
[07/22/2009|08:44] C:\Program Files\Common Files\ Wise Installation Wizard

——————–\\ Process

( 50 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 08:44:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu.zip
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu\File_ID.Diz
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu\ICU.nfo
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu\Tropix.(GameHouse).Keygen-icu.exe
C:\DOCUME~1\Owner\My Documents\LimeWire\Saved\ice cream paint job including crack TSRh.zip
C:\DOCUME~1\Owner\My Documents\My Videos\Creativity Fun Packs\Sound Effects\sports\Baseball Bat Hit, Crack.wma


[F:102][D:15]-> C:\DOCUME~1\Owner\LOCALS~1\Temp
[F:220][D:0]-> C:\DOCUME~1\Owner\Cookies
[F:14186][D:13]-> C:\DOCUME~1\Owner\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Thu 07/23/2009| 8:54 - Option : [1]

——————–\\ Scan completed at 8:54:33
Post #15
Select the entire area below, then right-click and choose Copy

C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu.zip
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu\File_ID.Diz
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu\ICU.nfo
C:\DOCUME~1\Owner\My Documents\Downloads\tropix.gamehouse.keygen-icu\Tropix.(GameHouse).Keygen-icu.exe
C:\DOCUME~1\Owner\My Documents\LimeWire\Saved\ice cream paint job including crack TSRh.zip
C:\DOCUME~1\Owner\My Documents\My Videos\Creativity Fun Packs\Sound Effects\sports\Baseball Bat Hit, Crack.wma

Restart Lop S&D
Choose Option 4 (LopScript)
A blank page will be opened, right-click it and choose Paste
Close the page, you'll be asked to save it, click [Save]
Don't close the windows during suppression!
Post the log which is created: (%SystemDrive%\lopR.txt)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI