What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Cannot install new .msi version of Hijack This

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am the administrator of this XPPro SP3 platform, and am receiving an error message when trying to run the downloaded latest version of HijackThis. Can you advise me how to delete this policy? I do not know what it is called by Windows. Thanks
Post #2
Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Thanks so much for the rapid response. While waiting, I ran some of the other programs you recommend and voila the .bho's were removed. I am now virus free using several scanners. You guys rock!
Post #4
If you want to run the scans anyway, I can check to make sure everything is gone. What programs did you run and do you have the logs?
Post #6
Hi,

Please do the following:

  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):


R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O15 - Trusted Zone: http://www.cfefcu.com
O15 - Trusted Zone: http://www.limewire.com
O15 - Trusted Zone: http://housecall.trendmicro.com
O15 - Trusted Zone: http://housecall65.trendmicro.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/15d8a7324e7722e65c18/…ip/RdxIE601.cab
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} -

  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.
Post #7
I keep trying to cut and paste the new logfile from HiJack This which I saved subsequent to following your directions. I keep getting a redirect to a page saying to update HiJack This, even though I am using the latest version. I am going to attempt to attach the .txt file to this post. Thanks

Attachments:

Post #8
The HJT log is clean, however, it is not a thorough diagnostic log and doesn't show the presence of any rootkits. Are you experiencing any symptoms? If you want to run DDS and GMER and psot the logs, I can analyze them and make certain you are clean.
Post #9
I have not noticed any new problems since running Kaspersky and Malwarebytes. However, when I rebooted I received a notice saying I was running in selective rather than normal startup mode. I ran MSConfig and changed to normal startup. If I did in fact cause this change, I have no idea how why. Anyway, here are the files you requested in zip format. Thanks again for your help and concern!

Attachments:

  • 📎GMER.zip
  • [attachment removed: DDS.zip]
  • [attachment removed: Attach.zip]
Post #10
There are still signs of infection in the log

Please do the following:


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #11
ComboFix 10-05-16.01 - Dale Kent 05/16/2010 16:06:50.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.767.333 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\020000005cf5cada909C.manifest
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\020000005cf5cada909O.manifest
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\020000005cf5cada909P.manifest
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\020000005cf5cada909S.manifest
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\Mozilla\Firefox\Profiles\7zf6t0s4.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\Mozilla\Firefox\Profiles\7zf6t0s4.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome.manifest
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\Mozilla\Firefox\Profiles\7zf6t0s4.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome\xulcache.jar
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\Mozilla\Firefox\Profiles\7zf6t0s4.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\defaults\preferences\xulcache.js
c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\Mozilla\Firefox\Profiles\7zf6t0s4.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\install.rdf
c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
c:\documents and settings\Dale Kent\Application Data\020000005cf5cada909C.manifest
c:\documents and settings\Dale Kent\Application Data\020000005cf5cada909O.manifest
c:\documents and settings\Dale Kent\Application Data\020000005cf5cada909P.manifest
c:\documents and settings\Dale Kent\Application Data\020000005cf5cada909S.manifest
c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}
c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome.manifest
c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome\xulcache.jar
c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\defaults\preferences\xulcache.js
c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\install.rdf
c:\documents and settings\Incoming\Trans Siberian Orchestra - Joy to the World - Angels We Have .mp3
c:\documents and settings\Incoming\TSO Trans-Siberian Orchestra - Wizards In Winter .mp3
c:\documents and settings\LocalService\Application Data\Mozilla\Firefox\Profiles\y8pq6odw.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}
c:\documents and settings\LocalService\Application Data\Mozilla\Firefox\Profiles\y8pq6odw.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome.manifest
c:\documents and settings\LocalService\Application Data\Mozilla\Firefox\Profiles\y8pq6odw.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome\xulcache.jar
c:\documents and settings\LocalService\Application Data\Mozilla\Firefox\Profiles\y8pq6odw.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\defaults\preferences\xulcache.js
c:\documents and settings\LocalService\Application Data\Mozilla\Firefox\Profiles\y8pq6odw.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\install.rdf
c:\documents and settings\Patricia Kent\Application Data\020000005cf5cada909C.manifest
c:\documents and settings\Patricia Kent\Application Data\020000005cf5cada909O.manifest
c:\documents and settings\Patricia Kent\Application Data\020000005cf5cada909P.manifest
c:\documents and settings\Patricia Kent\Application Data\020000005cf5cada909S.manifest
c:\documents and settings\Patricia Kent\Application Data\Mozilla\Firefox\Profiles\utmx398z.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}
c:\documents and settings\Patricia Kent\Application Data\Mozilla\Firefox\Profiles\utmx398z.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome.manifest
c:\documents and settings\Patricia Kent\Application Data\Mozilla\Firefox\Profiles\utmx398z.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\chrome\xulcache.jar
c:\documents and settings\Patricia Kent\Application Data\Mozilla\Firefox\Profiles\utmx398z.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\defaults\preferences\xulcache.js
c:\documents and settings\Patricia Kent\Application Data\Mozilla\Firefox\Profiles\utmx398z.default\extensions\{9560b691-13fd-4ee9-97e9-35b6f9faf320}\install.rdf
C:\Thumbs.db
c:\winnt\system32\_004331_.tmp.dll
c:\winnt\system32\_004333_.tmp.dll
c:\winnt\system32\_004336_.tmp.dll
c:\winnt\system32\_004338_.tmp.dll
c:\winnt\system32\_004339_.tmp.dll
c:\winnt\system32\_004340_.tmp.dll
c:\winnt\system32\_004341_.tmp.dll
c:\winnt\system32\_004342_.tmp.dll
c:\winnt\system32\_004345_.tmp.dll
c:\winnt\system32\_004347_.tmp.dll
c:\winnt\system32\_004348_.tmp.dll
c:\winnt\system32\_004349_.tmp.dll
c:\winnt\system32\_004353_.tmp.dll
c:\winnt\system32\648033785
c:\winnt\system32\ctl3d3232.dll
c:\winnt\system32\Icons
c:\winnt\system32\Icons\Cartoons\Arlene.ico
c:\winnt\system32\Icons\Cartoons\Babe.ico
c:\winnt\system32\Icons\Cartoons\Booker.ico
c:\winnt\system32\Icons\Cartoons\Buzz Lightyear.ico
c:\winnt\system32\Icons\Cartoons\Candlestick.ico
c:\winnt\system32\Icons\Cartoons\Cool.ico
c:\winnt\system32\Icons\Cartoons\Dad.ico
c:\winnt\system32\Icons\Cartoons\Doc boy.ico
c:\winnt\system32\Icons\Cartoons\Dog.ico
c:\winnt\system32\Icons\Cartoons\Donald duck.ico
c:\winnt\system32\Icons\Cartoons\Fairy.ico
c:\winnt\system32\Icons\Cartoons\Garfield #1.ico
c:\winnt\system32\Icons\Cartoons\Garfield #2.ico
c:\winnt\system32\Icons\Cartoons\Garfield #3.ico
c:\winnt\system32\Icons\Cartoons\Genie.ico
c:\winnt\system32\Icons\Cartoons\Jaffar.ico
c:\winnt\system32\Icons\Cartoons\Jon.ico
c:\winnt\system32\Icons\Cartoons\Lion King.ico
c:\winnt\system32\Icons\Cartoons\Liz.ico
c:\winnt\system32\Icons\Cartoons\Mailman.ico
c:\winnt\system32\Icons\Cartoons\Mickey Mouse.ico
c:\winnt\system32\Icons\Cartoons\Mom.ico
c:\winnt\system32\Icons\Cartoons\Mr Potato head.ico
c:\winnt\system32\Icons\Cartoons\Odie.ico
c:\winnt\system32\Icons\Cartoons\Orson.ico
c:\winnt\system32\Icons\Cartoons\Peanuts.ico
c:\winnt\system32\Icons\Cartoons\Pooky.ico
c:\winnt\system32\Icons\Cartoons\Rafiki.ico
c:\winnt\system32\Icons\Cartoons\Roy.ico
c:\winnt\system32\Icons\Cartoons\Scrooge McDuck.ico
c:\winnt\system32\Icons\Cartoons\Sheldon.ico
c:\winnt\system32\Icons\Cartoons\Simbi.ico
c:\winnt\system32\Icons\Cartoons\Smurf.ico
c:\winnt\system32\Icons\Cartoons\Super Mario.ico
c:\winnt\system32\Icons\Cartoons\Thumbs.db
c:\winnt\system32\Icons\Cartoons\Wade.ico
c:\winnt\system32\Icons\Cartoons\Witch.ico
c:\winnt\system32\Icons\Church\but_j01.gif
c:\winnt\system32\Icons\Church\but_j02.gif
c:\winnt\system32\Icons\Church\christian.zip
c:\winnt\system32\Icons\Church\church1.wmf
c:\winnt\system32\Icons\Church\church10.wmf
c:\winnt\system32\Icons\Church\church11.wmf
c:\winnt\system32\Icons\Church\church12.wmf
c:\winnt\system32\Icons\Church\church13.wmf
c:\winnt\system32\Icons\Church\church2.wmf
c:\winnt\system32\Icons\Church\church3.wmf
c:\winnt\system32\Icons\Church\church4.wmf
c:\winnt\system32\Icons\Church\church5.wmf
c:\winnt\system32\Icons\Church\church6.wmf
c:\winnt\system32\Icons\Church\church7.wmf
c:\winnt\system32\Icons\Church\church8.wmf
c:\winnt\system32\Icons\Church\church9.wmf
c:\winnt\system32\Icons\Church\churches.zip
c:\winnt\system32\Icons\Church\icon_dve.gif
c:\winnt\system32\Icons\Church\icon_go.gif
c:\winnt\system32\Icons\Church\icon_gtl.gif
c:\winnt\system32\Icons\Church\icon_jho.gif
c:\winnt\system32\Icons\Church\icon_nt.gif
c:\winnt\system32\Icons\Church\icon_ot.gif
c:\winnt\system32\Icons\Church\icon_ptl.gif
c:\winnt\system32\Icons\Church\icon_shp.gif
c:\winnt\system32\Icons\Church\jesus01.jpg
c:\winnt\system32\Icons\Church\jesus02.jpg
c:\winnt\system32\Icons\Church\jesus03.jpg
c:\winnt\system32\Icons\Church\jesus04.jpg
c:\winnt\system32\Icons\Church\jesus05.jpg
c:\winnt\system32\Icons\Church\jesus06.jpg
c:\winnt\system32\Icons\Church\jesus07.jpg
c:\winnt\system32\Icons\Church\jesus08.jpg
c:\winnt\system32\Icons\Church\jesus09.jpg
c:\winnt\system32\Icons\Church\jesus10.jpg
c:\winnt\system32\Icons\Church\jesus11.jpg
c:\winnt\system32\Icons\Church\jesus12.jpg
c:\winnt\system32\Icons\Church\jesus13.jpg
c:\winnt\system32\Icons\Church\jesus14.jpg
c:\winnt\system32\Icons\Church\jesus15.jpg
c:\winnt\system32\Icons\Church\jesus16.jpg
c:\winnt\system32\Icons\Church\jesus17.jpg
c:\winnt\system32\Icons\Church\jesus18.jpg
c:\winnt\system32\Icons\Church\jesus19.jpg
c:\winnt\system32\Icons\Church\jesus20.jpg
c:\winnt\system32\Icons\Church\logo1.wmf
c:\winnt\system32\Icons\Church\logo10.wmf
c:\winnt\system32\Icons\Church\logo11.wmf
c:\winnt\system32\Icons\Church\logo12.wmf
c:\winnt\system32\Icons\Church\logo13.wmf
c:\winnt\system32\Icons\Church\logo14.wmf
c:\winnt\system32\Icons\Church\logo15.wmf
c:\winnt\system32\Icons\Church\logo16.wmf
c:\winnt\system32\Icons\Church\logo17.wmf
c:\winnt\system32\Icons\Church\logo18.wmf
c:\winnt\system32\Icons\Church\logo19.wmf
c:\winnt\system32\Icons\Church\logo2.wmf
c:\winnt\system32\Icons\Church\logo20.wmf
c:\winnt\system32\Icons\Church\logo21.wmf
c:\winnt\system32\Icons\Church\logo22.wmf
c:\winnt\system32\Icons\Church\logo23.wmf
c:\winnt\system32\Icons\Church\logo24.wmf
c:\winnt\system32\Icons\Church\logo25.wmf
c:\winnt\system32\Icons\Church\logo26.wmf
c:\winnt\system32\Icons\Church\logo27.wmf
c:\winnt\system32\Icons\Church\logo28.wmf
c:\winnt\system32\Icons\Church\logo29.wmf
c:\winnt\system32\Icons\Church\logo3.wmf
c:\winnt\system32\Icons\Church\logo30.wmf
c:\winnt\system32\Icons\Church\logo31.wmf
c:\winnt\system32\Icons\Church\logo32.wmf
c:\winnt\system32\Icons\Church\logo33.wmf
c:\winnt\system32\Icons\Church\logo34.wmf
c:\winnt\system32\Icons\Church\logo35.wmf
c:\winnt\system32\Icons\Church\logo36.wmf
c:\winnt\system32\Icons\Church\logo37.wmf
c:\winnt\system32\Icons\Church\logo38.wmf
c:\winnt\system32\Icons\Church\logo39.wmf
c:\winnt\system32\Icons\Church\logo4.wmf
c:\winnt\system32\Icons\Church\logo40.wmf
c:\winnt\system32\Icons\Church\logo41.wmf
c:\winnt\system32\Icons\Church\logo42.wmf
c:\winnt\system32\Icons\Church\logo43.wmf
c:\winnt\system32\Icons\Church\logo44.wmf
c:\winnt\system32\Icons\Church\logo45.wmf
c:\winnt\system32\Icons\Church\logo46.wmf
c:\winnt\system32\Icons\Church\logo47.wmf
c:\winnt\system32\Icons\Church\logo48.wmf
c:\winnt\system32\Icons\Church\logo49.wmf
c:\winnt\system32\Icons\Church\logo5.wmf
c:\winnt\system32\Icons\Church\logo50.wmf
c:\winnt\system32\Icons\Church\logo51.wmf
c:\winnt\system32\Icons\Church\logo52.wmf
c:\winnt\system32\Icons\Church\logo53.wmf
c:\winnt\system32\Icons\Church\logo54.wmf
c:\winnt\system32\Icons\Church\logo55.wmf
c:\winnt\system32\Icons\Church\logo56.wmf
c:\winnt\system32\Icons\Church\logo57.wmf
c:\winnt\system32\Icons\Church\logo58.wmf
c:\winnt\system32\Icons\Church\logo59.wmf
c:\winnt\system32\Icons\Church\logo6.wmf
c:\winnt\system32\Icons\Church\logo60.wmf
c:\winnt\system32\Icons\Church\logo61.wmf
c:\winnt\system32\Icons\Church\logo62.wmf
c:\winnt\system32\Icons\Church\logo7.wmf
c:\winnt\system32\Icons\Church\logo8.wmf
c:\winnt\system32\Icons\Church\logo9.wmf
c:\winnt\system32\Icons\Church\logos.zip
c:\winnt\system32\Icons\Church\Thumbs.db
c:\winnt\system32\Icons\Church\wrldcrs3.gif
c:\winnt\system32\Icons\Commercial\3D Realms.ico
c:\winnt\system32\Icons\Commercial\Acura.ico
c:\winnt\system32\Icons\Commercial\Aero Costa Rica.ico
c:\winnt\system32\Icons\Commercial\Aero Lloyd.ico
c:\winnt\system32\Icons\Commercial\Aero Mexico.ico
c:\winnt\system32\Icons\Commercial\AeroRussia.ico
c:\winnt\system32\Icons\Commercial\Agfa.ico
c:\winnt\system32\Icons\Commercial\Air Canada.ico
c:\winnt\system32\Icons\Commercial\Air France.ico
c:\winnt\system32\Icons\Commercial\America Online.ico
c:\winnt\system32\Icons\Commercial\American Express.ico
c:\winnt\system32\Icons\Commercial\Apogee.ico
c:\winnt\system32\Icons\Commercial\Apple.ico
c:\winnt\system32\Icons\Commercial\AT&T.ico;
c:\winnt\system32\Icons\Commercial\BMW.ico
c:\winnt\system32\Icons\Commercial\Burger King.ico
c:\winnt\system32\Icons\Commercial\Chrystler.ico
c:\winnt\system32\Icons\Commercial\CNN International #1.ico
c:\winnt\system32\Icons\Commercial\CNN International #2.ico
c:\winnt\system32\Icons\Commercial\Coca Cola #1.ico
c:\winnt\system32\Icons\Commercial\Coca Cola #2.ico
c:\winnt\system32\Icons\Commercial\Coca Cola #3.ico
c:\winnt\system32\Icons\Commercial\Coca Cola #4.ico
c:\winnt\system32\Icons\Commercial\Dominos Pizza.ico
c:\winnt\system32\Icons\Commercial\Electronic Arts.ico
c:\winnt\system32\Icons\Commercial\EurostarAviation.ico
c:\winnt\system32\Icons\Commercial\FBI.ico
c:\winnt\system32\Icons\Commercial\Ford.ico
c:\winnt\system32\Icons\Commercial\Geosat.ico
c:\winnt\system32\Icons\Commercial\Heineken #1.ico
c:\winnt\system32\Icons\Commercial\Heineken #2.ico
c:\winnt\system32\Icons\Commercial\Hollywood pictures.ico
c:\winnt\system32\Icons\Commercial\Honda.ico
c:\winnt\system32\Icons\Commercial\IBM.ico
c:\winnt\system32\Icons\Commercial\Intel.ico
c:\winnt\system32\Icons\Commercial\Iomega.ico
c:\winnt\system32\Icons\Commercial\Lego.ico
c:\winnt\system32\Icons\Commercial\Logitech.ico
c:\winnt\system32\Icons\Commercial\Lucas Arts.ico
c:\winnt\system32\Icons\Commercial\MasterCard.ico
c:\winnt\system32\Icons\Commercial\McDonalds.ico
c:\winnt\system32\Icons\Commercial\Mercedes Bens.ico
c:\winnt\system32\Icons\Commercial\Microsoft Windows.ico
c:\winnt\system32\Icons\Commercial\Mitsubishi motors.ico
c:\winnt\system32\Icons\Commercial\Mtv.ico
c:\winnt\system32\Icons\Commercial\NBC1.ico
c:\winnt\system32\Icons\Commercial\Origin.ico
c:\winnt\system32\Icons\Commercial\OZ Virtual.ico
c:\winnt\system32\Icons\Commercial\Paramount pictures.ico
c:\winnt\system32\Icons\Commercial\Pepsi #1.ico
c:\winnt\system32\Icons\Commercial\Pepsi #2.ico
c:\winnt\system32\Icons\Commercial\Pepsi #3.ico
c:\winnt\system32\Icons\Commercial\Pizza Hut.ico
c:\winnt\system32\Icons\Commercial\Seagate.ico
c:\winnt\system32\Icons\Commercial\Sierra On-Line.ico
c:\winnt\system32\Icons\Commercial\Thumbs.db
c:\winnt\system32\Icons\Commercial\THX sound system.ico
c:\winnt\system32\Icons\Commercial\Trilobyte.ico
c:\winnt\system32\Icons\Commercial\TV guide.ico
c:\winnt\system32\Icons\Commercial\VISA.ico
c:\winnt\system32\Icons\Commercial\Walt Disney #1.ico
c:\winnt\system32\Icons\Commercial\Walt Disney #2.ico
c:\winnt\system32\Icons\Commercial\Warner Brothers.ico
c:\winnt\system32\Icons\eBay.bmp
c:\winnt\system32\Icons\eBay.jpg
c:\winnt\system32\Icons\eBayLogoTM.bmp
c:\winnt\system32\Icons\flag_ll.bmp
c:\winnt\system32\Icons\Folders\FOmis1.ico
c:\winnt\system32\Icons\Folders\FOmis10.ico
c:\winnt\system32\Icons\Folders\FOmis11.ico
c:\winnt\system32\Icons\Folders\FOmis12.ico
c:\winnt\system32\Icons\Folders\FOmis13.ico
c:\winnt\system32\Icons\Folders\FOmis14.ico
c:\winnt\system32\Icons\Folders\FOmis15.ico
c:\winnt\system32\Icons\Folders\FOmis16.ico
c:\winnt\system32\Icons\Folders\FOmis17.ico
c:\winnt\system32\Icons\Folders\FOmis18.ico
c:\winnt\system32\Icons\Folders\FOmis19.ico
c:\winnt\system32\Icons\Folders\FOmis2.ico
c:\winnt\system32\Icons\Folders\FOmis20.ico
c:\winnt\system32\Icons\Folders\FOmis21.ico
c:\winnt\system32\Icons\Folders\FOmis22.ico
c:\winnt\system32\Icons\Folders\FOmis23.ico
c:\winnt\system32\Icons\Folders\FOmis24.ico
c:\winnt\system32\Icons\Folders\FOmis25.ico
c:\winnt\system32\Icons\Folders\FOmis26.ico
c:\winnt\system32\Icons\Folders\FOmis27.ico
c:\winnt\system32\Icons\Folders\FOmis28.ico
c:\winnt\system32\Icons\Folders\FOmis29.ico
c:\winnt\system32\Icons\Folders\FOmis3.ico
c:\winnt\system32\Icons\Folders\FOmis30.ico
c:\winnt\system32\Icons\Folders\FOmis31.ico
c:\winnt\system32\Icons\Folders\FOmis32.ico
c:\winnt\system32\Icons\Folders\FOmis33.ico
c:\winnt\system32\Icons\Folders\FOmis34.ico
c:\winnt\system32\Icons\Folders\FOmis35.ico
c:\winnt\system32\Icons\Folders\FOmis36.ico
c:\winnt\system32\Icons\Folders\FOmis37.ico
c:\winnt\system32\Icons\Folders\FOmis38.ico
c:\winnt\system32\Icons\Folders\FOmis39.ico
c:\winnt\system32\Icons\Folders\FOmis4.ico
c:\winnt\system32\Icons\Folders\FOmis40.ico
c:\winnt\system32\Icons\Folders\FOmis41.ico
c:\winnt\system32\Icons\Folders\FOmis42.ico
c:\winnt\system32\Icons\Folders\FOmis43.ico
c:\winnt\system32\Icons\Folders\FOmis44.ico
c:\winnt\system32\Icons\Folders\FOmis45.ico
c:\winnt\system32\Icons\Folders\FOmis46.ico
c:\winnt\system32\Icons\Folders\FOmis47.ico
c:\winnt\system32\Icons\Folders\FOmis48.ico
c:\winnt\system32\Icons\Folders\FOmis49.ico
c:\winnt\system32\Icons\Folders\FOmis5.ico
c:\winnt\system32\Icons\Folders\FOmis50.ico
c:\winnt\system32\Icons\Folders\FOmis51.ico
c:\winnt\system32\Icons\Folders\FOmis52.ico
c:\winnt\system32\Icons\Folders\FOmis53.ico
c:\winnt\system32\Icons\Folders\FOmis54.ico
c:\winnt\system32\Icons\Folders\FOmis55.ico
c:\winnt\system32\Icons\Folders\FOmis56.ico
c:\winnt\system32\Icons\Folders\FOmis57.ico
c:\winnt\system32\Icons\Folders\FOmis58.ico
c:\winnt\system32\Icons\Folders\FOmis59.ico
c:\winnt\system32\Icons\Folders\FOmis6.ico
c:\winnt\system32\Icons\Folders\FOmis60.ico
c:\winnt\system32\Icons\Folders\FOmis61.ico
c:\winnt\system32\Icons\Folders\FOmis62.ico
c:\winnt\system32\Icons\Folders\FOmis63.ico
c:\winnt\system32\Icons\Folders\FOmis64.ico
c:\winnt\system32\Icons\Folders\FOmis65.ico
c:\winnt\system32\Icons\Folders\FOmis66.ico
c:\winnt\system32\Icons\Folders\FOmis67.ico
c:\winnt\system32\Icons\Folders\FOmis68.ico
c:\winnt\system32\Icons\Folders\FOmis69.ico
c:\winnt\system32\Icons\Folders\FOmis7.ico
c:\winnt\system32\Icons\Folders\FOmis70.ico
c:\winnt\system32\Icons\Folders\FOmis71.ico
c:\winnt\system32\Icons\Folders\FOmis72.ico
c:\winnt\system32\Icons\Folders\FOmis73.ico
c:\winnt\system32\Icons\Folders\FOmis74.ico
c:\winnt\system32\Icons\Folders\FOmis75.ico
c:\winnt\system32\Icons\Folders\FOmis76.ico
c:\winnt\system32\Icons\Folders\FOmis77.ico
c:\winnt\system32\Icons\Folders\FOmis78.ico
c:\winnt\system32\Icons\Folders\FOmis79.ico
c:\winnt\system32\Icons\Folders\FOmis8.ico
c:\winnt\system32\Icons\Folders\FOmis80.ico
c:\winnt\system32\Icons\Folders\FOmis81.ico
c:\winnt\system32\Icons\Folders\FOmis82.ico
c:\winnt\system32\Icons\Folders\FOmis83.ico
c:\winnt\system32\Icons\Folders\FOmis84.ico
c:\winnt\system32\Icons\Folders\FOmis85.ico
c:\winnt\system32\Icons\Folders\FOmis86.ico
c:\winnt\system32\Icons\Folders\FOmis87.ico
c:\winnt\system32\Icons\Folders\FOmis88.ico
c:\winnt\system32\Icons\Folders\FOmis89.ico
c:\winnt\system32\Icons\Folders\FOmis9.ico
c:\winnt\system32\Icons\Folders\FOmis90.ico
c:\winnt\system32\Icons\Folders\FOmis91.ico
c:\winnt\system32\Icons\Folders\FOmis92.ico
c:\winnt\system32\Icons\Folders\FOmis93.ico
c:\winnt\system32\Icons\Folders\FOmis94.ico
c:\winnt\system32\Icons\Folders\FOmis95.ico
c:\winnt\system32\Icons\Folders\FOmis96.ico
c:\winnt\system32\Icons\Folders\FOmis97.ico
c:\winnt\system32\Icons\Folders\Thumbs.db
c:\winnt\system32\Icons\FOmis_ico.zip
c:\winnt\system32\Icons\FOmis1.ico
c:\winnt\system32\Icons\FOmis10.ico
c:\winnt\system32\Icons\FOmis11.ico
c:\winnt\system32\Icons\FOmis12.ico
c:\winnt\system32\Icons\FOmis13.ico
c:\winnt\system32\Icons\FOmis14.ico
c:\winnt\system32\Icons\FOmis15.ico
c:\winnt\system32\Icons\FOmis16.ico
c:\winnt\system32\Icons\FOmis17.ico
c:\winnt\system32\Icons\FOmis18.ico
c:\winnt\system32\Icons\FOmis19.ico
c:\winnt\system32\Icons\FOmis2.ico
c:\winnt\system32\Icons\FOmis20.ico
c:\winnt\system32\Icons\FOmis21.ico
c:\winnt\system32\Icons\FOmis22.ico
c:\winnt\system32\Icons\FOmis23.ico
c:\winnt\system32\Icons\FOmis24.ico
c:\winnt\system32\Icons\FOmis25.ico
c:\winnt\system32\Icons\FOmis26.ico
c:\winnt\system32\Icons\FOmis27.ico
c:\winnt\system32\Icons\FOmis28.ico
c:\winnt\system32\Icons\FOmis29.ico
c:\winnt\system32\Icons\FOmis3.ico
c:\winnt\system32\Icons\FOmis30.ico
c:\winnt\system32\Icons\FOmis31.ico
c:\winnt\system32\Icons\FOmis32.ico
c:\winnt\system32\Icons\FOmis33.ico
c:\winnt\system32\Icons\FOmis34.ico
c:\winnt\system32\Icons\FOmis35.ico
c:\winnt\system32\Icons\FOmis36.ico
c:\winnt\system32\Icons\FOmis37.ico
c:\winnt\system32\Icons\FOmis38.ico
c:\winnt\system32\Icons\FOmis39.ico
c:\winnt\system32\Icons\FOmis4.ico
c:\winnt\system32\Icons\FOmis40.ico
c:\winnt\system32\Icons\FOmis41.ico
c:\winnt\system32\Icons\FOmis42.ico
c:\winnt\system32\Icons\FOmis43.ico
c:\winnt\system32\Icons\FOmis44.ico
c:\winnt\system32\Icons\FOmis45.ico
c:\winnt\system32\Icons\FOmis46.ico
c:\winnt\system32\Icons\FOmis47.ico
c:\winnt\system32\Icons\FOmis48.ico
c:\winnt\system32\Icons\FOmis49.ico
c:\winnt\system32\Icons\FOmis5.ico
c:\winnt\system32\Icons\FOmis50.ico
c:\winnt\system32\Icons\FOmis51.ico
c:\winnt\system32\Icons\FOmis52.ico
c:\winnt\system32\Icons\FOmis53.ico
c:\winnt\system32\Icons\FOmis54.ico
c:\winnt\system32\Icons\FOmis55.ico
c:\winnt\system32\Icons\FOmis56.ico
c:\winnt\system32\Icons\FOmis57.ico
c:\winnt\system32\Icons\FOmis58.ico
c:\winnt\system32\Icons\FOmis59.ico
c:\winnt\system32\Icons\FOmis6.ico
c:\winnt\system32\Icons\FOmis60.ico
c:\winnt\system32\Icons\FOmis61.ico
c:\winnt\system32\Icons\FOmis62.ico
c:\winnt\system32\Icons\FOmis63.ico
c:\winnt\system32\Icons\FOmis64.ico
c:\winnt\system32\Icons\FOmis65.ico
c:\winnt\system32\Icons\FOmis66.ico
c:\winnt\system32\Icons\FOmis67.ico
c:\winnt\system32\Icons\FOmis68.ico
c:\winnt\system32\Icons\FOmis69.ico
c:\winnt\system32\Icons\FOmis7.ico
c:\winnt\system32\Icons\FOmis70.ico
c:\winnt\system32\Icons\FOmis71.ico
c:\winnt\system32\Icons\FOmis92.ico
c:\winnt\system32\Icons\FOmis93.ico
c:\winnt\system32\Icons\FOmis94.ico
c:\winnt\system32\Icons\FOmis95.ico
c:\winnt\system32\Icons\FOmis96.ico
c:\winnt\system32\Icons\FOmis97.ico
c:\winnt\system32\Icons\google.gif
c:\winnt\system32\Icons\I Hate Computers.jpg
c:\winnt\system32\Icons\Icelandic\Air Atlanta.ico
c:\winnt\system32\Icons\Icelandic\Blomaval.ico
c:\winnt\system32\Icons\Icelandic\Bunadarbankinn.ico
c:\winnt\system32\Icons\Icelandic\Eymundson.ico
c:\winnt\system32\Icons\Icelandic\Flugleidir.ico
c:\winnt\system32\Icons\Icelandic\Glitnir.ico
c:\winnt\system32\Icons\Icelandic\Gula Linan.ico
c:\winnt\system32\Icons\Icelandic\Hanz.ico
c:\winnt\system32\Icons\Icelandic\Heimilistaeki.ico
c:\winnt\system32\Icons\Icelandic\Hotel Saga.ico
c:\winnt\system32\Icons\Icelandic\Husasmidjan.ico
c:\winnt\system32\Icons\Icelandic\Iceland #1.ico
c:\winnt\system32\Icons\Icelandic\Iceland #2.ico
c:\winnt\system32\Icons\Icelandic\Iceland #3.ico
c:\winnt\system32\Icons\Icelandic\Landsbankinn.ico
c:\winnt\system32\Icons\Icelandic\Nyherji.ico
c:\winnt\system32\Icons\Icelandic\Oddi.ico
c:\winnt\system32\Icons\Icelandic\Olis.ico
c:\winnt\system32\Icons\Icelandic\P&S.ico;
c:\winnt\system32\Icons\Icelandic\Plus Ferdir.ico
c:\winnt\system32\Icons\Icelandic\Reykjavik.ico
c:\winnt\system32\Icons\Icelandic\Securitas.ico
c:\winnt\system32\Icons\Icelandic\Sjova Almennar.ico
c:\winnt\system32\Icons\Icelandic\Spron.ico
c:\winnt\system32\Icons\Icelandic\Thumbs.db
c:\winnt\system32\Icons\images.jpg
c:\winnt\system32\Icons\imgres.htm
c:\winnt\system32\Icons\Internet\7 wonders.ico
c:\winnt\system32\Icons\Internet\At.ico
c:\winnt\system32\Icons\Internet\Big Book.ico
c:\winnt\system32\Icons\Internet\binaryface.gif
c:\winnt\system32\Icons\Internet\Bottom 95%.ico
c:\winnt\system32\Icons\Internet\Centrum #1.ico
c:\winnt\system32\Icons\Internet\Centrum #2.ico
c:\winnt\system32\Icons\Internet\Cnet.ico
c:\winnt\system32\Icons\Internet\Excite.ico
c:\winnt\system32\Icons\Internet\Free speech.ico
c:\winnt\system32\Icons\Internet\FutureNet.ico
c:\winnt\system32\Icons\Internet\Housenet.ico
c:\winnt\system32\Icons\Internet\Infoseek.ico
c:\winnt\system32\Icons\Internet\Intenet Shoping Network.ico
c:\winnt\system32\Icons\Internet\Internet Movie Database.ico
c:\winnt\system32\Icons\Internet\Interrobang.bmp
c:\winnt\system32\Icons\Internet\Netscape.ico
c:\winnt\system32\Icons\Internet\SharewareCOM.ico
c:\winnt\system32\Icons\Internet\Thumbs.db
c:\winnt\system32\Icons\Internet\Top 5%.ico
c:\winnt\system32\Icons\Internet\Webcrawler.ico
c:\winnt\system32\Icons\Internet\Yahoo! #1.ico
c:\winnt\system32\Icons\Internet\Yahoo! #2.ico
c:\winnt\system32\Icons\Internet\ZDnet.ico
c:\winnt\system32\Icons\Misc\! #1.ico
c:\winnt\system32\Icons\Misc\! #2.ico
c:\winnt\system32\Icons\Misc\$.ico
c:\winnt\system32\Icons\Misc\1.ico
c:\winnt\system32\Icons\Misc\A #1.ico
c:\winnt\system32\Icons\Misc\A #2.ico
c:\winnt\system32\Icons\Misc\Alien #1.ico
c:\winnt\system32\Icons\Misc\Alien #2.ico
c:\winnt\system32\Icons\Misc\Alien #3.ico
c:\winnt\system32\Icons\Misc\Arrow #1.ico
c:\winnt\system32\Icons\Misc\Arrow #2.ico
c:\winnt\system32\Icons\Misc\Arrow #3.ico
c:\winnt\system32\Icons\Misc\Ball #1.ico
c:\winnt\system32\Icons\Misc\Ball #2.ico
c:\winnt\system32\Icons\Misc\Bear.ico
c:\winnt\system32\Icons\Misc\Beast.ico
c:\winnt\system32\Icons\Misc\Binocular.ico
c:\winnt\system32\Icons\Misc\BMW m3.ico
c:\winnt\system32\Icons\Misc\BMW Z3 Roadster.ico
c:\winnt\system32\Icons\Misc\Book #1.ico
c:\winnt\system32\Icons\Misc\Book #2.ico
c:\winnt\system32\Icons\Misc\Book #3.ico
c:\winnt\system32\Icons\Misc\Book #4.ico
c:\winnt\system32\Icons\Misc\Book #5.ico
c:\winnt\system32\Icons\Misc\Box #2.ico
c:\winnt\system32\Icons\Misc\Box.ico
c:\winnt\system32\Icons\Misc\Butterfly.ico
c:\winnt\system32\Icons\Misc\Button.ico
c:\winnt\system32\Icons\Misc\Cake.ico
c:\winnt\system32\Icons\Misc\Candle.ico
c:\winnt\system32\Icons\Misc\CD.ico
c:\winnt\system32\Icons\Misc\Chair.ico
c:\winnt\system32\Icons\Misc\Circle.ico
c:\winnt\system32\Icons\Misc\Click here.ico
c:\winnt\system32\Icons\Misc\Clipboard.ico
c:\winnt\system32\Icons\Misc\Clown.ico
c:\winnt\system32\Icons\Misc\Coca Cola can.ico
c:\winnt\system32\Icons\Misc\Coffee cup.ico
c:\winnt\system32\Icons\Misc\Compass #1.ico
c:\winnt\system32\Icons\Misc\Compass #2.ico
c:\winnt\system32\Icons\Misc\Duke.ico
c:\winnt\system32\Icons\Misc\Eye.ico
c:\winnt\system32\Icons\Misc\eyeballicon[1].gif
c:\winnt\system32\Icons\Misc\Face (button).ico
c:\winnt\system32\Icons\Misc\Face.ico
c:\winnt\system32\Icons\Misc\Floppy.ico
c:\winnt\system32\Icons\Misc\Ford Bronco.ico
c:\winnt\system32\Icons\Misc\Ford F-150.ico
c:\winnt\system32\Icons\Misc\Fun.ico
c:\winnt\system32\Icons\Misc\Ghost.ico
c:\winnt\system32\Icons\Misc\Gift.ico
c:\winnt\system32\Icons\Misc\Greencar.ico
c:\winnt\system32\Icons\Misc\Grenade.ico
c:\winnt\system32\Icons\Misc\Gun (Colt).ico
c:\winnt\system32\Icons\Misc\Guy #1.ico
c:\winnt\system32\Icons\Misc\Guy #2.ico
c:\winnt\system32\Icons\Misc\Guy #3.ico
c:\winnt\system32\Icons\Misc\Guy #4.ico
c:\winnt\system32\Icons\Misc\Guy #5.ico
c:\winnt\system32\Icons\Misc\Hand #1.ico
c:\winnt\system32\Icons\Misc\Hand #2.ico
c:\winnt\system32\Icons\Misc\Hand #3.ico
c:\winnt\system32\Icons\Misc\Hat.ico
c:\winnt\system32\Icons\Misc\Heart.ico
c:\winnt\system32\Icons\Misc\House.ico
c:\winnt\system32\Icons\Misc\I.ico
c:\winnt\system32\Icons\Misc\Icecream.ico
c:\winnt\system32\Icons\Misc\K.ico
c:\winnt\system32\Icons\Misc\Laptop #1.ico
c:\winnt\system32\Icons\Misc\Laptop #2.ico
c:\winnt\system32\Icons\Misc\Laptop #3.ico
c:\winnt\system32\Icons\Misc\Letter #2.ico
c:\winnt\system32\Icons\Misc\Letter.ico
c:\winnt\system32\Icons\Misc\Life ring.ico
c:\winnt\system32\Icons\Misc\Lightning #1.ico
c:\winnt\system32\Icons\Misc\Lightning #2.ico
c:\winnt\system32\Icons\Misc\Lips.ico
c:\winnt\system32\Icons\Misc\Mask.ico
c:\winnt\system32\Icons\Misc\Mn.ico
c:\winnt\system32\Icons\Misc\Molecule box.ico
c:\winnt\system32\Icons\Misc\Monty python foot.ico
c:\winnt\system32\Icons\Misc\OA.ico
c:\winnt\system32\Icons\Misc\Parental advicory.ico
c:\winnt\system32\Icons\Misc\piano.jpg
c:\winnt\system32\Icons\Misc\Piggy.ico
c:\winnt\system32\Icons\Misc\Pin.ico
c:\winnt\system32\Icons\Misc\Planet #1.ico
c:\winnt\system32\Icons\Misc\Planet #2.ico
c:\winnt\system32\Icons\Misc\Planet #3.ico
c:\winnt\system32\Icons\Misc\Planet #4.ico
c:\winnt\system32\Icons\Misc\Planet #5.ico
c:\winnt\system32\Icons\Misc\Planet #6.ico
c:\winnt\system32\Icons\Misc\Planet #7.ico
c:\winnt\system32\Icons\Misc\Planet #8.ico
c:\winnt\system32\Icons\Misc\Pumpkin.ico
c:\winnt\system32\Icons\Misc\Queen.ico
c:\winnt\system32\Icons\Misc\Question #1.ico
c:\winnt\system32\Icons\Misc\Question #2.ico
c:\winnt\system32\Icons\Misc\Question #3.ico
c:\winnt\system32\Icons\Misc\Ravenloft.ico
c:\winnt\system32\Icons\Misc\Renault Clio.ico
c:\winnt\system32\Icons\Misc\Rolling Stones.ico
c:\winnt\system32\Icons\Misc\Skull #1.ico
c:\winnt\system32\Icons\Misc\Skull #2.ico
c:\winnt\system32\Icons\Misc\Skull #3.ico
c:\winnt\system32\Icons\Misc\Tape ruler.ico
c:\winnt\system32\Icons\Misc\Taxi.ico
c:\winnt\system32\Icons\Misc\Teddy bear.ico
c:\winnt\system32\Icons\Misc\Teeths.ico
c:\winnt\system32\Icons\Misc\Telephone #1.ico
c:\winnt\system32\Icons\Misc\Telephone #2.ico
c:\winnt\system32\Icons\Misc\Thumbs.db
c:\winnt\system32\Icons\Misc\Treasure chest.ico
c:\winnt\system32\Icons\Misc\Trophy.ico
c:\winnt\system32\Icons\Misc\Under 21.ico
c:\winnt\system32\Icons\Misc\Van Gogh.ico
c:\winnt\system32\Icons\Misc\Woman.ico
c:\winnt\system32\Icons\Misc\Worm #1.ico
c:\winnt\system32\Icons\Misc\Worm #2.ico
c:\winnt\system32\Icons\Misc\X.ico
c:\winnt\system32\Icons\Misc\Yin.ico
c:\winnt\system32\Icons\Motley.bmp
c:\winnt\system32\Icons\Rose.bmp
c:\winnt\system32\Icons\rypo.gif
c:\winnt\system32\Icons\Sports\Basketball.ico
c:\winnt\system32\Icons\Sports\Bowling ball.ico
c:\winnt\system32\Icons\Sports\Football.ico
c:\winnt\system32\Icons\Sports\I love this game.ico
c:\winnt\system32\Icons\Sports\Manchester United.ico
c:\winnt\system32\Icons\Sports\NBA.ico
c:\winnt\system32\Icons\Sports\NBA\Atlanta Hawks.ico
c:\winnt\system32\Icons\Sports\NBA\Boston Celtics.ico
c:\winnt\system32\Icons\Sports\NBA\Charlotte Hornets.ico
c:\winnt\system32\Icons\Sports\NBA\Chicago Bulls.ico
c:\winnt\system32\Icons\Sports\NBA\Cleveland Cavaliers.ico
c:\winnt\system32\Icons\Sports\NBA\Dallas Maverics.ico
c:\winnt\system32\Icons\Sports\NBA\Denver Nuggets.ico
c:\winnt\system32\Icons\Sports\NBA\Detroit Pistons.ico
c:\winnt\system32\Icons\Sports\NBA\Golden State Warriors.ico
c:\winnt\system32\Icons\Sports\NBA\Houston Rockets.ico
c:\winnt\system32\Icons\Sports\NBA\Indiana Pacers.ico
c:\winnt\system32\Icons\Sports\NBA\Los Angeles Clippers.ico
c:\winnt\system32\Icons\Sports\NBA\Los Angeles Lakers.ico
c:\winnt\system32\Icons\Sports\NBA\Miami Heat.ico
c:\winnt\system32\Icons\Sports\NBA\Millwaukee Bucks.ico
c:\winnt\system32\Icons\Sports\NBA\Minnesota Timberwolves.ico
c:\winnt\system32\Icons\Sports\NBA\New Jersey Nets.ico
c:\winnt\system32\Icons\Sports\NBA\New York Knicks.ico
c:\winnt\system32\Icons\Sports\NBA\Orlando Magic.ico
c:\winnt\system32\Icons\Sports\NBA\Philadelphia 76ers.ico
c:\winnt\system32\Icons\Sports\NBA\Phoenix Suns.ico
c:\winnt\system32\Icons\Sports\NBA\Portland Trailblazers.ico
c:\winnt\system32\Icons\Sports\NBA\Sacramento Kinks.ico
c:\winnt\system32\Icons\Sports\NBA\San Antonio Spurs.ico
c:\winnt\system32\Icons\Sports\NBA\Seattle Supersonics.ico
c:\winnt\system32\Icons\Sports\NBA\Toronto Raptors.ico
c:\winnt\system32\Icons\Sports\NBA\Utah Jazz.ico
c:\winnt\system32\Icons\Sports\NBA\Vancouver Grizzlies.ico
c:\winnt\system32\Icons\Sports\NBA\Washington Bullets.ico
c:\winnt\system32\Icons\Sports\NFL.ico
c:\winnt\system32\Icons\Sports\NHL\Anaheim Ducks.ico
c:\winnt\system32\Icons\Sports\NHL\Boston Bruins.ico
c:\winnt\system32\Icons\Sports\NHL\Buffalo Sabres.ico
c:\winnt\system32\Icons\Sports\NHL\Calgary Flames.ico
c:\winnt\system32\Icons\Sports\NHL\Chicago Blackhawks.ico
c:\winnt\system32\Icons\Sports\NHL\Colorado Avalanche.ico
c:\winnt\system32\Icons\Sports\NHL\Dallas Stars.ico
c:\winnt\system32\Icons\Sports\NHL\Detroit Red Wings.ico
c:\winnt\system32\Icons\Sports\NHL\Edmonton Oilers.ico
c:\winnt\system32\Icons\Sports\NHL\Florida Panthers.ico
c:\winnt\system32\Icons\Sports\NHL\Hartford Whalers.ico
c:\winnt\system32\Icons\Sports\NHL\Los Angeles Kings.ico
c:\winnt\system32\Icons\Sports\NHL\Montreal Candiens.ico
c:\winnt\system32\Icons\Sports\NHL\New Jersey Devils.ico
c:\winnt\system32\Icons\Sports\NHL\New York Islanders.ico
c:\winnt\system32\Icons\Sports\NHL\New York Rangers.ico
c:\winnt\system32\Icons\Sports\NHL\Ottawa Senators.ico
c:\winnt\system32\Icons\Sports\NHL\Philadelphia Flyers.ico
c:\winnt\system32\Icons\Sports\NHL\Phoenix Coyotes.ico
c:\winnt\system32\Icons\Sports\NHL\Pittsburgh Penguins.ico
c:\winnt\system32\Icons\Sports\NHL\San Jose Sharks.ico
c:\winnt\system32\Icons\Sports\NHL\St. Louis Blues.ico
c:\winnt\system32\Icons\Sports\NHL\Tampa Bay Lightning.ico
c:\winnt\system32\Icons\Sports\NHL\Toronto Maple Leafs.ico
c:\winnt\system32\Icons\Sports\NHL\Vancouver Canucks.ico
c:\winnt\system32\Icons\Sports\NHL\Washington Capitals.ico
c:\winnt\system32\Icons\Sports\Soccerball.ico
c:\winnt\system32\Icons\Sports\Thumbs.db
c:\winnt\system32\Icons\story.ebay.jpg
c:\winnt\system32\Icons\Thumbs.db
c:\winnt\system32\Icons\TV & Cinema\12 Monkeys.ico
c:\winnt\system32\Icons\TV & Cinema\Cameron Diaz #1.ico
c:\winnt\system32\Icons\TV & Cinema\Cameron Diaz #2.ico
c:\winnt\system32\Icons\TV & Cinema\Cindy Crawford.ico
c:\winnt\system32\Icons\TV & Cinema\Death Star.ico
c:\winnt\system32\Icons\TV & Cinema\George Lucas.ico
c:\winnt\system32\Icons\TV & Cinema\Han-Solo.ico
c:\winnt\system32\Icons\TV & Cinema\Imperial fighter.ico
c:\winnt\system32\Icons\TV & Cinema\James Bond.ico
c:\winnt\system32\Icons\TV & Cinema\Jodie Foster.ico
c:\winnt\system32\Icons\TV & Cinema\Leia.ico
c:\winnt\system32\Icons\TV & Cinema\Pamela Anderson.ico
c:\winnt\system32\Icons\TV & Cinema\Patrica Ford.ico
c:\winnt\system32\Icons\TV & Cinema\Rebel X wing.ico
c:\winnt\system32\Icons\TV & Cinema\Sandra Bullock.ico
c:\winnt\system32\Icons\TV & Cinema\Seinfeld #1.ico
c:\winnt\system32\Icons\TV & Cinema\Seinfeld #2.ico
c:\winnt\system32\Icons\TV & Cinema\seinfeld Elaine.ico
c:\winnt\system32\Icons\TV & Cinema\Seinfeld Georg.ico
c:\winnt\system32\Icons\TV & Cinema\Seinfeld Kramer.ico
c:\winnt\system32\Icons\TV & Cinema\Star Wars.ico
c:\winnt\system32\Icons\TV & Cinema\Thumbs.db
c:\winnt\system32\Icons\TV & Cinema\Tie Fighter.ico
c:\winnt\system32\Icons\TV & Cinema\Toy story #1.ico
c:\winnt\system32\Icons\TV & Cinema\Toy story #2.ico
c:\winnt\system32\Icons\TV & Cinema\Trooper.ico
c:\winnt\system32\Icons\TV & Cinema\Yoda #1.ico
c:\winnt\system32\Icons\TV & Cinema\Yoda #2.ico
c:\winnt\system32\ie.ico
c:\winnt\system32\Thumbs.db
c:\winnt\system32\unrar.exe

.
((((((((((((((((((((((((( Files Created from 2010-04-16 to 2010-05-16 )))))))))))))))))))))))))))))))
.

2010-05-14 02:40 . 2010-05-14 02:40 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-05-13 21:27 . 2010-05-13 21:27 ——– d—–w- c:\documents and settings\Dale Kent\Application Data\Malwarebytes
2010-05-13 16:31 . 2010-05-13 16:31 ——– d—–w- c:\program files\Sun
2010-05-13 16:28 . 2010-05-13 16:32 ——– d—–w- c:\program files\Java
2010-05-13 16:24 . 2010-05-13 16:24 ——– d—–w- c:\documents and settings\Patricia Kent\Application Data\Malwarebytes
2010-05-13 15:56 . 2010-05-13 15:56 ——– d—–w- c:\program files\Trend Micro
2010-05-13 14:51 . 2010-05-13 14:51 ——– d—–w- c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\Malwarebytes
2010-05-13 14:50 . 2010-04-29 19:39 38224 —-a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2010-05-13 14:50 . 2010-05-13 14:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-13 14:50 . 2010-05-13 14:50 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-13 14:50 . 2010-04-29 19:39 20952 —-a-w- c:\winnt\system32\drivers\mbam.sys
2010-05-13 13:18 . 2010-05-13 13:18 ——– d—–w- c:\documents and settings\Administrator.LEARNHOWNOW.000\Application Data\thecleaner
2010-05-13 13:18 . 2010-05-13 13:18 37424 —-a-w- c:\documents and settings\Administrator.LEARNHOWNOW.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-13 13:04 . 2010-05-13 13:04 ——– d—–w- c:\documents and settings\Patricia Kent\Application Data\thecleaner
2010-05-13 13:03 . 2010-05-13 16:22 ——– d—–w- c:\documents and settings\All Users\Application Data\moosoft
2010-05-13 12:37 . 2010-05-13 12:37 ——– d—–w- c:\documents and settings\Dale Kent\Application Data\thecleaner
2010-05-13 12:36 . 2010-05-13 14:25 ——– d—–w- c:\program files\The Cleaner
2010-05-13 12:08 . 2010-05-13 12:08 12464 —-a-w- c:\winnt\system32\avgrsstx.dll
2010-05-13 12:08 . 2010-05-13 12:08 242896 —-a-w- c:\winnt\system32\drivers\avgtdix.sys
2010-05-13 12:08 . 2010-05-13 12:08 216200 —-a-w- c:\winnt\system32\drivers\avgldx86.sys
2010-05-13 12:07 . 2010-05-13 12:08 29512 —-a-w- c:\winnt\system32\drivers\avgmfx86.sys
2010-05-13 12:07 . 2010-05-16 18:51 ——– d—–w- c:\winnt\system32\drivers\Avg
2010-05-12 22:33 . 2010-05-12 22:33 ——– d-sh–w- c:\documents and settings\Administrator.LEARNHOWNOW.000\PrivacIE
2010-05-12 22:28 . 2010-05-12 22:28 7168 —-a-w- c:\winnt\system32\drivers\utmymjq3.sys
2010-05-12 22:23 . 2009-10-22 17:54 37392 —-a-w- c:\winnt\system32\drivers\37287782.sys
2010-05-12 22:23 . 2009-10-10 03:31 315408 —-a-w- c:\winnt\system32\drivers\3728778.sys
2010-05-12 22:23 . 2009-09-25 21:59 128016 —-a-w- c:\winnt\system32\drivers\37287781.sys
2010-05-11 23:04 . 2010-05-11 23:04 ——– d—–w- c:\documents and settings\Administrator.LEARNHOWNOW.000\Local Settings\Application Data\Mozilla
2010-05-10 15:14 . 2010-05-10 15:14 ——– d-sh–w- c:\documents and settings\Administrator.LEARNHOWNOW.000\IETldCache
2010-05-09 16:51 . 2010-05-09 16:51 ——– d—–w- c:\documents and settings\Incomplete\Clash Of The Titans 2010 TS www.IWANNADOWNLOAD.com
2010-05-09 16:49 . 2010-05-09 16:49 ——– d—–w- c:\documents and settings\Incomplete\Kick-rear (2010) R5
2010-05-09 16:30 . 2010-05-13 16:32 411368 —-a-w- c:\winnt\system32\deployJava1.dll
2010-05-09 16:17 . 2010-05-09 16:20 ——– d—–w- c:\documents and settings\Dale Kent\.SunDownloadManager
2010-05-09 14:13 . 2010-05-10 20:10 ——– d—–w- c:\documents and settings\Incoming\track001
2010-05-02 22:39 . 2010-05-02 22:43 ——– d—–w- c:\documents and settings\Incoming\UsaBit.com_You.Dont.Know.Jack.cd
2010-05-01 13:27 . 2010-05-03 21:46 ——– d—–w- c:\documents and settings\Incoming\Crazy Heart[2009]DvDrip[Eng]-FXG
2010-04-25 12:14 . 2010-04-25 12:29 80476 —-a-w- c:\winnt\HPHins08.dat
2010-04-25 12:14 . 2005-06-01 16:23 4011 ——w- c:\winnt\hphmdl08.dat
2010-04-18 23:35 . 2010-04-18 23:35 ——– d—–w- c:\documents and settings\Dale Kent\Application Data\FireShot
2010-04-17 16:20 . 2010-04-17 22:28 ——– d—–w- c:\documents and settings\Incoming\Downmixing tutorial (erase unwanted tracks)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-16 18:50 . 2010-03-12 00:00 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-05-16 16:23 . 2010-03-19 16:38 0 -c–a-w- c:\documents and settings\Patricia Kent\Local Settings\Application Data\prvlcl.dat
2010-05-16 16:23 . 2010-03-13 20:20 0 —-a-w- c:\documents and settings\Dale Kent\Local Settings\Application Data\prvlcl.dat
2010-05-16 02:00 . 2005-08-05 19:43 ——– d—–w- c:\documents and settings\All Users\Application Data\HDD Thermometer
2010-05-16 01:51 . 2009-12-05 16:27 720 —-a-w- c:\documents and settings\All Users\Application Data\ArcSoft\kodak-printcreations-22-080812-oem\acforall.dll
2010-05-13 18:24 . 2009-10-16 16:17 ——– d—–w- c:\program files\IDrive
2010-05-13 16:32 . 2004-05-05 00:02 ——– d—–w- c:\program files\Common Files\Java
2010-05-13 13:04 . 2004-04-12 19:09 37424 -c–a-w- c:\documents and settings\Patricia Kent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-12 22:30 . 2010-05-12 19:52 497 —-a-w- c:\documents and settings\Administrator.LEARNHOWNOW.000\udpcrawl.tmp
2010-05-12 12:26 . 2008-02-25 16:33 ——– d—–w- c:\program files\Windows Live Safety Center
2010-05-11 12:13 . 2003-10-06 22:01 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-05-11 12:13 . 2007-07-01 00:54 ——– d—–w- c:\program files\Safer Networking
2010-05-11 11:11 . 2007-06-03 12:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-05-10 09:37 . 2010-05-09 14:22 100 —-a-w- c:\documents and settings\Dale Kent\udpcrawl.tmp
2010-05-10 09:37 . 2010-05-09 17:47 180 —-a-w- c:\documents and settings\Patricia Kent\udpcrawl.tmp
2010-04-21 12:24 . 2010-04-21 12:24 242696 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-04-21 12:23 . 2010-04-21 12:23 1689952 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-04-19 18:59 . 2010-04-19 18:59 255472 —-a-w- c:\documents and settings\Dale Kent\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-04-08 17:36 . 2008-09-11 19:08 ——– d—–w- c:\documents and settings\Dale Kent\Application Data\GoodSync
2010-04-03 22:14 . 2010-04-03 22:14 ——– d—–w- c:\documents and settings\Patricia Kent\Application Data\KodakCredentialStore
2010-04-03 22:14 . 2010-04-03 22:14 ——– d—–w- c:\documents and settings\Patricia Kent\Application Data\Skinux
2010-03-25 22:16 . 2010-03-25 19:49 ——– d—–w- c:\program files\NETGEAR GA311 Adapter
2010-03-25 19:48 . 2010-03-25 19:48 ——– d—–w- c:\documents and settings\All Users\Application Data\{B7A015B7-4802-4678-8CEC-700380BA9AFD}
2010-03-19 03:42 . 2010-03-17 17:56 ——– d—–w- c:\program files\XeroBank
2010-03-10 06:15 . 2003-03-31 12:00 420352 —-a-w- c:\winnt\system32\vbscript.dll
2010-02-25 06:24 . 2006-06-23 16:33 916480 —-a-w- c:\winnt\system32\wininet.dll
2010-02-24 13:11 . 2003-03-31 12:00 455680 —-a-w- c:\winnt\system32\drivers\mrxsmb.sys
2010-02-17 13:10 . 2003-03-31 12:00 2189952 —-a-w- c:\winnt\system32\ntoskrnl.exe
2010-02-16 13:25 . 2002-08-29 01:04 2066816 —-a-w- c:\winnt\system32\ntkrnlpa.exe
2005-09-14 18:13 . 2005-09-14 18:13 774144 —-a-w- c:\program files\RngInterstitial.dll
2003-11-10 14:01 . 2006-07-22 03:20 81920 —-a-w- c:\program files\Tw10122.dat
2000-08-31 11:00 . 2006-07-22 03:20 317952 —-a-w- c:\program files\roboex32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Dale Kent\Application Data\mjusbsp\cdloader2.exe" [2009-08-01 50520]
"RSD_HDDThermo"="c:\program files\HDD Thermometer\HDD Thermometer.exe" [2005-04-01 215040]
"Task Killer"="c:\program files\Task Killer\taskkiller.exe" [2010-04-08 221696]
"Google Update"="c:\documents and settings\Dale Kent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-03 135664]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-04-17 160328]
"tcactive"="c:\program files\The Cleaner\tcap.exe" [2010-03-30 2951680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U.S. Robotics Wireless Manager UI"="c:\winnt\system32\WLTRAY" [X]
"CTStartup"="c:\program files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 28672]
"UpdReg"="c:\winnt\UpdReg.EXE" [2000-05-11 90112]
"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2006-10-22 7700480]
"Jet Detection"="c:\program files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [2001-11-29 28672]
"HPDJ Taskbar Utility"="c:\winnt\System32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 188416]
"CoolSwitch"="c:\winnt\System32\taskswitch.exe" [2002-03-19 45632]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-10 385024]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-02 65536]
"RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-06-24 319488]
"NvMediaCenter"="c:\winnt\system32\NvMcTray.dll" [2006-10-22 86016]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-04-17 160328]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
"tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544]

c:\documents and settings\Dale Kent\Start Menu\Programs\Startup\
HDD Thermometer.lnk - c:\documents and settings\Default User\Start Menu\Programs\Startup\HDD Thermometer.exe [2005-4-1 215040]
Task Killer v2.30.lnk - c:\program files\Task Killer\TaskKiller.exe [2007-11-4 221696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GA311 Smart Wizard Utility.lnk - c:\program files\NETGEAR GA311 Adapter\GA311.exe [2003-12-25 270336]
Kodak EasyShare software.lnk.disabled [2009-12-5 1833]
TaskBar Icon.lnk - c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe [2005-7-5 160328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-05-13 12:08 12464 —-a-w- c:\winnt\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AVG Free Edition for Windows.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AVG Free Edition for Windows.lnk
backup=c:\winnt\pss\AVG Free Edition for Windows.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mess mix

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINNT\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1104981013\\EE\\aolsoftware.exe"=
"c:\\WINNT\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Common Files\\AOL\\1104981013\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Jet-Audio\\JETAUDIO.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINNT\\system32\\mmc.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Program Files\\Torpark\\Torpark 1.5.0.7\\Torpark.exe"=
"c:\\Documents and Settings\\Patricia Kent\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Dale Kent\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Documents and Settings\\Dale Kent\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Dale Kent\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\XeroBank\\xBBrowser.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"46500:TCP"= 46500:TCP:*:Disabled:Frostwire
"46500:UDP"= 46500:UDP:*:Disabled:Frostwire
"6346:TCP"= 6346:TCP:limewire
"24000:TCP"= 24000:TCP:Scrabulous
"24100:TCP"= 24100:TCP:Scrabulous

R0 37287782;37287782 Boot Guard Driver;c:\winnt\system32\drivers\37287782.sys [5/12/2010 6:23 PM 37392]
R1 37287781;37287781;c:\winnt\system32\drivers\37287781.sys [5/12/2010 6:23 PM 128016]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [5/13/2010 8:08 AM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [5/13/2010 8:08 AM 242896]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [5/13/2010 8:06 AM 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [5/13/2010 8:05 AM 308064]
R2 LANPkt;Realtek LANPkt Protocol;c:\winnt\system32\drivers\LANPkt.sys [12/25/2003 7:53 PM 8440]
R2 SocketLock;Raw Socket Lock Driver;c:\winnt\system32\socketlock.sys [10/31/2003 10:14 PM 3712]
R2 TTFixerService;NST ToolTipFixer;c:\program files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe [6/27/2007 1:20 AM 10240]
R3 Diag69xp;Diag69xp;c:\winnt\system32\drivers\diag69xp.sys [12/25/2003 7:53 PM 11237]
S2 DCSPGSRV;DiamondCS ProcessGuard Service v3.410;"c:\program files\ProcessGuard\dcsuserprot.exe" –> c:\program files\ProcessGuard\dcsuserprot.exe [?]
S2 gupdate1c9d30d7dc4a166;Google Update Service (gupdate1c9d30d7dc4a166);c:\program files\Google\Update\GoogleUpdate.exe [5/12/2009 10:25 AM 133104]
S2 moohelp;The Cleaner 2011 Helper Service;c:\program files\The Cleaner\mhelper.exe [5/13/2010 8:36 AM 813056]
S2 procguard;procguard;\??\c:\winnt\system32\drivers\procguard.sys –> c:\winnt\system32\drivers\procguard.sys [?]
S3 NetgearGA311;NETGEAR GA311 Gigabit Adapter Driver;c:\winnt\system32\drivers\G311N6.sys [3/25/2010 4:38 PM 70144]
S3 NTGUARD;NTGUARD;\??\c:\ikarus\GuardNT\NTGUARD.SYS –> c:\ikarus\GuardNT\NTGUARD.SYS [?]
S3 PSI;PSI;c:\winnt\system32\drivers\psi_mf.sys [8/1/2007 7:27 AM 7808]
S3 utmymjq3;AVZ Kernel Driver;c:\winnt\system32\drivers\utmymjq3.sys [5/12/2010 6:28 PM 7168]
.
Contents of the 'Scheduled Tasks' folder

2010-05-16 c:\winnt\Tasks\dfrg.job
- c:\winnt\system32\dfrg.msc [2003-03-31 12:00]

2010-05-16 c:\winnt\Tasks\Disk Cleanup.job
- c:\winnt\system32\cleanmgr.exe [2003-03-31 00:12]

2010-05-16 c:\winnt\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-22 09:39]

2010-05-16 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-12 14:24]

2010-05-16 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-12 14:24]

2010-05-16 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-2410643885-4093545365-1679696873-1006Core.job
- c:\documents and settings\Dale Kent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-29 12:23]

2010-05-16 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-2410643885-4093545365-1679696873-1006UA.job
- c:\documents and settings\Dale Kent\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-29 12:23]

2010-05-16 c:\winnt\Tasks\User_Feed_Synchronization-{6E39BF43-1378-4038-A18E-F720DFF2C882}.job
- c:\winnt\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Settings,ProxyServer = http=proxy-server:8080;https=proxy-server:8080
uInternet Settings,ProxyOverride = ams-server*
IE: Add to Google Photos Screensa&ver;
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Password Generator - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComPasswordGenerator.html
IE: RoboForm TaskBar Icon - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComTaskBarIcon.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: hp.com\h20364.www2
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: microsoft.com\www
DPF: DigiChat Applet - hxxp://host16.digichat.com/DigiChat/DigiClasses/Client_IE.cab
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} - hxxp://www.pandasoftware.es/avchecker/controles/AvDetInst.cab
DPF: {2C8EEB84-6D60-11D4-BD64-0050048A82BF} - hxxp://billing-a.mhi.aol.com/netagent/objects/custappx2.CAB
DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} - hxxp://www.imgag.com/cp/install/AxCtp.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner371050.cab
FF - ProfilePath - c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - component: c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\{7E7165E2-0767-448c-852F-5FA8714F2C37}\components\PlainOldFavorites.dll
FF - component: c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\[removed]\platform\WINNT_x86-msvc\components\mozFotofox.dll
FF - component: c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\[removed]\components\coolirisstub.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\Dale Kent\Application Data\Mozilla\Firefox\Profiles\ny1wmy9i.default\extensions\[removed]\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\Dale Kent\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Dale Kent\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPPGWrap.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\winnt\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Cmaudio - cmicnfg.cpl



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-16 16:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = c:\program files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4???????4???????\??? ??? ???\???\???????????5?B~e?B~\???\????????B`??????C@?\???\??????s????\??????s\???????A??s?????C@?x???`|?w\?????@

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2410643885-4093545365-1679696873-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(752)
c:\winnt\System32\BCMLogon.dll
.
Completion time: 2010-05-16 16:28:59
ComboFix-quarantined-files.txt 2010-05-16 20:28

Pre-Run: 79,726,657,536 bytes free
Post-Run: 80,267,677,696 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - B4BC6BE325D67C86227FF0839F654942
Post #12
Hi,

ComboFix removed a great number of icon files - were these downloaded from a torrent or other site? What can you tell me about them? (just want to make sure they were not false positives)

Please do the following:



  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\winnt\system32\drivers\utmymjq3.sys

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Please do the same for the following files:

c:\winnt\system32\drivers\37287782.sys
c:\winnt\system32\drivers\3728778.sys
c:\winnt\system32\drivers\37287781.sys
Post #13
Good Morning. On first view today, the AVG was alerting as follows: "Infection";"Trojan horse Cryptic.PX";"C:\System Volume Information\_restore{17732D30-E5C5-4F98-9675-67569E8CB6A9}\RP6\A0000548.dll";"";"5/17/2010, 7:53:16 AM"
I removed it to the Virus Vault. Trouble in River City!
I ran the files you mention at VirSCAN.org and UTMYMJG3.sys was identified as a positive. I have included a zip file of the results.
The .ico files were collected from a few different sites over the years for use in web page design. No torrents. I don't recall any problems involving any of them over time.
Thanks and have a great day.
Dale

Attachments:

  • [attachment removed: VirScan.zip]
Post #14
Hi,

Did you used to have Kaspersky installed on your machine at one time?


Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Cannot_install_new_msi_version_Hijack_t112039.html&view=findpost&p=653548#entry653548

Collect::
c:\winnt\system32\drivers\utmymjq3.sys

Suspect::
c:\winnt\system32\drivers\37287782.sys
c:\winnt\system32\drivers\3728778.sys
c:\winnt\system32\drivers\37287781.sys

File::
c:\documents and settings\Administrator.LEARNHOWNOW.000\udpcrawl.tmp
c:\documents and settings\Patricia Kent\Local Settings\Application Data\prvlcl.dat
c:\documents and settings\Dale Kent\Local Settings\Application Data\prvlcl.dat
c:\documents and settings\Dale Kent\udpcrawl.tmp
c:\documents and settings\Patricia Kent\udpcrawl.tmp

Driver::
utmymjq3

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

I would like to analyze a random sample of those icon files, if you would please upload a few for me:

they may have been targeted because the folder is in your system32 folder

Please do the following:

  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\qoobox\quarantine\c\winnt\system32\Icons\Cartoons\Roy.ico.vir

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Please do the same for the following:

c:\qoobox\quarantine\c\winnt\system32\Icons\Church\church9.wmf.vir
c:\qoobox\quarantine\c\winnt\system32\Icons\Commercial\Coca Cola #2.ico.vir
c:\qoobox\quarantine\c\winnt\system32\Icons\FOmis57.ico.vir
Post #15
Hi, this is a little complicated. :unsure:
  • I saved the script as requested. It refused to run, saying that it was misspelled. (They misspeld mispeld LOL). I then renamed the script, as it insisted on being called a .txt file when saved as all files. First, I just deleted the .txt part of the name, and it would not run. Then I renamed it .vbs and it ran. It is attached, as are the scans from VirSCAN.org.
  • Here is a zip file of several icons as well.
  • when ComboFix rebooted, an alert message appeared during the process initialization saying that Catchme.cfxxe could not run because Windows was shutting down.
  • The cut and paste technique did not work for cutting the file name from this page and entering it at VirScan.org. I had to browse to each file individually in order to scan them. They all were negative.
I want you to know how much I appreciate your continued efforts to clean this machine.

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI