What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware, Virus, Trojan? Antivir says no. Spyware? AVG says no.

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hijack this! log: Logfile of HijackThis v1.99.1 Scan saved at 4:33:48 PM, on 1/3/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\Toshiba\TOSHIBA RAID\Console\Kraidman.exe C:\Program Files\TOSHIBA\TOSHIBA Picture Enhancement Utility\TosPEHK.exe C:\Program Files\TOSHIBA\TouchED\TouchED.Exe C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\WINDOWS\system32\00THotkey.exe C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\hijackthis\HijackThis.exe C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe O4 - HKLM\..\Run: [Kraidman] C:\Program Files\Toshiba\TOSHIBA RAID\Console\Kraidman.exe O4 - HKLM\..\Run: [TOSHIBA Picture Enhancement Utility] C:\Program Files\TOSHIBA\TOSHIBA Picture Enhancement Utility\TosPEHK.exe O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SoundMax] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Wireless Hotkey] C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: DCS Loader (DCSLoader) - Oki Data Corporation - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe Original rootkit revealer log (from a couple of days ago) HKLM\SECURITY\Policy\Secrets\SAC* 3/8/2005 2:38 PM 0 bytes Key name contains embedded nulls (*) HKLM\SECURITY\Policy\Secrets\SAI* 3/8/2005 2:38 PM 0 bytes Key name contains embedded nulls (*) HKLM\SOFTWARE 0 bytes Error dumping hive: The system cannot find the file specified. C:\Documents and Settings\All Users\Application Data\Adobe(2) 3/15/2006 9:51 PM 0 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2) 3/15/2006 9:51 PM 0 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2)\Catalog Folders 3/2/2006 11:53 AM 0 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2)\Catalog Folders\My Catalog 3/2/2006 11:53 AM 0 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2)\Catalog Folders\My Catalog\tn.4.cache 3/2/2006 12:14 PM 3.25 MB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2)\Catalogs 3/15/2006 9:51 PM 0 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2)\Catalogs\My Catalog.psa 3/8/2006 11:52 AM 9.66 MB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\All Users\Application Data\Adobe(2)\Photoshop Album(2)\PSASE.dat 3/8/2006 11:44 AM 89 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Cookies\kerry@bitdefender[2].txt 12/29/2006 6:33 PM 122 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Cookies\[removed][2].txt 12/29/2006 7:19 PM 137 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Cookies\kerry@toshibadirect[1].txt 12/29/2006 7:12 PM 518 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Cookies\[removed][2].txt 12/29/2006 7:18 PM 106 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Cookies\[removed][3].txt 12/29/2006 7:20 PM 79 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Cookies\[removed][2].txt 12/29/2006 7:12 PM 100 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Cookies\[removed][2].txt 12/29/2006 7:10 PM 103 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\accessories-over[1].gif 12/29/2006 7:12 PM 456 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\accfinder_go2[1].gif 12/29/2006 7:12 PM 474 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\ads[3].htm 12/29/2006 6:31 PM 5.63 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\ads[4].htm 12/29/2006 6:31 PM 3.79 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\arrow_12[1].gif 12/29/2006 7:15 PM 223 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-global-nav-divit[1].gif 12/29/2006 6:33 PM 193 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-global-nav-left[1].gif 12/29/2006 6:33 PM 507 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-global-nav-mid-hover[1].gif 12/29/2006 6:33 PM 166 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-global-nav-right[1].gif 12/29/2006 6:33 PM 510 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-global-topgradient[1].gif 12/29/2006 6:32 PM 171 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-global-topgradient[2].gif 12/29/2006 6:33 PM 171 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-home-tab-bullet[1].gif 12/29/2006 6:33 PM 47 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\bd-home-tab-buynow[1].png 12/29/2006 6:33 PM 744 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\big_image[1].jpg 12/29/2006 6:33 PM 25.74 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\butt_go_grad[1].gif 12/29/2006 7:19 PM 232 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\butt_go_grad[2].gif 12/29/2006 7:19 PM 232 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\butt_vote[1].gif 12/29/2006 7:19 PM 274 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\button_cancel_all_102x26[1].gif 12/29/2006 7:18 PM 1.75 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\button_save_63x26[1].gif 12/29/2006 7:18 PM 1.54 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\clr[1].gif 12/29/2006 7:19 PM 48 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\cm[1].gif 12/29/2006 7:10 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\Common[1].css 12/29/2006 7:19 PM 0 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\comms_center_70x70[1].gif 12/29/2006 7:15 PM 3.84 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\computers-over[1].gif 12/29/2006 7:12 PM 412 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\CSG_styles[1].css 12/29/2006 7:10 PM 3.10 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\css_menu[1].js 12/29/2006 6:33 PM 393 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\dot_black[1].gif 12/29/2006 7:20 PM 810 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\dot_clear[1].gif 12/29/2006 7:15 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\down[1] 12/29/2006 5:55 PM 3.33 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\dynprice[1].htm 12/29/2006 7:12 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\electronics[1].gif 12/29/2006 7:12 PM 305 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\eluminate[1].js 12/29/2006 7:10 PM 13.28 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\favicon[1].ico 12/29/2006 7:10 PM 318 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\goBtn_HHO[1].gif 12/29/2006 7:10 PM 459 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\hint[1] 12/29/2006 6:33 PM 11 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\home[1].htm 12/29/2006 7:10 PM 31.56 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\icon_1[1].gif 12/29/2006 7:19 PM 135 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\icon_2[1].gif 12/29/2006 7:19 PM 197 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\icon_bottom[1].gif 12/29/2006 7:19 PM 68 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\my_account[1].gif 12/29/2006 7:10 PM 107 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\my_toshiba_75x70[1].gif 12/29/2006 7:20 PM 4.25 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\nav_curve2[1].gif 12/29/2006 7:12 PM 52 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\nav_howtobuy[1].jpg 12/29/2006 7:12 PM 1.21 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\nav_learningcenter[1].jpg 12/29/2006 7:12 PM 1.39 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\navDivider_black[1].jpg 12/29/2006 7:12 PM 429 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\one_pixel_bar[1].gif 12/29/2006 7:19 PM 1.19 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\pic_icon[1].gif 12/29/2006 7:19 PM 199 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\prodNavBG[1].gif 12/29/2006 7:10 PM 198 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\repost[1] 12/29/2006 6:31 PM 4.79 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\scriptFile[1].aspx 12/29/2006 7:19 PM 8.25 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\search[2].htm 12/29/2006 6:31 PM 21.72 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\segmentNavBG[1].gif 12/29/2006 7:10 PM 359 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\su_sc_notifyLogin[1].htm 12/29/2006 7:18 PM 1.78 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\tabLabelBG[1].gif 12/29/2006 7:10 PM 94 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\ToshibaLogin[1].htm 12/29/2006 7:21 PM 5.15 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\ToshibaSupport[1].ico 12/29/2006 7:16 PM 1.37 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\ul_logo_115_18[1].gif 12/29/2006 7:15 PM 2.15 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\us[1].gif 12/29/2006 7:10 PM 85 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\viewlet[1].js 12/29/2006 7:18 PM 975 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\15HWRLTA\warr_center_70x70[1].gif 12/29/2006 7:15 PM 3.79 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\22[1].gif 12/29/2006 7:12 PM 2.14 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\50_5thgoogle[1].js 12/29/2006 7:19 PM 248 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\accessories-down[1].gif 12/29/2006 7:12 PM 475 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\activity;src=1000873;type=tdcom487;cat=tdcom588;ord=1;num=4536001139414[1].gif 12/29/2006 7:10 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\ads[1].htm 12/29/2006 6:31 PM 6.38 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\ads[2].htm 12/29/2006 6:31 PM 4.15 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\ads[3].htm 12/29/2006 7:19 PM 4.15 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\at[1].gif 12/29/2006 7:19 PM 67 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\background_gradient[1] 12/29/2006 5:35 PM 453 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\bd-global-nav-mid[1].gif 12/29/2006 6:33 PM 166 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\bd-home-tab-botg[1].gif 12/29/2006 6:33 PM 160 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\bd-home-tab-bulletarrow[1].gif 12/29/2006 6:33 PM 296 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\bd-home-tab-scannow[1].gif 12/29/2006 6:33 PM 987 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\bd-home-tab-topg[1].gif 12/29/2006 6:33 PM 160 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\blog_controls[1].css 12/29/2006 5:59 PM 750 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\button_add_122x26[1].gif 12/29/2006 7:18 PM 1.88 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\button_continue_red[1].gif 12/29/2006 7:20 PM 1.69 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\c[1].gif 12/29/2006 7:19 PM 43 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\computers-down[1].gif 12/29/2006 7:12 PM 434 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\curve_topleft[1].gif 12/29/2006 7:12 PM 177 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\default[1].js 12/29/2006 6:32 PM 10.57 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\dot_clear[1].gif 12/29/2006 7:17 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\dot_clear[2].gif 12/29/2006 7:19 PM 43 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\dot_gray[1].gif 12/29/2006 7:15 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\eluminate[1].gif 12/29/2006 7:10 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\eluminate[2].gif 12/29/2006 7:12 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\eluminate[3].gif 12/29/2006 7:15 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\embed_flash[1].js 12/29/2006 7:10 PM 5.71 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\errorPageStrings[1] 12/29/2006 6:31 PM 850 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\ErrorPageTemplate[1] 12/29/2006 5:55 PM 2.12 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\flag_16_11[1].gif 12/29/2006 7:15 PM 996 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\forum[1].css 12/29/2006 7:19 PM 22.80 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\forum[1].htm 12/29/2006 7:19 PM 45.99 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\global[1].js 12/29/2006 6:33 PM 3.06 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\home-mast-homeoffice[1].png 12/29/2006 6:33 PM 1.40 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\icon18_edit_allbkg[1].gif 12/29/2006 6:20 PM 162 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\icon_3[1].gif 12/29/2006 7:19 PM 201 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\icon_4[1].gif 12/29/2006 7:19 PM 140 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\icon_accessories[1].gif 12/29/2006 7:10 PM 1.81 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\icon_laptops[1].gif 12/29/2006 7:10 PM 2.32 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\icon_middle[1].gif 12/29/2006 7:19 PM 52 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\imgad[1].png 12/29/2006 6:31 PM 1.52 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\info_48[1] 12/29/2006 6:31 PM 6.83 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\lft_nav_view_arrow[1].gif 12/29/2006 7:10 PM 301 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\main[1].css 12/29/2006 6:33 PM 46.71 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\MAIN_styles[1].css 12/29/2006 7:10 PM 14.23 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\mbox[1].js 12/29/2006 7:10 PM 17.41 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\protectypc_ad_120x60[1].gif 12/29/2006 7:16 PM 3.80 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\repair_center_70x70[1].gif 12/29/2006 7:15 PM 3.33 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\seeAllPromotions_185x58[1].gif 12/29/2006 7:12 PM 6.02 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\sIFR-screen[1].css 12/29/2006 6:33 PM 3.50 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\signUpForSpecials[1].gif 12/29/2006 7:12 PM 7.59 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\standard[1] 12/29/2006 7:12 PM 345 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\su_navShell[1].htm 12/29/2006 7:20 PM 35.35 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\su_sc_notifyLogin[1].htm 12/29/2006 7:17 PM 36.46 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\su_sc_outFrm[1].htm 12/29/2006 7:20 PM 3.66 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\su_sc_pubProfile[1].htm 12/29/2006 7:18 PM 35.43 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\tabletPC[1].gif 12/29/2006 7:10 PM 4.28 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\techprops[1].js 12/29/2006 7:10 PM 926 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\thinNetscapeToolbar101105[1].gif 12/29/2006 7:19 PM 3.83 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\ToshibaStyles[1].css 12/29/2006 7:15 PM 9.49 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\ui_helpIcon[1].gif 12/29/2006 7:12 PM 397 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\winter_01[1].swf 12/29/2006 6:33 PM 26.35 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\A592GF51\wug3[1].gif 12/29/2006 7:19 PM 4.30 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\aboutus[1].htm 12/29/2006 7:12 PM 45.61 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\ads[3].htm 12/29/2006 6:31 PM 2.32 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\adsWrapper[1].js 12/29/2006 7:19 PM 6.44 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\ask_iris_70x70[1].gif 12/29/2006 7:15 PM 3.81 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\background_gradient[1] 12/29/2006 6:31 PM 453 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\bd-global-nav-left-on[1].gif 12/29/2006 6:33 PM 451 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\bg_article[1].jpg 12/29/2006 6:31 PM 4.45 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\blog_controls[1].css 12/29/2006 6:20 PM 750 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\bullet[1] 12/29/2006 6:31 PM 3.09 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\button_go_red_44x24[1].gif 12/29/2006 7:18 PM 1.50 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\button_link_black[1].gif 12/29/2006 7:15 PM 167 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\button_log_in_72x26[1].gif 12/29/2006 7:17 PM 1.60 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\button_remove_122x26[1].gif 12/29/2006 7:18 PM 1.80 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\clr[1].gif 12/29/2006 7:19 PM 48 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\cmdatatagutils[1].inc 12/29/2006 7:10 PM 22.57 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\countries[1].js 12/29/2006 6:33 PM 22.34 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\cutie-is10[1].jpg 12/29/2006 6:33 PM 5.82 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\dot_clear[1].gif 12/29/2006 7:19 PM 43 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\download_circle_75x70[1].gif 12/29/2006 7:15 PM 4.08 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\ds[1].aspx 12/29/2006 7:19 PM 10.77 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\ErrorPageTemplate[1] 12/29/2006 6:31 PM 2.12 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\favicon[4].ico 12/29/2006 6:33 PM 1.12 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\favicon[5].ico 12/29/2006 7:18 PM 318 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\FixedLayerManager[1].js 12/29/2006 6:33 PM 6.37 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\FT_gaming[1].gif 12/29/2006 7:10 PM 6.41 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\google[1].gif 12/29/2006 7:19 PM 1.68 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\HHO_styles[1].css 12/29/2006 7:12 PM 1.42 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\home-mast-enterprise[1].png 12/29/2006 6:33 PM 1.10 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\home-mast-smallbusiness[1].png 12/29/2006 6:33 PM 1.28 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\home[1].htm 12/29/2006 6:33 PM 21.76 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\httpErrorPagesScripts[1] 12/29/2006 5:55 PM 6.81 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\icon_5[1].gif 12/29/2006 7:19 PM 198 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\icon_HHO[1].gif 12/29/2006 7:10 PM 3.01 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\icon_mag[1].gif 12/29/2006 7:19 PM 779 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\icon_SMB[1].gif 12/29/2006 7:10 PM 3.12 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\info_48[1] 12/29/2006 5:35 PM 6.83 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\logo[1].gif 12/29/2006 7:10 PM 1.40 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\menuhov_bg[1].gif 12/29/2006 6:32 PM 161 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\mytoshiba_banner_120x60[1].gif 12/29/2006 7:16 PM 47.29 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\nav_accessories[1].jpg 12/29/2006 7:12 PM 1.25 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\nav_bg[1].jpg 12/29/2006 7:12 PM 328 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\nav_curve1[1].gif 12/29/2006 7:10 PM 190 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\nav_notebooks[1].jpg 12/29/2006 7:12 PM 1.13 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\orange_arrow[1].gif 12/29/2006 7:19 PM 55 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\order_status[1].gif 12/29/2006 7:10 PM 108 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\projectors-over[1].gif 12/29/2006 7:12 PM 407 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\search[2].htm 12/29/2006 5:34 PM 21.72 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\seeAllPromos_185x74[1].gif 12/29/2006 7:10 PM 5.17 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\serviceSupport-over[1].gif 12/29/2006 7:12 PM 632 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\ShopToshibaStyles[1].css 12/29/2006 7:15 PM 71.97 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\spacer[1].gif 12/29/2006 7:12 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\spacer[2].gif 12/29/2006 7:19 PM 43 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\su_sc_docFrmTop[1].htm 12/29/2006 7:20 PM 9.59 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\su_sc_home[1].htm 12/29/2006 7:15 PM 49.72 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\su_sc_modSel[1].htm 12/29/2006 7:19 PM 68.08 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\tabCorner_right_15x21[1].gif 12/29/2006 7:10 PM 358 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\td_dynamic_cnt[1].js 12/29/2006 7:12 PM 2.90 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\texts[1].css 12/29/2006 6:33 PM 2.72 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\thinNetscapeBg[1].gif 12/29/2006 7:19 PM 74 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\threat-box-li[1].gif 12/29/2006 6:33 PM 45 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\threat-box[1].gif 12/29/2006 6:33 PM 6.97 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\ToshibaLogin[1].htm 12/29/2006 7:20 PM 4.50 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\urchin[1].js 12/29/2006 7:10 PM 19.04 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\warr_umbrella_75x70[1].gif 12/29/2006 7:20 PM 4.04 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\www.bitdefender[1].com 12/29/2006 6:33 PM 22.19 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\WV33A39E\x[2].gif 12/29/2006 7:19 PM 43 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\activity;src=1000873;type=tdcom487;cat=tdcom588;num=9907668;ord=1[1].gif 12/29/2006 7:10 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\ads[4].htm 12/29/2006 6:31 PM 1.76 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\adsEnd[1].js 12/29/2006 7:19 PM 1.57 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\all_new_go_red[1].gif 12/29/2006 7:19 PM 1.38 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\bd-global-nav-right-on[1].gif 12/29/2006 6:33 PM 447 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\bd-global-toplogo[1].gif 12/29/2006 6:32 PM 3.79 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\bd-home-tab-rss[1].gif 12/29/2006 6:33 PM 479 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\BMLleftNav[1].jpg 12/29/2006 7:12 PM 3.96 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\bullet[1] 12/29/2006 5:35 PM 3.09 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\bullet_gtgray[1].gif 12/29/2006 7:12 PM 57 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\butt_go_wh[1].gif 12/29/2006 7:19 PM 232 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\button_clear_list_122x26[1].gif 12/29/2006 7:18 PM 1.89 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\button_link_grey[1].gif 12/29/2006 7:15 PM 126 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\button_register_90x26[1].gif 12/29/2006 7:17 PM 1.72 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\comms_contact_75x70[1].gif 12/29/2006 7:19 PM 3.79 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\cookies[1].js 12/29/2006 6:33 PM 129 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\css_menu[1].js 12/29/2006 6:33 PM 393 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\curve_bottomleft[1].gif 12/29/2006 7:12 PM 90 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\digicamera40x50[1].jpg 12/29/2006 7:19 PM 1.03 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\discuss_icon[1].gif 12/29/2006 7:19 PM 148 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\dot_clear[1].gif 12/29/2006 7:20 PM 43 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\dot_grey[1].gif 12/29/2006 7:15 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\dot_white[1].gif 12/29/2006 7:15 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\dots2[1].gif 12/29/2006 6:33 PM 1.84 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\down-arrow[1].gif 12/29/2006 6:33 PM 1.00 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\down[1] 12/29/2006 6:31 PM 3.33 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\eluminate[1].gif 12/29/2006 7:12 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\eluminate[2].gif 12/29/2006 7:12 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\errorPageStrings[1] 12/29/2006 5:55 PM 850 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\favicon[1].ico 12/29/2006 7:20 PM 318 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\global-threatlevel-1[1].png 12/29/2006 6:33 PM 765 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\home-mast-isp[1].png 12/29/2006 6:33 PM 3.34 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\home_tablet[1].swf 12/29/2006 7:10 PM 204.04 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\httpErrorPagesScripts[1] 12/29/2006 6:31 PM 6.81 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icfc[1].gif 12/29/2006 7:19 PM 224 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icon18_edit_allbkg[1].gif 12/29/2006 5:58 PM 162 bytes Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icon_ENT[1].gif 12/29/2006 7:10 PM 3.46 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icon_projectors[1].gif 12/29/2006 7:10 PM 2.33 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icon_PSE[1].gif 12/29/2006 7:10 PM 3.46 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icon_support[1].gif 12/29/2006 7:10 PM 2.06 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\icon_top[1].gif 12/29/2006 7:19 PM 98 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\imgad[1].png 12/29/2006 6:31 PM 1.52 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\lb[1].gif 12/29/2006 7:10 PM 49 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\Main[1].js 12/29/2006 6:33 PM 4.81 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\moresearches[1].gif 12/29/2006 7:19 PM 133 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\nav_customercare[1].jpg 12/29/2006 7:12 PM 1.38 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\nav_entertainment[1].jpg 12/29/2006 7:12 PM 1.33 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\new_curve[1].gif 12/29/2006 7:10 PM 98 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\orange_arrow[1].gif 12/29/2006 7:19 PM 55 bytes Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\projectors-down[1].gif 12/29/2006 7:12 PM 427 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\serviceSupport-down[1].gif 12/29/2006 7:12 PM 632 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\shopping_cart[1].gif 12/29/2006 7:10 PM 113 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\spacer[1].gif 12/29/2006 7:10 PM 43 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\style[1].css 12/29/2006 6:32 PM 46.21 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\su_navShell[1].htm 12/29/2006 7:19 PM 31.41 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\su_navShell[2].htm 12/29/2006 7:19 PM 32.40 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\su_sc_notifyList[1].htm 12/29/2006 7:18 PM 102.14 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\su_sc_notifyList[2].htm 12/29/2006 7:18 PM 102.14 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\subpage-nav-subnav-bg[1].png 12/29/2006 6:33 PM 429 bytes Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\support_center_70x70[1].gif 12/29/2006 7:15 PM 3.68 KB Hidden from Windows API. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M16\support_updates_75x70[1].gif 12/29/2006 7:19 PM 3.67 KB Visible in directory index, but not Windows API or MFT. C:\Documents and Settings\Ricardo\Local Settings\Temporary Internet Files\Content.IE5\YLBJ1M1
Post #2
I am so over it. I got my computer back from a "friend" and now it's not working right. I removed the bearshare the idiot put on it and some other viruses that have popped up through using different antivirus solutions.

