This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Newbie needing help !

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi jonregester

Well done on your tasks! There is still one O17 line we need to get rid of so let's have another go.

1 - Run HJT Scan
Run a scan with HijackThis and tick the following entries, if present:

O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 85.255.116.137 85.255.112.23

Close all windows except HijackThis
Select Fix Checked in HijackThis.

2 - Network Settings

Note: This step (2 - Network Settings) is only required if you are experiencing problems connecting to the internet. If you are not having any problems, move on to the next step.
(2000/XP) Only
In the windows control panel (Start > Control Panel), if you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections.
Right-click on your default connection, usually local area connection for cable and dsl, and left click on properties.
Click the Networking tab.
Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot your PC if asked.
Now click on Start > Run and type cmd and click on OK
Type ipconfig /flushdns (note the space after ipconfig and before the /)
Press Enter, type exit at the command prompt, then press enter
The command window will close.


3 - Check on status
After you have completed the above, please reboot and provide a new HijackThis log and let me know how your PC is behaving now. Have we dealt with your initial problem? I appreciate this may take a little time to be sure. I'll reveal more about your PC's infection(s) once we're rid of them.

Good Luck

Vino
Hey vino
Latest hjt log
Logfile of HijackThis v1.99.1
Scan saved at 06:27:41, on 11/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
C:\Program Files\TOPRO\TPPOLL.EXE
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Documents and Settings\JON\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [TPPOLL] C:\Program Files\TOPRO\TPPOLL.EXE
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137692788537
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 85.255.116.137 85.255.112.23
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

Once again my thanks for your patience.
My pc does seem a little better but you never know i have over the years become very sceptical but I have faith in you my friend!
Yes I would be interested to know more about the infections if for nothing else than to know how to avoid them in the future is my anti virus up to the job ?
Is there any other software you would reccomend.
I am sure you will answer all these questions and more when we are finished and I don't mean to rush you.
Once again thank you so much
Hi jonregester

Thanks for posting the new HijackThis log.

We've still a little more to do.

1 - Backlight
Please download F-Secure's trial Blacklight from
>here<
Information and help can be found >here<
Click the I Accept button at the the license agreement
Click the Download button to start the download
Save it to your Desktop

Double-click the blbeta.exe file on your Desktop
Select the I Accept the agreement at the license agreement, then click Next

Make sure Scan through Windows Explorer (Recommended) is selected\checked
Make sure all open programs and windows are closed (including this browser window) before clicking the Scan button
Click Scan
When the animated graphics, in the bottom right-hand corner, disappears, click Next

A text log file will appear on your Desktop when the scan is complete. It will start with fsbl-xxxxxx.txt (ie: fsbl-20051017165931.log)
Paste the contents of that log in your next reply.

Good Luck

Vino
Hello again I did as you asked and here are the results of the latest scan 08/11/06 13:13:20 [Info]: BlackLight Engine 1.0.42 initialized 08/11/06 13:13:20 [Info]: OS: 5.1 build 2600 (Service Pack 2) 08/11/06 13:13:21 [Note]: 7019 4 08/11/06 13:13:21 [Note]: 7005 0 08/11/06 13:13:51 [Note]: 7006 0 08/11/06 13:13:52 [Note]: 7011 1476 08/11/06 13:13:54 [Note]: 7026 0 08/11/06 13:13:54 [Note]: 7026 0 08/11/06 13:14:19 [Note]: FSRAW library version 1.7.1019 08/11/06 13:32:13 [Note]: 7007 0 With all these programs I keep downloading should I delete them or keep them ? When we removed the items with hijack this the other day windows made a back up folder which is still on my desktop Should I delete this folder ? Once again thank you
Hi jonregester

Thanks for posting the Blacklight log. Unfortunately, it didn't find what I'm looking for.
Let's try another tool.
NB In answer to your question, yes we will be able to delete the tools we've downloaded once we're finished.

1 - Rootkit Revealer
Please download and extract to your Desktop Rootkit Revealer from
>here<
Double-click the RootkitRevealer.exe file
Click Scan and please be patient while the scan takes place
When finished, click File > Save and, using the default name, save the scan results to your Desktop
Paste the contents of that log in your next reply.

I'd also like you to re-run Fixwareout…

2 - WareOut Fix
Use Windows Explorer to go to the C:\fixwareout folder
Find and double-click on fix-it.bat
The fix will begin; follow the prompts.
You will be asked to reboot your computer; please do so.
Your system may take longer than usual to load; this is normal.

At the end of the fix, you may need to restart your computer again.

Can you please post the contents of the logfile C:\fixwareout\report.txt

3 - Network Settings

Note: This step (3 - Network Settings) is only required if you are experiencing problems connecting to the internet. If you are not having any problems, move on to the next step.
(2000/XP) Only
In the windows control panel (Start > Control Panel), if you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections.
Right-click on your default connection, usually local area connection for cable and dsl, and left click on properties.
Click the Networking tab.
Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot your PC if asked.
Now click on Start > Run and type cmd and click on OK
Type ipconfig /flushdns (note the space after ipconfig and before the /)
Press Enter, type exit at the command prompt, then press enter
The command window will close.

4 - Status Check
With your next reply, please post:
- the RootkitRevealer report
- the Fixwareout report
- a new HJT log

Good Luck

Vino
Hi vino I scanned withRootkit Revealer.exe and i get the scan results but when I go to save the results it won't let me. i have tried uninstalling the software then re installing and re scanning but it doesn't make any difference. I click on file then save to desktop then when I look on my desktop there is nothing . Sorry to be a nuisance I guess thats another beer i owe you !!!
Yes, I just tried it myself and couldn't save the results to my Desktop either. Weird!
I tried another location and the file did save to My Documents. Can you please try re-running RootkitRevealer and saving the output to a different location such as C:\My Documents.

Don't forget to then complete the other steps above and post the Fixwareout results and another HijackThis log.

Thanks

Vino
Hello again Well I scanned with rootkit reveal and saved the results to my documents and it said that the file already existed at that location. I was asked do I want to replace the existing file I said yes. When I went to look for the scan results they were no where to be seen. Thanks for your patience
Hi jonregester
You may find the Rootkit Revealer scan results in the following folder. Can you please have a look using Windows Explorer and reply with the results if they are there.

C:\Documents and Settings\LocalService\SYSTEM'S Documents
(Note that the address bar in Windows Explorer may show C:\Documents and Settings\LocalService\My Documents)

Should you find the Rootkit Revealer results, please carry out my previous request of running Fixwareout and posting the results along with a new HJT log.

Thanks

Vino
hello again sorry for the delay but I have been trying to save the rootkit revealer scan results it is however proving impossible. It won't let me save the results no matter where I tell windows to save them. I have even done a search after saving the results to my pc but nothing shows up. My anti virus keeps flagging up "network virus blocked " exploit/lsass. i don't know what on earth is going on but it's really weird.
Hi jonregester

I'm sorry that we don't seem to be having much luck in saving the Rootkit Revealer log. Can you please try the following to see if it makes a difference.

Using Windows Explorer, create a new folder in your C:\ drive called RKR
Again, using Windows Explorer, move the file RootkitRevealer.exe to the new C:\RKR folder
Now please try running the program by double-clicking on RootkitRevealer.exe
When the scan has finished, please try saving the log to the C:\RKR folder

Good Luck

Vino
Hello again
Right firstly the results of the RKR scan this was done whilst I was still connected to the internet is that a problem
C:\Documents and Settings\JON\Cookies\[removed][2].txt 20/08/2006 03:12 457 bytes Hidden from Windows API.
C:\Documents and Settings\JON\Cookies\jon@cdcovers[1].txt 20/08/2006 03:12 334 bytes Hidden from Windows API.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\130x130_sun_free_downloads[1].gif 20/08/2006 02:52 7.72 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\223166[1].jpg 20/08/2006 02:52 5.41 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\3261601000[1].jpg 20/08/2006 02:52 5.26 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\3300701000[1].jpg 20/08/2006 02:52 4.48 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\4970342[1].jpg 20/08/2006 02:52 4.99 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\_alternate[1].css 20/08/2006 02:52 22 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\bck[1].gif 20/08/2006 02:52 18.93 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\bck[2].gif 20/08/2006 02:52 459 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\buy_lrg[1].gif 20/08/2006 02:52 614 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\CDINTACT2[1].jpg 20/08/2006 02:52 4.75 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\change_view_button[1].gif 20/08/2006 02:52 212 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\chartsnav_h2_bck[1].gif 20/08/2006 02:52 1.22 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\CXINTACT1[1].jpg 20/08/2006 02:52 3.69 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\D067705[1].jpg 20/08/2006 02:52 4.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\default[1].png 20/08/2006 02:49 3.71 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\EDV9377[1].jpg 20/08/2006 02:52 3.78 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\favourite[1].png 20/08/2006 02:50 335 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\flagpage[1].css 20/08/2006 02:52 1.52 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\footer_bck_hires[1].jpg 20/08/2006 02:52 1.46 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\h2_bck[1].jpg 20/08/2006 02:52 924 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\h3_bck[1].jpg 20/08/2006 02:52 333 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\header[1].gif 20/08/2006 02:52 10.95 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\hi-res[1].css 20/08/2006 02:52 4.90 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\nav_downloads_bck[1].gif 20/08/2006 02:52 3.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\nav_games_bck[1].gif 20/08/2006 02:52 2.68 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\navigation_bck[1].jpg 20/08/2006 02:52 397 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\NIN353[1].jpg 20/08/2006 02:52 5.59 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\p[1].htm 20/08/2006 02:50 15.05 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\p[2].htm 20/08/2006 02:50 11.83 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\p[3].htm 20/08/2006 02:51 14.81 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\pre_order_sml[1].gif 20/08/2006 02:52 1.88 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\PRERELCDSNOWP[1].jpg 20/08/2006 02:52 9.25 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\print_logo[1].gif 20/08/2006 02:52 5.10 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\privmsg[1].png 20/08/2006 02:49 2.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\product_nav_bck[1].jpg 20/08/2006 02:52 771 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\profile[1].png 20/08/2006 02:49 2.42 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\REMARIL005[1].jpg 20/08/2006 02:52 5.64 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\REMARIL005[2].jpg 20/08/2006 02:52 11.85 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\search[1].htm 20/08/2006 02:52 14 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\search[2].htm 20/08/2006 02:52 14 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\searchbar_adv_search[1].gif 20/08/2006 02:52 1.25 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\top_links_bck[1].gif 20/08/2006 02:52 153 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\1KD49SWV\topup[1].png 20/08/2006 02:49 2.95 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\130x130_blu_ray[1].gif 20/08/2006 02:52 8.25 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\130x130_VFestival[1].gif 20/08/2006 02:52 12.72 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\4986112[1].jpg 20/08/2006 02:52 11.13 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\5323212[1].jpg 20/08/2006 02:52 5.55 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\5346282[1].jpg 20/08/2006 02:52 8.59 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\5395089[1].jpg 20/08/2006 02:52 3.71 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\660x120_06WOL[1].jpg 20/08/2006 02:52 18.32 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\960x30_06WOP[1].jpg 20/08/2006 02:52 10.33 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\a_pink_arrow_up_small[1].gif 20/08/2006 02:52 157 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\account[1].htm 20/08/2006 02:49 17.07 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\bck_dottedline[1].gif 20/08/2006 02:52 66 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\btn_submit[1].gif 20/08/2006 02:52 215 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\buy_sml[1].gif 20/08/2006 02:52 749 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\CDV3020[1].jpg 20/08/2006 02:52 3.89 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\chartsnav_li_bck[1].gif 20/08/2006 02:52 435 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\content_bck[1].gif 20/08/2006 02:52 58 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\D081070[1].jpg 20/08/2006 02:52 8.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\daily[1].png 20/08/2006 02:49 2.83 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\dc867362[1].jpg 20/08/2006 02:52 5.47 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\filters[1].png 20/08/2006 02:49 2.69 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\footer_a_bck[1].gif 20/08/2006 02:52 63 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\h2_bck[1].gif 20/08/2006 02:52 2.05 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\h2_bck[1].jpg 20/08/2006 02:52 534 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\hi-res[1].css 20/08/2006 02:52 4.90 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\hmv[1].js 20/08/2006 02:52 16.88 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\hr_white[1].gif 20/08/2006 02:52 48 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\ignore[1].png 20/08/2006 02:50 555 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\M4933692[1].jpg 20/08/2006 02:52 5.24 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\MDRP3801[1].jpg 20/08/2006 02:52 3.62 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\nav_albums_bck[1].gif 20/08/2006 02:52 2.96 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\new_customer_incentive[1].gif 20/08/2006 02:52 19.75 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\new_customer_incentive[2].gif 20/08/2006 02:52 19.75 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\p[1].htm 20/08/2006 02:50 22.73 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\p[2].htm 20/08/2006 02:51 14.92 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\print_logo[1].gif 20/08/2006 02:52 5.10 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\screen[1].css 20/08/2006 02:49 13.72 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\search[1].htm 20/08/2006 02:52 14 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\search[2].htm 20/08/2006 02:52 14 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\SMRCD319[1].jpg 20/08/2006 02:52 4.97 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\summer_dvds_130x130[1].gif 20/08/2006 02:52 7.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\vacation[1].png 20/08/2006 02:49 2.06 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\WMTV022[1].jpg 20/08/2006 02:52 7.09 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\CHNNFMF2\ZELDAPRINCESS[1].jpg 20/08/2006 02:52 4.48 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\130x130_hd_dvd[1].gif 20/08/2006 02:52 8.70 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\130x130_mercury_lover[1].gif 20/08/2006 02:52 5.73 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\4906259[1].jpg 20/08/2006 02:52 3.62 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\4933722[1].jpg 20/08/2006 02:52 3.91 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\5271162[1].jpg 20/08/2006 02:52 5.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\5508212[1].jpg 20/08/2006 02:52 3.96 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\add_wish_list[1].gif 20/08/2006 02:52 605 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\bck[1].gif 20/08/2006 02:52 1.77 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\bck[1].jpg 20/08/2006 02:52 3.75 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\btn_submit[1].gif 20/08/2006 02:52 215 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\BUA0022401[1].jpg 20/08/2006 02:52 10.86 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\buy_lrg[1].gif 20/08/2006 02:52 614 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\complete[1].png 20/08/2006 02:50 290 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\default[1].css 20/08/2006 02:52 9.17 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\footer_bck_hires[1].jpg 20/08/2006 02:52 1.46 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\functions[1].js 20/08/2006 02:52 1.04 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\google.co[1].htm 20/08/2006 02:51 3.72 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\h1_bck[1].jpg 20/08/2006 02:52 672 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\h2_bck[1].gif 20/08/2006 02:52 1.66 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\h2_bck[1].jpg 20/08/2006 02:52 582 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\h2_bck[2].gif 20/08/2006 02:52 87 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\h2_bck[2].jpg 20/08/2006 02:52 333 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\header[1].gif 20/08/2006 02:52 10.95 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\ie[1].css 20/08/2006 02:52 2.87 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\INTACTCD1[1].jpg 20/08/2006 02:52 3.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\li_bck[1].gif 20/08/2006 02:52 2.51 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\li_bck[2].gif 20/08/2006 02:52 44 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\nav_comingsoon_bck[1].gif 20/08/2006 02:52 2.40 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\nav_home_bck[1].gif 20/08/2006 02:52 2.69 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\nav_offers_bck[1].gif 20/08/2006 02:52 2.52 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\nav_singles_bck[1].gif 20/08/2006 02:52 2.90 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\nfo[1].png 20/08/2006 02:50 337 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\p[1].htm 20/08/2006 02:51 11.85 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\pre_order_lrg[1].gif 20/08/2006 02:52 2.32 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\PRESCISSORCD[1].jpg 20/08/2006 02:52 4.54 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\REMARIL001[1].jpg 20/08/2006 02:52 6.03 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\searchbar_go[1].gif 20/08/2006 02:52 580 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\searchbar_go[2].gif 20/08/2006 02:52 580 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHFF0XPH\sound[1].gif 20/08/2006 02:52 166 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\130x130_blank_head[1].gif 20/08/2006 02:52 6.71 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\3315301012[1].jpg 20/08/2006 02:52 4.47 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\3708502[1].jpg 20/08/2006 02:52 4.70 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\4005209076579[1].jpg 20/08/2006 02:52 4.76 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\4906249[1].jpg 20/08/2006 02:52 4.26 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\4970382[1].jpg 20/08/2006 02:52 3.96 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\4986112[1].jpg 20/08/2006 02:52 4.92 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\5026555305402[1].jpg 20/08/2006 02:52 5.47 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\9362481402[1].jpg 20/08/2006 02:52 6.10 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\_print[1].css 20/08/2006 02:52 496 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\a_pink_arrow[1].gif 20/08/2006 02:52 158 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\a_pink_arrow_down_small[1].gif 20/08/2006 02:52 157 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\a_pink_arrow_small[1].gif 20/08/2006 02:52 155 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\base_bck[1].gif 20/08/2006 02:52 427 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\bck[1].gif 20/08/2006 02:52 2.44 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\bck[1].jpg 20/08/2006 02:52 1.08 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\BUA0030301[1].jpg 20/08/2006 02:52 4.43 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\buy_sml[1].gif 20/08/2006 02:52 749 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\CAWLA7OD.htm 20/08/2006 02:52 14 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\CDS7914632[1].jpg 20/08/2006 02:52 6.59 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\components[1].css 20/08/2006 02:52 46.85 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\CXINTACT2[1].jpg 20/08/2006 02:52 5.20 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\functions[1].js 20/08/2006 02:49 18.80 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\h2_bck[1].jpg 20/08/2006 02:52 1.32 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\header_bck_hires[1].jpg 20/08/2006 02:52 1.71 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\header_bck_hires[2].jpg 20/08/2006 02:52 1.71 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\header_logo[1].jpg 20/08/2006 02:52 3.55 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\heading_bck[1].jpg 20/08/2006 02:52 349 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\INTACTDVD1[1].jpg 20/08/2006 02:52 3.94 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\list[1].png 20/08/2006 02:49 2.81 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\login[1].htm 20/08/2006 02:49 12.55 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\logo[1].gif 20/08/2006 02:51 8.50 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\nav_dvd_bck[1].gif 20/08/2006 02:52 2.38 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\nav_gadgets_bck[1].gif 20/08/2006 02:52 3.03 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\p[1].htm 20/08/2006 02:50 11.84 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\p[2].htm 20/08/2006 02:51 11.84 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\payments[1].png 20/08/2006 02:49 2.95 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\preferences[1].png 20/08/2006 02:49 2.21 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\PRERELCDPHILTON[1].jpg 20/08/2006 02:52 9.12 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\resize[1].js 20/08/2006 02:52 668 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\searchbar_adv_search[1].gif 20/08/2006 02:52 1.25 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\searchbar_bck[1].jpg 20/08/2006 02:52 393 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\url[1].png 20/08/2006 02:50 562 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\Local Settings\Temporary Internet Files\Content.IE5\HHZBAFJT\watchdog[1].png 20/08/2006 02:49 2.43 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\JON\My Documents\dvd covers\Scary_Movie_3-front.jpg 20/08/2006 03:11 419.75 KB Hidden from Windows API.
C:\Documents and Settings\JON\My Documents\dvd covers\Scary_Movie_4-front.jpg 20/08/2006 03:12 495.98 KB Hidden from Windows API.
C:\Documents and Settings\JON\My Documents\dvd covers\X_Men_2-front.jpg 20/08/2006 03:08 369.98 KB Hidden from Windows API.
C:\Documents and Settings\JON\Recent\Just like heaven Front.bmp.lnk 20/08/2006 03:03 731 bytes Hidden from Windows API.
C:\Documents and Settings\JON\Recent\Scary_Movie_3-front.jpg.lnk 20/08/2006 03:11 728 bytes Hidden from Windows API.
C:\Documents and Settings\JON\Recent\Scary_Movie_4-front.jpg.lnk 20/08/2006 03:12 632 bytes Hidden from Windows API.
C:\Documents and Settings\JON\Recent\X_Men_2-front.jpg.lnk 20/08/2006 03:09 692 bytes Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018763.lnk 20/08/2006 03:03 438 bytes Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018764.cfg 18/08/2006 12:14 55.06 KB Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018765.cfg 18/08/2006 13:42 55.06 KB Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018766.exe 20/08/2006 03:15 445.95 KB Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018766.exe:Zone.Identifier 20/08/2006 03:15 26 bytes Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018767.exe 20/08/2006 03:15 799.56 KB Hidden from Windows API.
C:\System Volume Information\_restore{1A30F93B-A113-4798-B3CF-08287D71917C}\RP66\A0018767.exe:Zone.Identifier 20/08/2006 03:15 26 bytes Hidden from Windows API.
C:\System Volume Information\catalog.wci\00010002.ci 20/08/2006 03:10 40.00 KB Hidden from Windows API.
C:\System Volume Information\catalog.wci\00010002.dir 20/08/2006 03:10 484 bytes Hidden from Windows API.
C:\System Volume Information\catalog.wci\CiFLfffc.000 20/08/2006 02:50 240 bytes Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\catalog.wci\CiFLfffc.001 20/08/2006 02:50 64.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\catalog.wci\CiFLfffc.002 20/08/2006 02:50 64.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\catalog.wci\CiFLfffd.000 20/08/2006 03:10 240 bytes Hidden from Windows API.
C:\System Volume Information\catalog.wci\CiFLfffd.001 20/08/2006 03:10 64.00 KB Hidden from Windows API.
C:\System Volume Information\catalog.wci\CiFLfffd.002 20/08/2006 03:10 64.00 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\AVCIMAN.EXE-033BB562.pf 20/08/2006 03:04 15.71 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\AVLTMAIN.EXE-1FE37852.pf 20/08/2006 03:05 43.40 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\E_S10MT2.EXE-0E680929.pf 20/08/2006 03:04 17.45 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\E_S10RN2.EXE-38983110.pf 20/08/2006 03:04 16.06 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\PSIMREAL.EXE-30CF6158.pf 20/08/2006 03:05 5.48 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\SAGENT4.EXE-21EE8135.pf 20/08/2006 03:04 10.09 KB Hidden from Windows API.
C:\WINDOWS\Prefetch\UNDERCOVERXP.EXE-2D3AE5CD.pf 20/08/2006 03:01 13.97 KB Hidden from Windows API.
C:\WINDOWS\system32\spool\PRINTERS\FP00000.SHD 20/08/2006 03:05 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\system32\spool\PRINTERS\FP00000.SPL 20/08/2006 03:05 0 bytes Visible in Windows API, but not in MFT or directory index.
Next the new fixwareout scan results

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32
And finally the new hjt log
Logfile of HijackThis v1.99.1
Scan saved at 03:41:52, on 20/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\apvxdwin.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\TOPRO\TPPOLL.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\JON\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [TPPOLL] C:\Program Files\TOPRO\TPPOLL.EXE
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137692788537
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 85.255.116.137 85.255.112.23
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

Once again thank you for your help and patuence
Hi Jonregester

Just before we start our next step, I am suspicious of this program and would like to ask you if you recognise it:
C:\Program Files\TOPRO\TPPOLL.EXE
If you do recognise it as a program you specifically installed please let me know in your next post and do NOT carry out the steps where shown below or include it in the HijackThis fix.

1 - Stop process ** See note above
Using Task Manager, stop the following process
Press the Ctrl, Alt, and Delete keys together to open Task Manager
Click the 'Processes' tab
Click on 'Image Name' to sort the processes alphabetically
Scroll down, right-click and select 'End Process' on the following entry:
TPPOLL.EXE
Close Task Manager

2 - Run HJT Scan
Run a scan with HijackThis and tick the following entry:
O4 - HKLM\..\Run: [TPPOLL] C:\Program Files\TOPRO\TPPOLL.EXE ** See note above
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 85.255.116.137 85.255.112.23

Close all windows except HijackThis
Select Fix Checked in HijackThis.

3 - Delete suspect folder ** See note above
Using Windows Explorer, browse for the following folder and delete as instructed

C:\Program Files\TOPRO <=== This folder only

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

4 - WareOut Fix
Use Windows Explorer to find and double-click on C:\fixwareout\fix-it.bat
The fix will begin; follow the prompts.
You will be asked to reboot your computer; please do so.
Your system may take longer than usual to load; this is normal.

At the end of the fix, you may need to restart your computer again.

Can you please post the contents of the logfile C:\fixwareout\report.txt

5 - Network Settings
Note: This step (5 - Network Settings) is only required if you are experiencing problems connecting to the internet. If you are not having any problems, move on to the next step.
(2000/XP) Only
In the windows control panel (Start > Control Panel), if you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections.
Right-click on your default connection, usually local area connection for cable and dsl, and left click on properties.
Click the Networking tab.
Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot your PC if asked.
Now click on Start > Run and type cmd and click on OK
Type ipconfig /flushdns (note the space after ipconfig and before the /)
Press Enter, type exit at the command prompt, then press enter
The command window will close.

6 - Check on status
After you have completed the above, please reboot and provide:
- the Fixwareout report
- a new HijackThis log

Remember, it's worth printing these instructions out before you start.

Good Luck
Vino
Hello again
Firstly the TOPRO.EXE was my webcam. I have however uninstalled it from my pc and have done a search and nothing seems to be left.
I have also run regscrub xp which cleans up alot of rubbish left behind.
It isn't a problem as I hardly ever use the camera anyway and it always disabled my windows media player.
If I need it in the future I can always re install it.
Ok here goes.
Logs as requested.

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32
And the new hjt log.
Logfile of HijackThis v1.99.1
Scan saved at 07:20:05, on 21/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\JON\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [TPPOLL] C:\Program Files\TOPRO\TPPOLL.EXE
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137692788537
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 85.255.116.137 85.255.112.23
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\program files\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

Thanks once again for your help.
Hi jonregester

We going to take a slightly different approach this time. Please note that it is very important to follow each step one after the other.

1 - Run HJT Scan
Run a scan with HijackThis and tick the following entry:
O4 - HKLM\..\Run: [TPPOLL] C:\Program Files\TOPRO\TPPOLL.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 85.255.116.137 85.255.112.23


Close all windows except HijackThis
Select Fix Checked in HijackThis.

2 - Flush DNS
In the windows control panel (Start > Control Panel), if you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections.
Right-click on your default connection, usually local area connection for cable and dsl, and left click on properties.
Click the Networking tab.
Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot your PC if asked.
Now click on Start > Run and type cmd and click on OK
Type ipconfig /flushdns (note the space after ipconfig and before the /)
Press Enter, type exit at the command prompt, then press enter
The command window will close

3 - Check on status
After you have completed the above, please reboot and provide:
- a new HijackThis log

Good Luck
Vino

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI