[Closed] Java / activex downloads no longer working. Too many pro

Hello Whatthetech. I don't imagine I have a virus or anything too too serious (though I may be completly wrong)
But I haven't been able to download anything from adobe and I see a lot of internet explorer popups flashing on my screen. I try to locate anything mysterious in my processes but there are just so many. Anything I need to delete off this log?
You're all always a big help to me. Thanks.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:29 PM, on 8/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\COGECO Security Services\Anti-Virus\fsgk32st.exe
C:\Program Files\COGECO Security Services\Anti-Virus\FSGK32.EXE
C:\Program Files\COGECO Security Services\Common\FSMA32.EXE
C:\Program Files\COGECO Security Services\Common\FSMB32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\COGECO Security Services\Common\FCH32.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\COGECO Security Services\Common\FAMEH32.EXE
C:\Program Files\COGECO Security Services\Anti-Virus\fsqh.exe
C:\Program Files\COGECO Security Services\FSPC\fspc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\COGECO Security Services\FSAUA\program\fsaua.exe
C:\Program Files\COGECO Security Services\Anti-Virus\fssm32.exe
C:\Program Files\COGECO Security Services\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\COGECO Security Services\FSAUA\program\fsus.exe
C:\Program Files\COGECO Security Services\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\COGECO Security Services\Common\FSM32.EXE
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\Program Files\COGECO Security Services\FSGUI\fsguidll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Wacom\TabUserW.exe
C:\DOCUME~1\TINE~1\LOCALS~1\Temp\AutoDetect.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\ArcSoft\PhotoStudio 5\PhotoStudio.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\.tine\My Documents\Downloads\HJTInstall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec…amp;gc=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec…amp;gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirec…p;gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll (file missing)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [D-Link RangeBooster G WUA-2340] C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\COGECO Security Services\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\COGECO Security Services\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [FileZilla Server Interface] "C:\Program Files\FileZilla Server\FileZilla Server Interface.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [CPMd73e5df3] Rundll32.exe "c:\windows\system32\kewuvihe.dll",a
O4 - HKLM\..\Run: [gmsyo] "c:\windows\system32\gmsyo.exe" gmsyo
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [TopmostClock] C:\Program Files\Topmost Clock\TopMostClock.exe
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\RunOnce: [Ceedo Repair] C:\DOCUME~1\TINE~1\LOCALS~1\Temp\AutoDetect.exe /repair /drive=K /name=Ceedo /id= /params=
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: TimeLeft.lnk = C:\Program Files\TimeLeft3\TimeLeft.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
O8 - Extra context menu item: &Search - http://speedbar.myway.com/menusearch.html?p=MG2
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?990a54a890e445a8b94d7ea83ab706c1
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?990a54a890e445a8b94d7ea83ab706c1
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll
O9 - Extra button: Parental… - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\COGECO Security Services\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\COGECO Security Services\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental… - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\COGECO Security Services\FSPC\fspcmsie.dll
O9 - Extra button: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - C:\Program Files\TimeLeft3\TLIntergIE.html
O9 - Extra 'Tools' menuitem: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - C:\Program Files\TimeLeft3\TLIntergIE.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://fulfillment.puretracks.com/onager.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase2895.cab
O20 - AppInit_DLLs: oaexzi.dll c:\windows\system32\kewuvihe.dll
O21 - SSODL: odSJrO - {D40D6EC1-7EA7-C46B-FBF8-5C52B39CBA32} - C:\WINDOWS\system32\fvu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kewuvihe.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kewuvihe.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\COGECO Security Services\Anti-Virus\fsgk32st.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\COGECO Security Services\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\COGECO Security Services\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\COGECO Security Services\Common\FSMA32.EXE
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 16303 bytes

OK. So my combofix log has been attatched
I see how many Zango files were deleted and I'm shocked because I thought I had already deleted the traces of that program.
My internet browsing has been noticeably sped up.
I've tried using gmail. facebook, and adobe's download system and adobe is the only one still not running smoothly. That maybe end up being a system error though. No signs of pop ups as of yet, and wow Facebook is working 100% and my gmail opens up without using html view so that's great.

So Good so far What the tech.

ComboFix 09-08-10.06 - .tine 08/13/2009 6:33.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447.102 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: COGECO Security Services 7.03 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: COGECO Security Services 7.03 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\.tine\Application Data\WeatherDPA
c:\documents and settings\.tine\Application Data\WeatherDPA\Weather\WeatherStartup.xml
c:\documents and settings\.tine\Application Data\Zango
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\1.sdf
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\3756141.sdf
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\domains.txt
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20570
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26664
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44228
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44229
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\56113
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82292
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\dynamic\ustat\369e.dat
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\btntrans.idx
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\btntrans1.dat
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\buttondir.txt
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\components.cdf
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\cursors.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_1000.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_2000.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_3000.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bar.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bbar1.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_logos.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_other.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\d_icons_weather.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\default.cdf
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_511745-514279.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-ca.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-us.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_categorize.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_comparison.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-Mails.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-people.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_favorites.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_Games.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_Hide.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_hotbarcom.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_Hotmail.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_hsskin.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_jemster.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_jemsterie.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_jemsteruk.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_jobsearch.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_Mails.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_MobileSidewalk.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_new.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_premium.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_reun.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_ringtones.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_SearchBoxTrapper.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_searchfor.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_searchgo.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_weather.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Default_yellowpages.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\editblbuttons.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-548964.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-9595.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\email-t1-bg.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\icons2.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\ie_games_icon.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\ie_video.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\keywords.idx
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\keywords1.dat
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\layout.cdf
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\linkpathlegal.txt
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\progress.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\s_icons_buttons.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\sales_buttons.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\sdfmodifier.xml
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\t2_bg.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\theweb.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\top7.cdf
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\Top7_theweb.mnu
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\tsd_bg.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\zango_btn.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\2\zango_ie_menu.res
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip
c:\documents and settings\.tine\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip
c:\windows\kb913800.exe
c:\windows\system32\a.exe
c:\windows\system32\aakesslg.ini
c:\windows\system32\ahtn.htm
c:\windows\system32\airdthse.ini
c:\windows\system32\bauvtlwy.ini
c:\windows\system32\bhpaeg.dll
c:\windows\system32\breorf.dll
c:\windows\system32\bsalvgsd.dll
c:\windows\system32\busudene.dll
c:\windows\system32\caqvxhto.ini
c:\windows\system32\cbspklbb.ini
c:\windows\system32\cbvdoudy.ini
c:\windows\system32\cfdwcddv.ini
c:\windows\system32\cfwdylxv.ini
c:\windows\system32\dgqgtkog.ini
c:\windows\system32\dsfwdunv.ini
c:\windows\system32\emnutifb.ini
c:\windows\system32\gdpovrtx.ini
c:\windows\system32\glhupsfa.ini
c:\windows\system32\grvjbfpf.ini
c:\windows\system32\gsqveoxc.dll
c:\windows\system32\hbhpfeyl.dll
c:\windows\system32\hiievhdd.ini
c:\windows\system32\icifiekf.ini
c:\windows\system32\itervi.dll
c:\windows\system32\iullbhbu.ini
c:\windows\system32\ixncjrbf.ini
c:\windows\system32\jjllm.bak1
c:\windows\system32\jjllm.bak2
c:\windows\system32\jjllm.ini
c:\windows\system32\jjllm.ini2
c:\windows\system32\jjllm.tmp
c:\windows\system32\jkysiomp.ini
c:\windows\system32\jmukxfbm.ini
c:\windows\system32\jqfuqa.dll
c:\windows\system32\jrpqgmgg.ini
c:\windows\system32\kcegxpvv.ini
c:\windows\system32\kefkikeb.ini
c:\windows\system32\kewuvihe.dll
c:\windows\system32\kqtmbwdg.ini
c:\windows\system32\kteiqmkw.ini
c:\windows\system32\kzwtab.dll
c:\windows\system32\lbxmemjh.ini
c:\windows\system32\ldptfgxw.ini
c:\windows\system32\lmgsfupq.ini
c:\windows\system32\lvqcip.dll
c:\windows\system32\mbwoshvy.dll
c:\windows\system32\mjibsmio.ini
c:\windows\system32\mlerdhjw.ini
c:\windows\system32\mpmbtplh.ini
c:\windows\system32\nembae.dll
c:\windows\system32\nkdghmjf.ini
c:\windows\system32\nmqwwfvw.ini
c:\windows\system32\oadoapci.ini
c:\windows\system32\odqfocuh.ini
c:\windows\system32\ogghcgha.ini
c:\windows\system32\oifiqh.dll
c:\windows\system32\okxtnysp.ini
c:\windows\system32\oqgxhxux.ini
c:\windows\system32\osfbgwog.ini
c:\windows\system32\pgxfmqxi.dll
c:\windows\system32\phhbypcf.ini
c:\windows\system32\pkfypekc.ini
c:\windows\system32\qfkgmmua.ini
c:\windows\system32\qpxdbpbp.ini
c:\windows\system32\rmdtpdco.ini
c:\windows\system32\rpflbimu.ini
c:\windows\system32\ruemtpnf.ini
c:\windows\system32\rwsvicei.ini
c:\windows\system32\skinboxer43.dll
c:\windows\system32\sshmhygs.ini
c:\windows\system32\stmamjtj.dll
c:\windows\system32\suuxirhc.ini
c:\windows\system32\thdsnsve.dll
c:\windows\system32\ttcsvyuk.ini
c:\windows\system32\txpsgnmu.ini
c:\windows\system32\txvtjfgi.ini
c:\windows\system32\uniq.tll
c:\windows\system32\upoiukyk.ini
c:\windows\system32\usjist.dll
c:\windows\system32\vzljqi.dll
c:\windows\system32\warning.gif
c:\windows\system32\win32hlp.cnf
c:\windows\system32\x.exe
c:\windows\system32\xfhgsjnc.ini
c:\windows\system32\xgcbxchy.dll
c:\windows\system32\ygsgpceb.dll
c:\windows\system32\ymibwsne.dll
c:\windows\system32\yuikhloa.ini
c:\windows\system32\zdvtvd.dll
c:\windows\Tasks\zzydizjl.job
K:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DOMAINSERVICE
——-\Legacy_SYSREST.SYS


((((((((((((((((((((((((( Files Created from 2009-07-13 to 2009-08-13 )))))))))))))))))))))))))))))))
.

2009-08-13 05:30 . 2009-08-13 05:30 ——– d—–w- c:\program files\Macromedia
2009-08-11 18:45 . 2009-08-05 16:29 43008 —-a-w- c:\documents and settings\.tine\Application Data\Mozilla\Firefox\Profiles\lm6mj529.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-08-11 18:45 . 2009-08-05 16:29 340480 —-a-w- c:\documents and settings\.tine\Application Data\Mozilla\Firefox\Profiles\lm6mj529.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-08-11 18:45 . 2009-08-05 16:28 346112 —-a-w- c:\documents and settings\.tine\Application Data\Mozilla\Firefox\Profiles\lm6mj529.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-08-10 11:23 . 2009-08-10 11:23 ——– d—–w- c:\program files\AnalogX
2009-08-06 15:23 . 2009-08-06 15:23 152576 —-a-w- c:\documents and settings\.tine\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-06 15:14 . 2009-08-06 15:14 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2 SDK
2009-08-05 02:09 . 2009-08-05 02:09 ——– d—–w- c:\program files\Trend Micro
2009-08-03 02:49 . 2009-08-03 02:49 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-07-28 21:45 . 2009-07-28 21:45 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-07-28 21:45 . 2009-07-28 21:46 ——– d—–w- c:\documents and settings\.tine\Local Settings\Application Data\Temp
2009-07-27 04:33 . 2009-07-27 04:35 1853083 —-a-w- C:\wordpress-2.7.1.zip

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-13 10:50 . 2006-12-25 18:48 320 —-a-w- c:\windows\system32\wacom.dat
2009-08-13 06:12 . 2007-12-02 19:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-13 03:07 . 2008-07-03 00:06 2516 –sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-08-13 03:07 . 2008-07-03 00:06 2516 –sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-08-12 02:44 . 2006-12-27 16:00 ——– d—–w- c:\documents and settings\.tine\Application Data\Canon
2009-08-06 15:10 . 2006-12-27 16:19 ——– d—–w- c:\program files\FreeRIP2
2009-08-06 14:55 . 2008-10-28 02:38 ——– d—–w- c:\documents and settings\.tine\Application Data\proDAD
2009-08-06 14:53 . 2006-08-11 21:04 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-06 14:52 . 2008-11-25 03:44 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2009-08-06 14:51 . 2008-10-28 10:25 ——– d—–w- c:\program files\A123 DVD Clone
2009-07-30 21:06 . 2008-10-09 17:08 ——– d—–w- c:\documents and settings\.tine\Application Data\FileZilla
2009-07-28 21:46 . 2007-09-02 01:29 ——– d—–w- c:\program files\Google
2009-07-14 03:25 . 2007-01-16 01:56 ——– d—–w- c:\program files\Only Astrology
2009-07-12 20:17 . 2007-07-15 01:24 ——– d—–w- c:\program files\Veoh Networks
2009-07-06 22:07 . 2007-06-30 03:58 ——– d—–w- c:\program files\DivX
2009-07-06 22:06 . 2009-07-06 22:06 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-06-28 17:33 . 2006-12-25 16:30 ——– d—–w- c:\documents and settings\.tine\Application Data\foobar2000
2009-06-28 02:47 . 2009-06-28 02:33 ——– d—–w- c:\program files\Acoustica Mixcraft 4
2009-06-27 21:15 . 2009-06-27 21:15 ——– d—–w- c:\program files\Audacity
2009-06-25 01:54 . 2009-06-25 01:53 ——– d—–w- c:\program files\TimeLeft3
2009-06-25 01:53 . 2009-06-25 01:53 ——– d—–w- c:\documents and settings\.tine\Application Data\NesterSoft
2009-06-25 01:44 . 2009-06-25 01:44 ——– d—–w- c:\program files\Topmost Clock
2009-06-12 03:34 . 2009-06-12 03:34 17265 —-a-w- c:\program files\hs_err_pid3836.log
2009-06-12 00:40 . 2009-06-12 00:40 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-06-12 00:38 . 2009-06-12 00:38 152576 —-a-w- c:\documents and settings\.tine\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-11 17:14 . 2009-06-11 17:14 245760 —-a-w- c:\windows\system32\emiosse.exe
2007-02-26 03:05 . 2007-02-26 02:54 17920 -c–a-w- c:\program files\Common Files\stdole2.tlb
2007-02-26 02:53 . 2007-02-26 02:54 151552 -c–a-w- c:\program files\Common Files\scrrun.dll
2007-02-26 02:53 . 2007-02-26 02:54 1227264 -c–a-w- c:\program files\Common Files\dx8vb.dll
2007-02-26 02:53 . 2007-02-26 02:54 11776 -c–a-w- c:\program files\Common Files\smartsubclass.dll
2006-12-26 09:54 . 2006-12-26 09:54 251 —-a-w- c:\program files\wt3d.ini
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-07-14 03:01 . 2007-07-13 07:28 1398634 –sha-w- c:\windows\system32\oqstv.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 3587120]
"TopmostClock"="c:\program files\Topmost Clock\TopMostClock.exe" [2002-09-08 540672]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-05-19 3561720]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 148888]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-19 49152]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"D-Link RangeBooster G WUA-2340"="c:\program files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe" [2005-12-15 2490368]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-11-30 49152]
"Omnipage"="c:\program files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"F-Secure Manager"="c:\program files\COGECO Security Services\Common\FSM32.EXE" [2008-04-23 182936]
"F-Secure TNB"="c:\program files\COGECO Security Services\FSGUI\TNBUtil.exe" [2008-04-23 744032]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-05-21 451896]
"FileZilla Server Interface"="c:\program files\FileZilla Server\FileZilla Server Interface.exe" [2008-07-30 942080]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-01 16208384]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

c:\documents and settings\.tine\Start Menu\Programs\Startup\
TimeLeft.lnk - c:\program files\TimeLeft3\TimeLeft.exe [2009-6-24 1978040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-12-25 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-25 113664]
TabUserW.lnk - c:\program files\Wacom\TabUserW.exe [2006-12-25 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"odSJrO"= {D40D6EC1-7EA7-C46B-FBF8-5C52B39CBA32} - c:\windows\system32\fvu.dll [2007-04-16 32768]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll schannel.dll digest.dll msnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [8/25/2008 8:49 PM 57824]
R1 F-Secure HIPS;F-Secure HIPS;c:\program files\COGECO Security Services\HIPS\fshs.sys [8/25/2008 8:48 PM 47936]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\COGECO Security Services\Anti-Virus\minifilter\fsgk.sys [8/25/2008 8:47 PM 62048]
S1 21116528;21116528;c:\windows\system32\drivers\21116528.sys –> c:\windows\system32\drivers\21116528.sys [?]
S1 60c6d6e8;60c6d6e8;c:\windows\system32\drivers\60c6d6e8.sys –> c:\windows\system32\drivers\60c6d6e8.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/28/2009 5:45 PM 133104]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [7/26/2005 2:32 AM 348352]
S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [7/26/2005 2:35 AM 43392]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\COGECO Security Services\Anti-Virus\win2k\fsfilter.sys [8/25/2008 8:47 PM 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\COGECO Security Services\Anti-Virus\win2k\fsrec.sys [8/25/2008 8:47 PM 25184]
.
Contents of the 'Scheduled Tasks' folder

2009-08-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-02 01:53]

2009-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 21:45]

2009-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 21:45]
.
- - - - ORPHANS REMOVED - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar.dll
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar.dll
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
HKLM-Run-CPMd73e5df3 - c:\windows\system32\kewuvihe.dll


.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13161&gct;=&gc;=1&q;=%s
IE: &Search; - http://speedbar.myway.com/menusearch.html?p=MG2
IE: &Windows; Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?990a54a890e445a8b94d7ea83ab706c1
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?990a54a890e445a8b94d7ea83ab706c1
IE: {{21196042-830F-419f-A594-F9D456A6C29A} - {21196042-830F-419f-A594-F9D456A6C29A} c:\program files\TimeLeft3\TLIntergIE.html - c:\program files\timeleft3\tlintergie.html\inprocserver32 does not exist!
LSP: c:\program files\COGECO Security Services\FSPS\program\FSLSP.DLL
FF - ProfilePath - c:\documents and settings\.tine\Application Data\Mozilla\Firefox\Profiles\lm6mj529.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13161&gct;=&gc;=1&q;=
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll

—- FIREFOX POLICIES —-
pref(dom.disable_open_during_load, true);c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-13 06:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1610437805-2841582524-13902958-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A24ECAC5-62AC-587F-6F4B-7C71BE474653}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"eajgehomfa"=hex:66,61,70,70,64,64,65,64,65,6d,6e,6c,00,31
"damglgfn"=hex:64,62,6e,65,6b,6f,69,61,6c,69,6d,6f,6d,6d,69,6e,62,6c,61,69,64,
6f,61,64,6e,6b,67,6f,62,64,70,68,65,6e,6d,6e,6b,6a,6f,69,00,00
"iabeifejgcplhppnlj"=hex:6a,61,66,64,67,64,64,6b,64,62,6c,62,6d,61,6b,63,6c,6c,
6d,6f,00,00
"hahfkmddobpafbin"=hex:6a,61,66,64,67,64,64,6b,64,62,6c,62,6d,61,6b,63,6c,6c,
6d,6f,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,09,6e,bf,b8,d8,
88,8e,5f,c8,28,51,af,b0,29,a3,98,d5,5d,ba,af,b5,3a,47,f0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,63,06,14,e6,b8,
bf,7b,9d,71,3b,04,66,8b,46,0d,96,1c,56,97,38,6f,10,70,30,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,7a,0d,8c,f2,64,
6d,52,72,25,da,ec,7e,55,20,c9,26,d3,0b,31,93,cd,cb,44,58,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,a5,bf,30,d0,ee,
64,52,96,3e,1e,9e,e0,57,5a,93,61,f7,0e,11,6a,c8,c6,cf,ee,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,42,f5,86,0b,d7,
d9,43,4a,cd,44,cd,b9,a6,33,6c,cd,49,d1,bd,eb,29,be,ea,4a,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,bf,3b,77,5d,7c,
59,7b,31,b0,18,ed,a7,3f,8d,37,a4,7a,20,20,a0,dc,d3,85,40,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,be,2c,8f,d0,d7,
91,02,a0,31,77,e1,ba,b1,f8,68,02,35,e1,92,77,40,2e,07,e7,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,63,db,19,40,45,
71,cc,f0,83,6c,56,8b,a0,85,96,ab,ce,f6,90,f6,08,30,04,30,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,87,0c,e9,fc,b2,
54,db,53,51,fa,6e,91,28,9e,14,cc,ec,ff,a8,b9,7f,e1,7b,a3,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,5f,21,ad,9f,61,
9a,b7,5c,b1,cd,45,5a,a8,c4,f8,b9,f8,38,ea,3d,d5,da,a9,64,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,30,ed,3d,6e,9c,
ac,67,ee,e3,0e,66,d5,eb,bc,2f,6b,2f,94,c7,03,a1,0b,38,88,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,ef,1b,ee,f1,6f,
f2,fd,d3,fa,ea,66,7f,d4,3b,6b,70,11,7c,60,5a,1b,08,03,6c,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(800)
c:\program files\COGECO Security Services\FWES\Program\fsdc.dll

- - - - - - - > 'lsass.exe'(864)
c:\program files\COGECO Security Services\FSPS\program\FSLSP.DLL
c:\program files\COGECO Security Services\FWES\Program\fsdc.dll

- - - - - - - > 'explorer.exe'(6108)
c:\program files\ScanSoft\OmniPageSE\ophook32.dll
c:\windows\system32\tabhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'csrss.exe'(776)
c:\program files\COGECO Security Services\FWES\Program\fsdc.dll
.
———————— Other Running Processes ————————
.
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\COGECO Security Services\Anti-Virus\fsgk32st.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\COGECO Security Services\Anti-Virus\fsgk32.exe
c:\program files\COGECO Security Services\Common\FSMA32.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\COGECO Security Services\FSPC\fspc.exe
c:\windows\system32\Tablet.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files\COGECO Security Services\Anti-Virus\fssm32.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\COGECO Security Services\Common\FSLAUNCH.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\SoftwareDistribution\Download\9261758ae93a5d5afe3cfa673fec12a4\update\update.exe
.
**************************************************************************
.
Completion time: 2009-08-13 7:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-13 11:12

Pre-Run: 38,665,940,992 bytes free
Post-Run: 39,350,988,800 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

586 — E O F — 2009-01-15 08:04

Web browsing is still running smoothly. And I haven't had any pop ups today. Starting up is even taking less time.


Logs

Malwarebytes


Malwarebytes' Anti-Malware 1.40
Database version: 2615
Windows 5.1.2600 Service Pack 2

8/13/2009 11:16:45 AM
mbam-log-2009-08-13 (11-16-45).txt

Scan type: Quick Scan
Objects scanned: 104759
Time elapsed: 9 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhc7coj0er1a (Rogue.AntiVirusXP2008) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dll schannel.dll digest.dll msnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\ssqQhgEv.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.




ESET


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# IEXPLORE.EXE=6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
# OnlineScanner.ocx=1.0.0.6048
# api_version=3.0.2
# EOSSerial=84b4f22ea9100e47b47d4d628d5fb77d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-08-13 05:42:05
# local_time=2009-08-13 01:42:05 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=2305 37 85 73 145342343750
# scanned=109611
# found=101
# cleaned=0
# scan_time=6222
C:\Qoobox\Quarantine\[4]-Submit_2009-08-13_09.39.46.zip multiple threats 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\a.exe.vir a variant of Win32/TrojanDownloader.FakeAlert.KD trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\aakesslg.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ahtn.htm.vir probably a variant of Win32/TrojanDownloader.Agent trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\airdthse.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bauvtlwy.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bhpaeg.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\breorf.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\bsalvgsd.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\busudene.dll.vir a variant of Win32/Adware.SuperJuan.C application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\caqvxhto.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cbspklbb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cbvdoudy.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cfdwcddv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\cfwdylxv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dgqgtkog.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\dsfwdunv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\emnutifb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gdpovrtx.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\glhupsfa.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\grvjbfpf.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\gsqveoxc.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hbhpfeyl.dll.vir a variant of Win32/Adware.Virtumonde.NDK application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\hiievhdd.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\icifiekf.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\itervi.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\iullbhbu.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ixncjrbf.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjllm.bak1.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjllm.bak2.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjllm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjllm.ini2.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jjllm.tmp.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jkysiomp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jmukxfbm.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jqfuqa.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\jrpqgmgg.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kcegxpvv.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kefkikeb.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kewuvihe.dll.vir a variant of Win32/Kryptik.OH trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kqtmbwdg.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kteiqmkw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\kzwtab.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\lbxmemjh.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ldptfgxw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\lmgsfupq.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\lvqcip.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mbwoshvy.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mjibsmio.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mlerdhjw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\mpmbtplh.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nembae.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nkdghmjf.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\nmqwwfvw.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oadoapci.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\odqfocuh.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ogghcgha.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oifiqh.dll.vir a variant of Win32/Adware.Virtumonde.NDK application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\okxtnysp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\oqgxhxux.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\osfbgwog.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pgxfmqxi.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\phhbypcf.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\pkfypekc.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qfkgmmua.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\qpxdbpbp.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rmdtpdco.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rpflbimu.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ruemtpnf.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\rwsvicei.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\sshmhygs.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\stmamjtj.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\suuxirhc.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\thdsnsve.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ttcsvyuk.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\txpsgnmu.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\txvtjfgi.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\upoiukyk.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\usjist.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\vzljqi.dll.vir a variant of Win32/Adware.SuperJuan.C application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\warning.gif.vir Win32/TrojanDownloader.FakeAlert.ACR trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xfhgsjnc.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\xgcbxchy.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ygsgpceb.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\ymibwsne.dll.vir a variant of Win32/Adware.Virtumonde.NEE application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\yuikhloa.ini.vir Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\zdvtvd.dll.vir Win32/Adware.SuperJuan application 00000000000000000000000000000000 I
C:\WINDOWS\explorer.exe Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I
C:\WINDOWS\system32\hgjbufkg.exe probably a variant of Win32/Genetik trojan 00000000000000000000000000000000 I
C:\WINDOWS\system32\lsass.exe Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I
C:\WINDOWS\system32\services.exe Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I
C:\WINDOWS\system32\spoolsv.exe Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I
C:\WINDOWS\system32\svchost.exe Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I
C:\WINDOWS\system32\winlogon.exe Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CL6VS5QN\aasuper2[1].htm Win32/Obfuscated.NCY trojan 00000000000000000000000000000000 I
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OL6BW1UB\warning[1].gif Win32/TrojanDownloader.FakeAlert.ACR trojan 00000000000000000000000000000000 I
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OLQFSHUF\aasuper1[1].htm Win32/TrojanDownloader.FakeAlert.AAT trojan 00000000000000000000000000000000 I
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\W5UFG1IR\aasuper3[1].htm Win32/TrojanDropper.Delf.NKN trojan 00000000000000000000000000000000 I
C:\WINDOWS\system32\drivers\796cc93d.sys a variant of Win32/Rustock.NIH trojan 00000000000000000000000000000000 I
K:\My Documents\My Music\music\CorelDraw X4 inc Keygen\CorelDraw X4 Keygen.exe probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I
${Memory} Win32/TrojanProxy.Agent.NCI virus 00000000000000000000000000000000 I

VirSCAN.org Scanned Report :
Scanned time : 2009/08/13 19:00:45 (CDT)
Scanner results: 92% Scanner(34/37) found malware!
File Name : explorer.exe
File Size : 1035776 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 1b95df83267750ecdac62537cb305132
SHA1 : 46dc0e55b520daa356be1158f33a1ae154c75e1b
Online report : http://virscan.org/report/1acb9da545c70b43…7998053483.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090813160201 2009-08-13 0.42 Trojan.Win32.Patched!IK
AhnLab V3 2009.08.13.04 2009.08.13 2009-08-13 0.81 Win32/Liger
AntiVir 8.2.1.1 7.1.5.110 2009-08-13 0.17 HEUR/Malware
Antiy 2.0.18 20090813.2698352 2009-08-13 0.12 Trojan/Win32.Patched.aa
Arcavir 2009 200908131337 2009-08-13 0.02 W32.Patched.Aa
Authentium 5.1.1 200908131840 2009-08-13 2.17 -
AVAST! 4.7.4 090813-0 2009-08-13 0.05 Win32:Patched-CK [Trj]
AVG 8.5.288 270.13.55/2301 2009-08-14 0.30 Win32/PEPatch.AO
BitDefender 7.81008.3837912 7.27144 2009-08-13 3.37 Trojan.Patched.U
CA (VET) 9.0.0.143 31.6.6676 2009-08-13 8.03 Win32/Donise.H virus.
ClamAV 0.95.2 9694 2009-08-14 0.15 Trojan.Agent-5069
Comodo 3.10 1971 2009-08-13 0.81 TrojWare.Win32.Patched.B
CP Secure 1.1.0.715 2009.08.14 2009-08-14 11.98 Troj.W32.Patched.aa
Dr.Web 4.44.0.9170 2009.08.13 2009-08-13 5.11 Trojan.Starter.384
F-Prot 4.4.4.56 20090813 2009-08-13 1.13 W32/Patched.D.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.08.13.15 2009-08-13 0.16 Trojan.Win32.Patched.aa [AVP]
Fortinet 2.81-3.120 10.713 2009-08-13 0.30 W32/Patched.CX
GData 19.7102/19.437 20090813 2009-08-13 4.82 Trojan.Win32.Patched.aa [Engine:A]
ViRobot 20090813 2009.08.13 2009-08-13 0.41 Win32.Patched.C
Ikarus T3.1.01.64 2009.08.13.73234 2009-08-13 3.79 Trojan.Win32.Patched
JiangMin 11.0.800 2009.08.13 2009-08-13 3.84 Win32/InfectExplorer.c
Kaspersky 5.5.10 2009.08.13 2009-08-13 0.11 Trojan.Win32.Patched.aa
KingSoft 2009.2.5.15 2009.8.13.21 2009-08-13 0.50 Win32.EvalEntry.a.53248
McAfee 5.3.00 5708 2009-08-13 3.03 W32/PEPatcher.c
Microsoft 1.4903 2009.08.12 2009-08-12 5.23 TrojanDownloader:Win32/Donise.C!patched
Norman 6.01.09 6.01.00 2009-08-12 4.01 W32/Patched.A
Panda 9.05.01 2009.08.13 2009-08-13 2.08 W32/PatchLog.gen
Trend Micro 8.700-1004 6.362.02 2009-08-13 0.02 PE_PATCHEP.A
Quick Heal 10.00 2009.08.13 2009-08-13 1.81 Trojan.Patched.AA
Rising 20.0 21.42.34.00 2009-08-13 1.11 Trojan.Win32.Patched.aa
Sophos 2.89.1 4.44 2009-08-14 2.98 W32/Liger-A
Sunbelt 5330 5330 2009-08-13 1.49 -
Symantec 1.3.0.24 20090812.008 2009-08-12 0.10 Trojan.Patchep!inf
nProtect 20090812.02 4997778 2009-08-12 6.76 Virus/W32.Patched.G
The Hacker 6.3.4.3 v00383 2009-08-12 0.74 W32/PEPatcher.gen
VBA32 3.12.10.9 20090813.1326 2009-08-13 1.95 -
VirusBuster 4.5.11.10 10.112.4/1818927 2009-08-13 2.44 Win32.Agent.IMP







VirSCAN.org Scanned Report :
Scanned time : 2009/08/13 19:03:35 (CDT)
Scanner results: 89% Scanner(33/37) found malware!
File Name : lsass.exe
File Size : 14848 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : e5289f7fe6229707dfb162dbc9a2b5b1
SHA1 : 0f2536402c52737a8a90008be2d31a5338156c57
Online report : http://virscan.org/report/2f689c6ea9bb2209…82235adaa0.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090813160201 2009-08-13 0.34 Trojan.Win32.Patched!IK
AhnLab V3 2009.08.13.04 2009.08.13 2009-08-13 0.78 Win32/Liger
AntiVir 8.2.1.1 7.1.5.110 2009-08-13 0.11 TR/Patched.Gen
Antiy 2.0.18 20090813.2698352 2009-08-13 0.12 Trojan/Win32.Patched.aa
Arcavir 2009 200908131337 2009-08-13 0.03 W32.Patched.Aa
Authentium 5.1.1 200908131840 2009-08-13 1.18 -
AVAST! 4.7.4 090813-0 2009-08-13 0.00 Win32:Patched-CK [Trj]
AVG 8.5.288 270.13.55/2301 2009-08-14 0.31 Win32/PEPatch.AO
BitDefender 7.81008.3837912 7.27144 2009-08-13 3.32 Trojan.Patched.U
CA (VET) 9.0.0.143 31.6.6676 2009-08-13 10.42 Win32/Donise.H virus.
ClamAV 0.95.2 9694 2009-08-14 0.01 Trojan.Agent-5069
Comodo 3.10 1971 2009-08-13 0.82 TrojWare.Win32.Patched.B
CP Secure 1.1.0.715 2009.08.14 2009-08-14 12.37 Troj.W32.Patched.aa
Dr.Web 4.44.0.9170 2009.08.13 2009-08-13 5.30 Trojan.Starter.384
F-Prot 4.4.4.56 20090813 2009-08-13 1.20 W32/Patched.D.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.08.13.15 2009-08-13 7.86 Trojan.Win32.Patched.aa [AVP]
Fortinet 2.81-3.120 10.713 2009-08-13 0.19 W32/Patched.CX
GData 19.7102/19.437 20090813 2009-08-13 5.04 Trojan.Win32.Patched.aa [Engine:A]
ViRobot 20090813 2009.08.13 2009-08-13 0.43 Win32.Patched.C
Ikarus T3.1.01.64 2009.08.13.73234 2009-08-13 3.74 Trojan.Win32.Patched
JiangMin 11.0.800 2009.08.13 2009-08-13 5.79 Win32/InfectExplorer.c
Kaspersky 5.5.10 2009.08.13 2009-08-13 0.11 Trojan.Win32.Patched.aa
KingSoft 2009.2.5.15 2009.8.13.21 2009-08-13 0.52 Win32.EvalEntry.a.53248
McAfee 5.3.00 5708 2009-08-13 3.04 W32/PEPatcher.c
Microsoft 1.4903 2009.08.12 2009-08-12 5.31 TrojanDownloader:Win32/Donise.C!patched
Norman 6.01.09 6.01.00 2009-08-12 4.01 W32/Smalltroj.DGHM
Panda 9.05.01 2009.08.13 2009-08-13 2.51 W32/PatchLog.gen
Trend Micro 8.700-1004 6.362.02 2009-08-13 0.02 PE_PATCHEP.A
Quick Heal 10.00 2009.08.13 2009-08-13 1.23 Trojan.Patched.AA
Rising 20.0 21.42.34.00 2009-08-13 1.05 Trojan.Win32.Patched.aa
Sophos 2.89.1 4.44 2009-08-14 3.01 W32/Liger-A
Sunbelt 5330 5330 2009-08-13 1.47 -
Symantec 1.3.0.24 20090812.008 2009-08-12 0.25 -
nProtect 20090812.02 4997778 2009-08-12 8.19 Virus/W32.Patched.G
The Hacker 6.3.4.3 v00383 2009-08-12 0.87 W32/PEPatcher.gen
VBA32 3.12.10.9 20090813.1326 2009-08-13 1.94 -
VirusBuster 4.5.11.10 10.112.4/1818927 2009-08-13 2.25 Win32.Agent.IMP








VirSCAN.org Scanned Report :
Scanned time : 2009/08/13 19:07:00 (CDT)
Scanner results: 89% Scanner(33/37) found malware!
File Name : services.exe
File Size : 110592 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 43e0108fdb3427d1994aebb591a6e61a
SHA1 : a8f7a4cf8423a8506d90984b71de323055097799
Online report : http://virscan.org/report/480cd9fe15376ca6…7b08097387.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090813160201 2009-08-13 0.35 Trojan.Win32.Patched!IK
AhnLab V3 2009.08.13.04 2009.08.13 2009-08-13 0.76 Win32/Liger
AntiVir 8.2.1.1 7.1.5.110 2009-08-13 0.34 TR/Patched.Gen
Antiy 2.0.18 20090813.2698352 2009-08-13 0.12 Trojan/Win32.Patched.aa
Arcavir 2009 200908131337 2009-08-13 0.02 W32.Patched.Aa
Authentium 5.1.1 200908131840 2009-08-13 1.42 -
AVAST! 4.7.4 090813-0 2009-08-13 0.01 Win32:Patched-CK [Trj]
AVG 8.5.288 270.13.55/2301 2009-08-14 0.31 Win32/PEPatch.AO
BitDefender 7.81008.3837912 7.27144 2009-08-13 3.27 Trojan.Patched.U
CA (VET) 9.0.0.143 31.6.6676 2009-08-13 6.14 Win32/Donise.H virus.
ClamAV 0.95.2 9694 2009-08-14 0.01 Trojan.Agent-5069
Comodo 3.10 1971 2009-08-13 0.71 TrojWare.Win32.Patched.B
CP Secure 1.1.0.715 2009.08.14 2009-08-14 11.90 Troj.W32.Patched.cx
Dr.Web 4.44.0.9170 2009.08.13 2009-08-13 5.07 Trojan.Starter.384
F-Prot 4.4.4.56 20090813 2009-08-13 1.16 W32/Patched.D.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.08.13.15 2009-08-13 0.14 Trojan.Win32.Patched.aa [AVP]
Fortinet 2.81-3.120 10.713 2009-08-13 0.19 W32/Patched.CX
GData 19.7102/19.437 20090813 2009-08-13 4.64 Trojan.Win32.Patched.aa [Engine:A]
ViRobot 20090813 2009.08.13 2009-08-13 0.43 Win32.Patched.C
Ikarus T3.1.01.64 2009.08.13.73234 2009-08-13 3.77 Trojan.Win32.Patched
JiangMin 11.0.800 2009.08.13 2009-08-13 3.43 Win32/InfectExplorer.c
Kaspersky 5.5.10 2009.08.13 2009-08-13 0.11 Trojan.Win32.Patched.aa
KingSoft 2009.2.5.15 2009.8.13.21 2009-08-13 0.56 Win32.EvalEntry.a.53248
McAfee 5.3.00 5708 2009-08-13 3.04 W32/PEPatcher.c
Microsoft 1.4903 2009.08.12 2009-08-12 5.27 TrojanDownloader:Win32/Donise.C!patched
Norman 6.01.09 6.01.00 2009-08-12 4.01 W32/Patched.A
Panda 9.05.01 2009.08.13 2009-08-13 1.71 W32/PatchLog.gen
Trend Micro 8.700-1004 6.362.02 2009-08-13 0.02 PE_PATCHEP.A
Quick Heal 10.00 2009.08.13 2009-08-13 1.08 Trojan.Patched.AA
Rising 20.0 21.42.34.00 2009-08-13 0.93 Trojan.Win32.Patched.aa
Sophos 2.89.1 4.44 2009-08-14 3.10 W32/Liger-A
Sunbelt 5330 5330 2009-08-13 1.34 -
Symantec 1.3.0.24 20090812.008 2009-08-12 0.23 -
nProtect 20090812.02 4997778 2009-08-12 5.96 Virus/W32.Patched.G
The Hacker 6.3.4.3 v00383 2009-08-12 0.77 W32/PEPatcher.gen
VBA32 3.12.10.9 20090813.1326 2009-08-13 1.86 -
VirusBuster 4.5.11.10 10.112.4/1818927 2009-08-13 2.25 Win32.Agent.IMP







VirSCAN.org Scanned Report :
Scanned time : 2009/08/13 19:10:58 (CDT)
Scanner results: 89% Scanner(33/37) found malware!
File Name : spoolsv.exe
File Size : 58880 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 22578218a3fc84564a3e09a1662e67ae
SHA1 : 8a617e83c6f0ca5818f5351ac45800ff35b0ad42
Online report : http://virscan.org/report/e7f2cc897af43807…6b974d6393.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090813160201 2009-08-13 0.47 Virus.Win32.SdBot!IK
AhnLab V3 2009.08.13.04 2009.08.13 2009-08-13 0.94 Win32/Liger
AntiVir 8.2.1.1 7.1.5.110 2009-08-13 0.19 HEUR/Malware
Antiy 2.0.18 20090813.2698352 2009-08-13 0.12 Trojan/Win32.Patched.aa
Arcavir 2009 200908131337 2009-08-13 0.02 W32.Patched.Aa
Authentium 5.1.1 200908131840 2009-08-13 1.33 -
AVAST! 4.7.4 090813-0 2009-08-13 0.01 Win32:Patched-CK [Trj]
AVG 8.5.288 270.13.55/2301 2009-08-14 0.35 Win32/PEPatch.AO
BitDefender 7.81008.3837912 7.27144 2009-08-13 3.33 Trojan.Patched.U
CA (VET) 9.0.0.143 31.6.6676 2009-08-13 7.89 Win32/Donise.H virus.
ClamAV 0.95.2 9694 2009-08-14 0.01 Trojan.Agent-5069
Comodo 3.10 1971 2009-08-13 1.78 TrojWare.Win32.Patched.B
CP Secure 1.1.0.715 2009.08.14 2009-08-14 12.08 Troj.W32.Patched.aa
Dr.Web 4.44.0.9170 2009.08.13 2009-08-13 5.09 Trojan.Starter.384
F-Prot 4.4.4.56 20090813 2009-08-13 1.17 W32/Patched.D.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.08.13.15 2009-08-13 0.14 Trojan.Win32.Patched.aa [AVP]
Fortinet 2.81-3.120 10.713 2009-08-13 0.20 W32/Patched.CX
GData 19.7102/19.437 20090813 2009-08-13 7.85 Trojan.Win32.Patched.aa [Engine:A]
ViRobot 20090813 2009.08.13 2009-08-13 0.44 Win32.Patched.C
Ikarus T3.1.01.64 2009.08.13.73234 2009-08-13 3.77 Virus.Win32.SdBot
JiangMin 11.0.800 2009.08.13 2009-08-13 4.13 Win32/InfectExplorer.c
Kaspersky 5.5.10 2009.08.13 2009-08-13 0.11 Trojan.Win32.Patched.aa
KingSoft 2009.2.5.15 2009.8.13.21 2009-08-13 0.47 Win32.EvalEntry.a.53248
McAfee 5.3.00 5708 2009-08-13 3.05 W32/PEPatcher.c
Microsoft 1.4903 2009.08.12 2009-08-12 5.39 TrojanDownloader:Win32/Donise.C!patched
Norman 6.01.09 6.01.00 2009-08-12 4.01 W32/Smalltroj.DECI
Panda 9.05.01 2009.08.13 2009-08-13 1.97 W32/PatchLog.gen
Trend Micro 8.700-1004 6.362.02 2009-08-13 0.02 PE_PATCHEP.A
Quick Heal 10.00 2009.08.13 2009-08-13 1.18 Trojan.Patched.AA
Rising 20.0 21.42.34.00 2009-08-13 1.04 Trojan.Win32.Patched.aa
Sophos 2.89.1 4.44 2009-08-14 3.01 W32/Liger-A
Sunbelt 5330 5330 2009-08-13 1.42 -
Symantec 1.3.0.24 20090812.008 2009-08-12 0.17 -
nProtect 20090812.02 4997778 2009-08-12 5.97 Virus/W32.Patched.G
The Hacker 6.3.4.3 v00383 2009-08-12 0.77 W32/PEPatcher.gen
VBA32 3.12.10.9 20090813.1326 2009-08-13 1.85 -
VirusBuster 4.5.11.10 10.112.4/1818927 2009-08-13 2.24 Win32.Agent.IMP






VirSCAN.org Scanned Report :
Scanned time : 2009/08/13 19:43:56 (CDT)
Scanner results: 92% Scanner(34/37) found malware!
File Name : svchost.exe
File Size : 17408 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 9453837ba414a71c8ce5240726a606b5
SHA1 : 9cd12d67786a16a467dd5ddfca86d51e1028cd32
Online report : http://virscan.org/report/d7be49f2979c7b5a…26dcff2c44.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090813160201 2009-08-13 0.36 Trojan.Win32.Patched!IK
AhnLab V3 2009.08.13.04 2009.08.13 2009-08-13 0.79 Win32/Liger
AntiVir 8.2.1.1 7.1.5.110 2009-08-13 0.53 TR/Patched.Gen
Antiy 2.0.18 20090813.2698352 2009-08-13 0.12 Trojan/Win32.Patched.aa
Arcavir 2009 200908131337 2009-08-13 0.02 W32.Patched.Aa
Authentium 5.1.1 200908131840 2009-08-13 1.20 -
AVAST! 4.7.4 090813-0 2009-08-13 0.00 Win32:Patched-CK [Trj]
AVG 8.5.288 270.13.55/2301 2009-08-14 0.31 Win32/PEPatch.AO
BitDefender 7.81008.3837912 7.27144 2009-08-13 3.59 Trojan.Patched.U
CA (VET) 9.0.0.143 31.6.6676 2009-08-13 7.45 Win32/Donise.H virus.
ClamAV 0.95.2 9694 2009-08-14 0.01 Trojan.Agent-5069
Comodo 3.10 1971 2009-08-13 0.71 TrojWare.Win32.Patched.B
CP Secure 1.1.0.715 2009.08.14 2009-08-14 12.00 Troj.W32.Patched.aa
Dr.Web 4.44.0.9170 2009.08.13 2009-08-13 5.12 Trojan.Starter.384
F-Prot 4.4.4.56 20090813 2009-08-13 1.15 W32/Patched.D.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.08.13.15 2009-08-13 7.91 Trojan.Win32.Patched.aa [AVP]
Fortinet 2.81-3.120 10.713 2009-08-13 0.16 W32/Patched.CX
GData 19.7105/19.438 20090814 2009-08-14 4.80 Trojan.Win32.Patched.aa [Engine:A]
ViRobot 20090813 2009.08.13 2009-08-13 0.41 Win32.Patched.C
Ikarus T3.1.01.64 2009.08.13.73234 2009-08-13 3.73 Trojan.Win32.Patched
JiangMin 11.0.800 2009.08.13 2009-08-13 3.50 Win32/InfectExplorer.c
Kaspersky 5.5.10 2009.08.13 2009-08-13 0.11 Trojan.Win32.Patched.aa
KingSoft 2009.2.5.15 2009.8.13.21 2009-08-13 0.55 Win32.EvalEntry.a.53248
McAfee 5.3.00 5708 2009-08-13 3.03 W32/PEPatcher.c
Microsoft 1.4903 2009.08.12 2009-08-12 5.53 TrojanDownloader:Win32/Donise.C!patched
Norman 6.01.09 6.01.00 2009-08-12 4.01 W32/Smalltroj.CPXE
Panda 9.05.01 2009.08.13 2009-08-13 2.98 W32/Patchlog.D
Trend Micro 8.700-1004 6.362.02 2009-08-13 0.02 PE_PATCHEP.A
Quick Heal 10.00 2009.08.13 2009-08-13 1.15 Trojan.Patched.AA
Rising 20.0 21.42.34.00 2009-08-13 0.96 Trojan.Win32.Patched.aa
Sophos 2.89.1 4.44 2009-08-14 3.02 W32/Liger-A
Sunbelt 5330 5330 2009-08-13 1.35 -
Symantec 1.3.0.24 20090812.008 2009-08-12 0.05 Trojan.Patchep!inf
nProtect 20090812.02 4997778 2009-08-12 7.47 Virus/W32.Patched.G
The Hacker 6.3.4.3 v00383 2009-08-12 0.74 W32/PEPatcher.gen
VBA32 3.12.10.9 20090813.1326 2009-08-13 1.86 -
VirusBuster 4.5.11.10 10.112.4/1818927 2009-08-13 2.23 Win32.Agent.IMP




VirSCAN.org Scanned Report :
Scanned time : 2009/08/13 19:46:33 (CDT)
Scanner results: 95% Scanner(35/37) found malware!
File Name : winlogon.exe
File Size : 506368 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 8f9e2ab17f6d73a66f97317cf4fb1a9c
SHA1 : ca3f13050c3842f02e6803568a864ec6c1277b07
Online report : http://virscan.org/report/9cdbd60c40a1280a…e001a4f983.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090813160201 2009-08-13 0.40 Trojan.Win32.Patched!IK
AhnLab V3 2009.08.13.04 2009.08.13 2009-08-13 0.84 Win32/Liger
AntiVir 8.2.1.1 7.1.5.110 2009-08-13 0.27 TR/Patched.AA.18
Antiy 2.0.18 20090813.2698352 2009-08-13 0.12 Trojan/Win32.Patched.aa
Arcavir 2009 200908131337 2009-08-13 0.02 W32.Patched.Aa
Authentium 5.1.1 200908131840 2009-08-13 2.27 W32/Swizzor-based.2!Maximus (Heuristic)
AVAST! 4.7.4 090813-0 2009-08-13 0.03 Win32:Patched-CK [Trj]
AVG 8.5.288 270.13.55/2301 2009-08-14 0.31 Win32/PEPatch.AO
BitDefender 7.81008.3837912 7.27144 2009-08-13 3.32 Trojan.Patched.U
CA (VET) 9.0.0.143 31.6.6676 2009-08-13 7.63 Win32/Donise.H virus.
ClamAV 0.95.2 9694 2009-08-14 0.08 Trojan.Agent-5069
Comodo 3.10 1971 2009-08-13 0.72 TrojWare.Win32.Patched.B
CP Secure 1.1.0.715 2009.08.14 2009-08-14 11.99 Troj.W32.Patched.aa
Dr.Web 4.44.0.9170 2009.08.13 2009-08-13 5.14 Trojan.Starter.384
F-Prot 4.4.4.56 20090813 2009-08-13 1.17 W32/Patched.D.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2009.08.13.15 2009-08-13 0.17 Trojan.Win32.Patched.aa [AVP]
Fortinet 2.81-3.120 10.713 2009-08-13 0.18 W32/Patched.CX
GData 19.7105/19.438 20090814 2009-08-14 4.63 Trojan.Win32.Patched.aa [Engine:A]
ViRobot 20090813 2009.08.13 2009-08-13 0.41 Win32.Patched.C
Ikarus T3.1.01.64 2009.08.13.73234 2009-08-13 3.79 Trojan.Win32.Patched
JiangMin 11.0.800 2009.08.13 2009-08-13 3.50 Win32/InfectExplorer.c
Kaspersky 5.5.10 2009.08.13 2009-08-13 0.11 Trojan.Win32.Patched.aa
KingSoft 2009.2.5.15 2009.8.13.21 2009-08-13 0.48 Win32.EvalEntry.a.53248
McAfee 5.3.00 5708 2009-08-13 3.06 W32/PEPatcher.c
Microsoft 1.4903 2009.08.12 2009-08-12 5.64 TrojanDownloader:Win32/Donise.C!patched
Norman 6.01.09 6.01.00 2009-08-12 4.01 W32/Patched.A
Panda 9.05.01 2009.08.13 2009-08-13 1.80 W32/PatchLog.gen
Trend Micro 8.700-1004 6.362.02 2009-08-13 0.02 PE_PATCHEP.A
Quick Heal 10.00 2009.08.13 2009-08-13 1.24 Trojan.Patched.AA
Rising 20.0 21.42.34.00 2009-08-13 0.97 Trojan.Win32.Patched.aa
Sophos 2.89.1 4.44 2009-08-14 2.98 W32/Liger-A
Sunbelt 5330 5330 2009-08-13 1.41 -
Symantec 1.3.0.24 20090812.008 2009-08-12 0.06 Trojan.Patchep!inf
nProtect 20090812.02 4997778 2009-08-12 5.94 Virus/W32.Patched.G
The Hacker 6.3.4.3 v00383 2009-08-12 0.74 W32/PEPatcher.gen
VBA32 3.12.10.9 20090813.1326 2009-08-13 2.05 -
VirusBuster 4.5.11.10 10.112.4/1818927 2009-08-13 2.35 Win32.Agent.IMP