But I'm still having the following problems:

Windows Explorer (taskbar anyway) freezes up. I have to manually end and restart it through the task manager every 15 minutes. (sometimes shorter, sometimes longer). When I boot the computer, it says there is no paging file, even though i've set it dozens of times in dozens of different combinations. When I run a virus scan (like antivir) or a malware scan (like windows defender) I watch the taskmanager and cmd.exe keeps popping up every couple of seconds while the scan is running or I'm receiving an update from the internet. Once, when I ran Rootkit Revealer it said that a process running cmd.exe was keeping rootkit revealer from scanning or running properly. Something like that. And I see ipconfig run too, but from what I can tell, my ip is not being renewed or anything. Has whatever it is embedded itself as a process?

Thank you for any help you can give. BTW, I don't speak with that "friend" anymore :)

Kerry

Logfile of HijackThis v1.99.1
Scan saved at 8:13:21 PM, on 1/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\APLicensing.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Toshiba\TOSHIBA RAID\Console\Kraidman.exe
C:\Program Files\TOSHIBA\TOSHIBA Picture Enhancement Utility\TosPEHK.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\00THotkey.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe
C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Kraidman] C:\Program Files\Toshiba\TOSHIBA RAID\Console\Kraidman.exe
O4 - HKLM\..\Run: [TOSHIBA Picture Enhancement Utility] C:\Program Files\TOSHIBA\TOSHIBA Picture Enhancement Utility\TosPEHK.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB
O4 - HKCU\..\Run: [WengoPhoneNG] C:\Program Files\WengoPhone\qtwengophone.exe -b
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by23fd.bay23.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Audio Pack Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\APLicensing.exe
O23 - Service: DCS Loader (DCSLoader) - Oki Data Corporation - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


I ran rootkit revealer again, but when i go to save the discrepencies, the computer freezes up
Post #3 last edited
kerry111 :D

Welcome to Tom Coyote . Sorry about the delay in responding but we are as most times just overwhelmed with logs.

I am not looking at anything real bad on your log, not to say something could be hidden and not showing up. Lets do a few things. CMD could be a problem but I don't see it on your log.


There are infections being written to evade Hijackthis, so go to where you have HJT installed and right click on the HJT Icon [external image: Posted Image] and rename it to Scanner.exe, run the program to Scan and Save a Log File and post a new log into this thread.



Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.




  • Click Start>Run
  • Type in sfc /scannow, hit Enter.
  • Note: there is a space between sfc and /scannow
  • This should replace any corrupted/missing system files and will hopefully fix things.
    You may need your XP disc in your CD drive for this.




Download and install the 30 day trial of AVG Anti-Spyware 7.5 to your desktop.
  • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
Tutorial if you need it How to boot into Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG Anti-Spyware 7.5



Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
If you cant run AVG or it turns up nothing, this may well be a windows problem and at that point I can direct you to some windows support sites.

Tell ya what, no one and I mean no one except my wife and I use my computer, leaving it up for grabs is a carp** shoot. :rant2:

Let me see the AVG Log and a new HJT log renamed please.
Post #4
Thank you so much for responding. Okay, did the first step, renamed hjt to scanner and here's the logfile:

Logfile of HijackThis v1.99.1
Scan saved at 8:56:04 PM, on 1/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\TOSHIBA Picture Enhancement Utility\TosPEHK.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\00THotkey.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TOSHIBA\ConfigFree\CFXFER.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Scanner\Scanner.exe

O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TOSHIBA Picture Enhancement Utility] C:\Program Files\TOSHIBA\TOSHIBA Picture Enhancement Utility\TosPEHK.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Scanner\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DCS Loader (DCSLoader) - Oki Data Corporation - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

**I ran fsecure.com scan and it said that it could not scan C:\hiberfile.sys; C:\WINDOWS\SYSTEM32\temppf.sys; and a couple of registry keys (it wouldn't let me copy the results)

and i opened my ntldr to check for anything strange. see if this looks weird:


term keyboard pointer print monitor modem other audio key point par video net serial worm tape dti tc sc sdc sic pdc pic fpu cpu arc C üC ôC ìC äC ÜC ÔC ÌC ÄC ¼C ´C ¬C ¤C œC ”C ŒC „C |C tC lC \Device\Harddisk %s%s(%d)%s(%d)%s(%d) \Device\Floppy \Device\CDRom %s%s(%d)%s(%d) C üC ôC ìC äC ÜC ÔC ÌC ÄC ¼C ´C ¬C ¤C œC ”C ŒC „C |C tC lC partition(0)

last night it said something about monitor controller … worm controller

I'm about to run the ATF-Cleaner

Thank you again. K
Post #5
kerry111, Even with HJT renamed, your log still looks fine. C:\hiberfile.sys; C:\WINDOWS\SYSTEM32\temppf.sys <– these have to do with your paging file and for when your system goes into hibernation. Lets see what AVG turns up, this friend messed up your system real well :rant2:
Post #6
Here's the avg scan in safe mode: ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 10:36:42 PM 1/12/2007 + Scan result: Nothing found. ::Report end found the thing in ntldr S e r i a l C o n t r o l l e r W o r m C o n t r o l l e r C d R o m C o n t r o l l e r The temporary pagefile thing doesn't seem to be happening anymore. And my explorer/taskbar isn't freezing-up in 5 minutes. It didn't at all in safe mode and it hasn't yet since i've rebooted. And CMD.exe isn't popping up now when I do a virus scan. I used the online scanner and cleaner on f-secure.com last night and it found 4 infections and cleaned them. is ctfmon.exe necessary? I've tried to disable it because I rarely if ever use MSOffice, but it keeps coming back. On Rootkit revealer, it shows: HKLM\SECURITY\Policy\Secrets\SAC* HKLM\SECURITY\Policy\SAI* HKLM\SOFTWARE (Error dumping hive. The system cannot find the file specified.) *Key name contains embedded nulls
Post #7
Good Morning Kerry :D

This has to do with your boot up and I believe is legit. Windows is loading these controllers at bootup.
ntldr
S e r i a l C o n t r o l l e r W o r m C o n t r o l l e r C d R o m C o n t r o l l e r



This is normal behaviour and need not be cause for alarm.
HKLM\Security\Policy\Secrets\SAC*
HKLM\Security\Policy\Secrets\SAI*



This one is harmless and best left alone.

ctfmon.exe is a process belonging to Microsoft Office Suite. It activates the Alternative User Input Text Input Processor (TIP) and the
Microsoft Office XP Language Bar. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.


If it is causing you problems, you can remove it with HJT
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

If it does cause you problems by removing it, you can always restore it.
To restore the backups:
  • Open HiJackThis
  • Click on "View the list of Backups"
  • Place a check mark next to anything you want to restore
  • Click Restore
  • Click Yes
  • Reboot your computer


Leave your system on and let it run for most of the day trying different programs now and then and post back and let me know how its doing. If needed I will direct you to some windows support sites that can help you straighten out your system.
Post #8
This topic is being closed due to lack of response, if you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI