What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

tried everything - plz help!

31 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi a week ago i downloaded this thing called youTube downloader so i could save video's off YouTube - straight after that when using IE for the web i started recieving an unimaginable amount of pop ups!!! my friends said to use Spybot Search and Destroy and it lists things and 'fixes' them but everything still stays there, eventually another friend said to delete everything from the date of download from my System32 file, eventually i got a link to Hijack this and this website but i ran Hijack this 1st and deleted stuff i didnt recognise and everything keeps coming back - i dont know how to keep them gone Can anyone plz help? i cant believe there can be so many pop ups and IE can keep functioning - if nothing else my mouse will quit working on me from closing all the windows at such a massive rate!!! plz i'm totally distraught!
Post #2
Logfile of HijackThis v1.99.1
Scan saved at 9:25:42 PM, on 12/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\secures3.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\DesktopEarth\DesktopEarth.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\autosys.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\autosys.exe
C:\WINDOWS\system32\autosys.exe
C:\WINDOWS\system32\autosys.exe
C:\WINDOWS\system32\autosys.exe
C:\WINDOWS\system32\autosys.exe
C:\Xfire\Xfire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\Rar$EX00.731\HijackThis.exe
C:\WINDOWS\system32\autosys.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\NortonBETA\osCheck.exe"
O4 - HKLM\..\Run: [SvcManager] secures3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [37] "C:\WINDOWS\system32\37.exe"
O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe"
O4 - HKCU\..\Run: [96] "C:\WINDOWS\system32\96.exe"
O4 - HKCU\..\Run: [FJDR] "C:\WINDOWS\system32\FJDR.exe"
O4 - HKCU\..\Run: [MJUM] "C:\Documents and Settings\Mustainer\MJUM.exe"
O4 - HKCU\..\Run: [ISPP] "C:\Documents and Settings\Mustainer\ISPP.exe"
O4 - HKCU\..\Run: [TJOR] "C:\Documents and Settings\Mustainer\TJOR.exe"
O4 - HKCU\..\Run: [FKKJ] "C:\Documents and Settings\Mustainer\FKKJ.exe"
O4 - HKCU\..\Run: [BNGA] "C:\Documents and Settings\Mustainer\BNGA.exe"
O4 - HKCU\..\Run: [AITM] "C:\Documents and Settings\Mustainer\AITM.exe"
O4 - HKCU\..\Run: [BSSU] "C:\Documents and Settings\Mustainer\BSSU.exe"
O4 - HKCU\..\Run: [LCRT] "C:\Documents and Settings\Mustainer\LCRT.exe"
O4 - HKCU\..\Run: [BQPM] "C:\Documents and Settings\Mustainer\BQPM.exe"
O4 - HKCU\..\Run: [JTBN] "C:\Documents and Settings\Mustainer\JTBN.exe"
O4 - HKCU\..\Run: [FKJK] "C:\Documents and Settings\Mustainer\FKJK.exe"
O4 - HKCU\..\Run: [UDBO] "C:\Documents and Settings\Mustainer\UDBO.exe"
O4 - HKCU\..\Run: [BDEM] "C:\Documents and Settings\Mustainer\BDEM.exe"
O4 - HKCU\..\Run: [DTQT] "C:\Documents and Settings\Mustainer\DTQT.exe"
O4 - HKCU\..\Run: [WinInit] "C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\1014548.exe "
O4 - HKCU\..\Run: [TDNI] "C:\WINDOWS\system32\TDNI.exe"
O4 - HKCU\..\Run: [JRKC] "C:\WINDOWS\system32\JRKC.exe"
O4 - HKCU\..\Run: [ECLC] "C:\Documents and Settings\Mustainer\ECLC.exe"
O4 - HKCU\..\Run: [NEKF] "C:\Documents and Settings\Mustainer\NEKF.exe"
O4 - HKCU\..\Run: [KKAC] "C:\Documents and Settings\Mustainer\KKAC.exe"
O4 - HKCU\..\Run: [RNCN] "C:\Documents and Settings\Mustainer\RNCN.exe"
O4 - HKCU\..\Run: [DGJS] "C:\Documents and Settings\Mustainer\DGJS.exe"
O4 - Global Startup: DesktopEarth AutoStart.lnk = ?
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bejeweled…ploader_v10.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: browsewm.exe - Unknown owner - C:\WINDOWS\system32\browsewm.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: d3dx9_24.exe - Unknown owner - C:\WINDOWS\system32\d3dx9_24.exe
O23 - Service: dsquery.exe - Unknown owner - C:\WINDOWS\system32\dsquery.exe (file missing)
O23 - Service: dtu100.exe - Unknown owner - C:\WINDOWS\system32\dtu100.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: ipsecsnp.exe - Unknown owner - C:\WINDOWS\system32\ipsecsnp.exe (file missing)
O23 - Service: ipxpromn.exe - Unknown owner - C:\WINDOWS\system32\ipxpromn.exe (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\NortonBETA\isPwdSvc.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mcicda.exe - Unknown owner - C:\WINDOWS\system32\mcicda.exe (file missing)
O23 - Service: mqupgrd.exe - Unknown owner - C:\WINDOWS\system32\mqupgrd.exe (file missing)
O23 - Service: msrecr40.exe - Unknown owner - C:\WINDOWS\system32\msrecr40.exe (file missing)
O23 - Service: resutils.exe - Unknown owner - C:\WINDOWS\system32\resutils.exe
O23 - Service: sfcfiles.exe - Unknown owner - C:\WINDOWS\system32\sfcfiles.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: syntpfcs.exe - Unknown owner - C:\WINDOWS\system32\syntpfcs.exe
O23 - Service: wintrust.exe - Unknown owner - C:\WINDOWS\system32\wintrust.exe
Post #3
Welcome to the forum

Clean out temp files:

Download and run ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then click "empty selected" That will clear out all the temp files on the system.

—————————–

Next…..

Download combofix.exe from one of the links below:

http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/combofix.exe

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

—————-

Next:

Please download SUPERAntiSpyware Home Edition (free)

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click "Yes",
Let it through your firewall!
Under "Configuration and Preferences", click the "Preferences" button.
Click the "Scanning Control" tab.
Under "Scanner Options" make sure the following are checked:
1>> Close browsers before scanning
2>> Scan for tracking cookies
3>> Terminate memory threats before quarantining.
4>> Ignore System Restore/Volume Information on ME and XP
5>> Please leave the others unchecked.
6>> Click the Close button to leave the control center screen.

On the main screen, under "Scan for Harmful Software" click "Scan your
computer".
On the left check "C:\Fixed Drive".
On the right, under "Complete Scan", choose "Perform Complete Scan".
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click "OK".
Make sure everything in the white box has a check next to it, then click "Next".
It will quarantine what it found and if it asks if you want to reboot, click
"Yes".

To retrieve the removal information - please do the following:
1>> After reboot, double-click the "SUPERAntispyware icon" on your desktop.
2>> Click "Preferences". Click the "Statistics/Logs tab".
3>> Under "Scanner Logs", double-click "SUPERAntiSpyware Scan Log".
4>> It will open in your default text editor (such as Notepad/Wordpad).
5>> Please highlight everything , then right-click and choose copy.
6>> Click close and close again to exit the program.

Now please paste the "removal information" along with a fresh "HijackThis log" and the log from ComboFix in your reply. If it's a large log, you may need several replies to post it.
Good Luck, MrC
Post #4
Hi MrC Thx for taking time with my problem heres the combofix report pt 1 "Mustainer" - 07-01-13 19:13:11 Service Pack 2 ComboFix 07-01-14 - Running from: "C:\Documents and Settings\Mustainer\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-12-13 to 2007-01-13 )))))))))))))))))))))))))))))))))) 2007-01-13 12:55 d——– C:\PowerISO 2007-01-12 23:23 19,968 –a—— C:\DOCUME~1\MUSTAI~1\UHSG.exe 2007-01-12 23:17 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KQQQ.exe 2007-01-12 23:17 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FIJR.exe 2007-01-12 23:17 d——– C:\DOCUME~1\MUSTAI~1\Application Data\Viewpoint 2007-01-12 23:13 19,968 –a—— C:\DOCUME~1\MUSTAI~1\SFSL.exe 2007-01-12 23:10 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DFMH.exe 2007-01-12 23:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ODJD.exe 2007-01-12 23:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IIMI.exe 2007-01-12 23:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BRJP.exe 2007-01-12 23:05 19,968 –a—— C:\DOCUME~1\MUSTAI~1\OHRK.exe 2007-01-12 23:05 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JQIQ.exe 2007-01-12 23:02 3,105 –a—— C:\WINDOWS\system32\loadadv559.exe 2007-01-12 23:02 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QJJS.exe 2007-01-12 23:02 1,024 –a—— C:\yjvpq.exe 2007-01-12 22:57 19,968 –a—— C:\DOCUME~1\MUSTAI~1\SFIU.exe 2007-01-12 22:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MAQK.exe 2007-01-12 22:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KOCM.exe 2007-01-12 22:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DFPQ.exe 2007-01-12 22:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EHQT.exe 2007-01-12 22:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KIMD.exe 2007-01-12 22:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JOLK.exe 2007-01-12 22:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DGCF.exe 2007-01-12 22:48 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BSHQ.exe 2007-01-12 22:47 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KOQD.exe 2007-01-12 22:44 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FUNQ.exe 2007-01-12 22:43 19,968 –a—— C:\DOCUME~1\MUSTAI~1\OOJC.exe 2007-01-12 22:43 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ILAQ.exe 2007-01-12 22:42 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TFLR.exe 2007-01-12 22:42 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MHPM.exe 2007-01-12 22:42 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EPEK.exe 2007-01-12 22:35 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MGRF.exe 2007-01-12 22:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QGHB.exe 2007-01-12 22:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GHIL.exe 2007-01-12 22:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CLKF.exe 2007-01-12 22:33 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CPLI.exe 2007-01-12 22:25 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LMDJ.exe 2007-01-12 22:25 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AHER.exe 2007-01-12 22:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GSRP.exe 2007-01-12 22:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HNQE.exe 2007-01-12 22:18 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IEGI.exe 2007-01-12 22:16 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IQTK.exe 2007-01-12 22:13 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CECU.exe 2007-01-12 22:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GGUF.exe 2007-01-12 22:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PGUR.exe 2007-01-12 22:06 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RHPH.exe 2007-01-12 22:03 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FHTB.exe 2007-01-12 21:59 19,968 –a—— C:\DOCUME~1\MUSTAI~1\STOC.exe 2007-01-12 21:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EURN.exe 2007-01-12 21:54 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LCUO.exe 2007-01-12 21:52 d——– C:\adawareSELavasoft 2007-01-12 21:48 19,968 –a—— C:\DOCUME~1\MUSTAI~1\SKTQ.exe 2007-01-12 21:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PGIK.exe 2007-01-12 21:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PCMQ.exe 2007-01-12 21:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KOOF.exe 2007-01-12 21:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JSFB.exe 2007-01-12 21:45 19,968 –a—— C:\DOCUME~1\MUSTAI~1\THQC.exe 2007-01-12 21:45 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JIFP.exe 2007-01-12 21:45 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ERSQ.exe 2007-01-12 21:42 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KEHA.exe 2007-01-12 21:33 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JJEC.exe 2007-01-12 21:27 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ARTR.exe 2007-01-12 21:22 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FQHK.exe 2007-01-12 21:20 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PUCT.exe 2007-01-12 21:14 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TROR.exe 2007-01-12 21:06 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QAUJ.exe 2007-01-12 21:01 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DGJS.exe 2007-01-12 20:57 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TGRN.exe 2007-01-12 20:55 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NEOU.exe 2007-01-12 20:51 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ELSH.exe 2007-01-12 20:48 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FAQM.exe 2007-01-12 20:47 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KIUQ.exe 2007-01-12 20:38 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HAPO.exe 2007-01-12 20:27 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FLAD.exe 2007-01-12 20:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GSUR.exe 2007-01-12 20:16 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DGQP.exe 2007-01-12 20:15 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NOSC.exe 2007-01-12 20:15 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JTMG.exe 2007-01-12 20:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ANUA.exe 2007-01-12 20:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FFSP.exe 2007-01-12 20:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CSIA.exe 2007-01-12 20:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GFJT.exe 2007-01-12 20:03 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BRQH.exe 2007-01-12 20:00 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RNCN.exe 2007-01-12 19:57 42,801 –a—— C:\WINDOWS\system32\secures3.exe 2007-01-12 19:57 42,801 –a—— C:\pydmjr.exe 2007-01-12 19:57 1,024 –a—— C:\xrskp.exe 2007-01-12 19:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KKAC.exe 2007-01-12 19:48 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EGSA.exe 2007-01-12 19:47 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KHFO.exe 2007-01-12 19:43 19,968 –a—— C:\DOCUME~1\MUSTAI~1\OSLR.exe 2007-01-12 19:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TNMQ.exe 2007-01-12 19:38 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MKUH.exe 2007-01-12 19:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JDRN.exe 2007-01-12 19:29 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NEKF.exe 2007-01-12 19:26 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FABF.exe 2007-01-12 19:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TQIU.exe 2007-01-12 19:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\STUM.exe 2007-01-12 19:23 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EIDH.exe 2007-01-12 19:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TRDF.exe 2007-01-12 19:18 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RJPM.exe 2007-01-12 19:14 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JOBT.exe 2007-01-12 19:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LRHR.exe 2007-01-12 19:06 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RPCJ.exe 2007-01-12 19:02 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ECLC.exe 2007-01-12 18:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IDMQ.exe 2007-01-12 18:45 19,968 –a—— C:\DOCUME~1\MUSTAI~1\SRIF.exe 2007-01-12 16:47 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KURC.exe 2007-01-12 16:41 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ULLQ.exe 2007-01-12 16:40 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QQMS.exe 2007-01-12 15:45 d——– C:\Program Files\nortonBETA 2007-01-12 15:45 d——– C:\NortonBETA 2007-01-12 14:57 43,520 –a—— C:\WINDOWS\system32\msvcrl.dll 2007-01-10 15:00 d——– C:\WINDOWS\ie7updates 2007-01-10 02:47 624,784 –a—— C:\WINDOWS\system32\SymNeti.dll 2007-01-10 02:47 242,320 –a—— C:\WINDOWS\system32\SymRedir.dll 2007-01-09 22:32 40,120 –a—— C:\WINDOWS\system32\drivers\symids.sys 2007-01-09 22:32 38,200 –a—— C:\WINDOWS\system32\drivers\symndisv.sys 2007-01-09 22:32 35,256 –a—— C:\WINDOWS\system32\drivers\symndis.sys 2007-01-09 22:32 27,576 –a—— C:\WINDOWS\system32\drivers\symredrv.sys 2007-01-09 22:32 191,544 –a—— C:\WINDOWS\system32\drivers\symtdi.sys 2007-01-09 22:32 145,976 –a—— C:\WINDOWS\system32\drivers\symfw.sys 2007-01-09 22:32 12,984 –a—— C:\WINDOWS\system32\drivers\symdns.sys 2007-01-08 03:40 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MUIN.exe 2007-01-08 03:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ENOL.exe 2007-01-08 03:36 19,968 –a—— C:\DOCUME~1\MUSTAI~1\UTFQ.exe 2007-01-08 03:36 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GJKD.exe 2007-01-08 03:32 19,968 –a—— C:\DOCUME~1\MUSTAI~1\THNH.exe 2007-01-08 02:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MGDS.exe 2007-01-08 02:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AGBQ.exe 2007-01-08 02:27 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FOPR.exe 2007-01-08 02:27 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AMJH.exe 2007-01-08 02:25 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FNGI.exe 2007-01-08 02:22 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ILTR.exe 2007-01-08 02:19 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HSPQ.exe 2007-01-08 02:19 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GBLO.exe 2007-01-08 02:17 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DAGP.exe 2007-01-08 02:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CJNO.exe 2007-01-08 02:10 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PARM.exe 2007-01-08 02:10 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HGTT.exe 2007-01-08 02:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NTMK.exe 2007-01-08 02:05 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AUIC.exe 2007-01-08 02:03 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DTQT.exe 2007-01-08 01:58 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HTKC.exe 2007-01-08 01:58 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FMMU.exe 2007-01-08 01:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PCGK.exe 2007-01-08 01:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PAMB.exe 2007-01-08 01:48 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DIOD.exe 2007-01-08 01:44 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IRTM.exe 2007-01-08 01:43 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GOKI.exe 2007-01-08 01:40 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RIII.exe 2007-01-08 01:37 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ISJT.exe 2007-01-08 01:35 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CFPL.exe 2007-01-08 01:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LSAO.exe 2007-01-08 01:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QPFC.exe 2007-01-08 01:16 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RDFD.exe 2007-01-08 01:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LUAD.exe 2007-01-08 01:10 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AOPG.exe 2007-01-08 01:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EHES.exe 2007-01-08 01:05 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RSOM.exe 2007-01-08 01:00 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BDEM.exe 2007-01-08 00:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HNLT.exe 2007-01-08 00:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HEKB.exe 2007-01-08 00:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JQGQ.exe 2007-01-08 00:51 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IMHR.exe 2007-01-08 00:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BJUB.exe 2007-01-08 00:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IBCN.exe 2007-01-08 00:40 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JIGJ.exe 2007-01-08 00:37 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DIAO.exe 2007-01-08 00:35 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CLPM.exe 2007-01-08 00:31 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TAPM.exe 2007-01-08 00:28 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PLKS.exe 2007-01-08 00:26 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RMEF.exe 2007-01-08 00:25 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QHQQ.exe 2007-01-08 00:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TJUR.exe 2007-01-08 00:18 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JKLR.exe 2007-01-08 00:15 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GGEA.exe 2007-01-08 00:13 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IEOG.exe 2007-01-08 00:13 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IBPK.exe 2007-01-08 00:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MDML.exe 2007-01-08 00:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PRFB.exe 2007-01-08 00:04 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JJPS.exe 2007-01-07 23:10 19,968 –a—— C:\DOCUME~1\MUSTAI~1\UDBO.exe 2007-01-07 22:41 19,968 –a—— C:\DOCUME~1\MUSTAI~1\UCTU.exe 2007-01-07 22:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CQJC.exe 2007-01-07 22:36 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PAIF.exe 2007-01-07 22:35 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LLEN.exe 2007-01-07 21:15 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IMFN.exe 2007-01-07 20:45 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HGSI.exe 2007-01-07 20:41 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BBQD.exe 2007-01-07 20:22 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IPSS.exe 2007-01-07 20:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NDSF.exe 2007-01-07 20:06 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FKJK.exe 2007-01-07 19:55 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RUKR.exe 2007-01-07 19:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TTLJ.exe 2007-01-07 19:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MRDI.exe 2007-01-07 19:45 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CIEG.exe 2007-01-07 19:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GMSF.exe 2007-01-07 19:18 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IEUJ.exe 2007-01-07 19:14 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RGRQ.exe 2007-01-07 19:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MRNT.exe 2007-01-07 19:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HIEC.exe 2007-01-07 19:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AHNR.exe 2007-01-07 19:09 178,408 –a—— C:\WINDOWS\system32\muweb.dll 2007-01-07 18:54 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CIRN.exe 2007-01-07 18:51 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KGFK.exe 2007-01-07 18:51 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GJBJ.exe 2007-01-07 18:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HUTF.exe 2007-01-07 18:48 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IPKP.exe 2007-01-07 18:36 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MLNN.exe 2007-01-07 18:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HHQQ.exe 2007-01-07 18:33 19,968 –a—— C:\DOCUME~1\MUSTAI~1\URRR.exe 2007-01-07 18:29 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RBLB.exe 2007-01-07 18:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RDRN.exe 2007-01-07 18:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QFTR.exe 2007-01-07 18:04 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JTBN.exe 2007-01-07 17:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ILDB.exe 2007-01-07 17:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NAJK.exe 2007-01-07 17:38 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HTLC.exe 2007-01-07 17:37 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QBLQ.exe 2007-01-07 17:33 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QGPQ.exe 2007-01-07 17:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TRPG.exe 2007-01-07 17:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LTUM.exe 2007-01-07 17:28 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BQPM.exe 2007-01-07 15:22 19,968 –a—— C:\DOCUME~1\MUSTAI~1\OJTD.exe 2007-01-07 15:18 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HIHA.exe 2007-01-07 15:10 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CBRE.exe 2007-01-07 15:04 d——– C:\!KillBox 2007-01-07 15:03 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LCRT.exe 2007-01-07 14:42 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DTCM.exe 2007-01-07 14:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\PPOD.exe 2007-01-07 14:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CEDC.exe 2007-01-07 14:28 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BNAD.exe 2007-01-07 14:25 19,968 –a—— C:\DOCUME~1\MUSTAI~1\APLT.exe 2007-01-07 14:22 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RUHS.exe 2007-01-07 14:21 d——– C:\Spybot - Search & Destroy 2007-01-07 14:21 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy 2007-01-07 14:16 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CQUH.exe 2007-01-07 14:14 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EFJN.exe 2007-01-07 14:14 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EENG.exe 2007-01-07 14:04 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FIAP.exe 2007-01-07 14:02 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FIQA.exe 2007-01-07 14:01 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ERJS.exe 2007-01-07 14:00 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BSSU.exe 2007-01-07 13:57 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JQAT.exe 2007-01-07 13:57 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BMMM.exe 2007-01-07 13:54 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DKOS.exe 2007-01-07 13:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\URSB.exe 2007-01-07 13:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DFEJ.exe 2007-01-07 13:50 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DUEM.exe 2007-01-07 13:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RQRT.exe 2007-01-07 13:43 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CMKD.exe 2007-01-07 13:40 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AITM.exe 2007-01-07 07:23 19,968 –a—— C:\DOCUME~1\MUSTAI~1\UPIG.exe 2007-01-07 07:23 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KHUI.exe 2007-01-07 06:58 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QORB.exe 2007-01-07 06:55 19,968 –a—— C:\DOCUME~1\MUSTAI~1\JTHI.exe 2007-01-07 06:55 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EBNK.exe 2007-01-07 06:52 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HKRB.exe 2007-01-07 06:49 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TLEH.exe 2007-01-07 06:46 19,968 –a—— C:\DOCUME~1\MUSTAI~1\GAOB.exe 2007-01-07 06:38 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HTFT.exe 2007-01-07 06:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MNPB.exe 2007-01-07 06:34 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DMFC.exe 2007-01-07 06:29 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RJFD.exe 2007-01-07 06:28 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EUDQ.exe 2007-01-07 06:15 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ENFL.exe 2007-01-07 06:12 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MQQD.exe 2007-01-07 06:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\UOUP.exe 2007-01-07 06:09 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TCBB.exe 2007-01-07 06:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BNGA.exe 2007-01-07 06:07 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BCKL.exe 2007-01-07 05:56 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BNSM.exe 2007-01-07 05:29 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FKKJ.exe 2007-01-07 04:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\NOUL.exe 2007-01-07 04:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LFCC.exe 2007-01-07 04:30 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HRGC.exe 2007-01-07 04:25 19,968 –a—— C:\DOCUME~1\MUSTAI~1\RIMB.exe 2007-01-07 04:22 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TJOR.exe 2007-01-06 22:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\TKOU.exe 2007-01-06 22:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IUSI.exe 2007-01-06 22:08 19,968 –a—— C:\DOCUME~1\MUSTAI~1\CASU.exe 2007-01-06 22:05 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FDSQ.exe 2007-01-06 22:02 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ISPP.exe 2007-01-06 21:59 19,968 –a—— C:\DOCUME~1\MUSTAI~1\KQQD.exe 2007-01-06 21:53 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LDQP.exe 2007-01-06 21:44 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ATCB.exe 2007-01-06 21:43 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IBMR.exe 2007-01-06 21:28 19,968 –a—— C:\DOCUME~1\MUSTAI~1\IBES.exe 2007-01-06 21:28 19,968 –a—— C:\DOCUME~1\MUSTAI~1\COMB.exe 2007-01-06 21:25 d——– C:\DOCUME~1\LOCALS~1\Application Data\Google 2007-01-06 21:25 d——– C:\DOCUME~1\LOCALS~1\Application Data\Adobe 2007-01-06 21:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\DFAU.exe 2007-01-06 21:24 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BIPF.exe 2007-01-06 21:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\EQUK.exe 2007-01-06 21:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BMTM.exe 2007-01-06 21:17 19,968 –a—— C:\DOCUME~1\MUSTAI~1\BCEH.exe 2007-01-06 19:16 19,968 –a—— C:\DOCUME~1\MUSTAI~1\OFSO.exe 2007-01-06 19:11 19,968 –a—— C:\DOCUME~1\MUSTAI~1\OAHI.exe 2007-01-06 19:04 19,968 –a—— C:\DOCUME~1\MUSTAI~1\ANDS.exe 2007-01-06 19:02 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LKOG.exe 2007-01-06 19:00 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MJUM.exe 2007-01-06 18:57 19,968 –a—— C:\DOCUME~1\MUSTAI~1\FHAL.exe 2007-01-06 18:39 19,968 –a—— C:\DOCUME~1\MUSTAI~1\LJAO.exe 2007-01-06 18:27 19,968 –a—— C:\DOCUME~1\MUSTAI~1\MLLO.exe 2007-01-06 18:23 19,968 –a—— C:\DOCUME~1\MUSTAI~1\HKDK.exe 2007-01-06 18:21 19,968 –a—— C:\DOCUME~1\MUSTAI~1\QDNE.exe 2007-01-06 18:15 19,968 –a—— C:\DOCUME~1\MUSTAI~1\AEUF.exe 2007-01-06 17:36 d——– C:\WINDOWS\system32\NetMon 2007-01-06 17:09 d–h—– C:\Program Files\Common Files\Uninstall Information 2006-12-28 15:10 31,744 –a—— C:\WINDOWS\system32\drivers\wceusbsh.sys 2006-12-22 03:09 d——– C:\WINDOWS\system32\WinXP 2006-12-22 03:09 d——– C:\WINDOWS\system32\Win2K 2006-12-22 03:09 d——– C:\Program Files\Belkin 2006-12-22 03:09 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Yahoo! Companion 2006-12-22 03:09 d——– C:\BoostXP2 2006-12-22 03:09 d——– C:\Belkin 2006-12-22 03:00 d——– C:\Belkin(2) 2006-12-21 20:51 276,792 –a—— C:\WINDOWS\system32\drivers\srtspl.sys 2006-12-21 20:51 25,400 –a—— C:\WINDOWS\system32\drivers\srtspx.sys 2006-12-21 20:51 247,096 –a—— C:\WINDOWS\system32\drivers\srtsp.sys 2006-12-14 02:03 155,648 –a—— C:\WINDOWS\system32\igfxres.dll 2006-12-14 01:58 d——– C:\Program Files\NSC
Post #5
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver lzx32 is present. A rootkit scan is required

2007-01-13 19:16 ——– d——– C:\DOCUME~1\MUSTAI~1\Application Data\utorrent
2007-01-13 18:53 ——– d——– C:\DOCUME~1\MUSTAI~1\Application Data\xfire
2007-01-13 16:21 ——– d——– C:\Program Files\mozilla firefox
2007-01-12 23:24 ——– d——– C:\Program Files\Common Files\symantec shared
2007-01-12 21:53 ——– d——– C:\DOCUME~1\MUSTAI~1\Application Data\lavasoft
2007-01-12 16:00 48776 –a—— C:\WINDOWS\system32\s32evnt1.dll
2007-01-12 16:00 115000 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-01-12 16:00 ——– d——– C:\Program Files\symantec
2007-01-11 18:55 ——– d——– C:\DOCUME~1\MUSTAI~1\Application Data\teamspeak2
2006-12-22 03:09 ——– d–h—– C:\Program Files\installshield installation information
2006-12-22 02:13 ——– d——– C:\Program Files\yahoo!
2006-12-22 02:11 ——– d——– C:\Program Files\google
2006-12-07 05:29 2374472 –a—— C:\WINDOWS\system32\wmvcore.dll
2006-12-04 18:35 ——– d——– C:\Program Files\dramatica pro
2006-11-24 00:42 ——– d——– C:\Program Files\picasa2
2006-11-22 13:42 ——– d——– C:\DOCUME~1\MUSTAI~1\Application Data\divx
2006-11-22 01:26 ——– d——– C:\Program Files\divx
2006-11-19 16:46 ——– d——– C:\Program Files\msn messenger
2006-11-08 05:06 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 –a—— C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 –a—— C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 –a—— C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 –a—— C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 –a—— C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 –a—— C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 –a—— C:\WINDOWS\system32\msls31.dll
2006-11-07 03:27 382976 –a—— C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 –a—— C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 –a—— C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 –a—— C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 –a—— C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 –a—— C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 –a—— C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 –a—— C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 –a—— C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 –a—— C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 –a—— C:\WINDOWS\system32\msxml4.dll
2006-10-19 13:56 713216 –a—— C:\WINDOWS\system32\sxs.dll
2006-10-17 13:06 78336 –a—— C:\WINDOWS\system32\ieencode.dll
2006-10-17 13:05 40960 –a—— C:\WINDOWS\system32\licmgr10.dll
2006-10-17 13:05 206336 ——— C:\WINDOWS\system32\winfxdocobj.exe
2006-10-17 13:05 105984 –a—— C:\WINDOWS\system32\url.dll
2006-10-17 13:04 101376 –a—— C:\WINDOWS\system32\occache.dll
2006-10-17 13:03 17408 –a—— C:\WINDOWS\system32\corpol.dll
2006-10-17 12:58 61952 ——— C:\WINDOWS\system32\icardie.dll
2006-10-17 12:58 12288 ——— C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 12:57 36352 –a—— C:\WINDOWS\system32\imgutil.dll
2006-10-17 12:57 266752 ——— C:\WINDOWS\system32\iertutil.dll
2006-10-17 12:56 45568 –a—— C:\WINDOWS\system32\mshta.exe
2006-10-17 12:28 48128 –a—— C:\WINDOWS\system32\mshtmler.dll
2006-10-17 12:27 380928 ——— C:\WINDOWS\system32\ieapfltr.dll
2006-10-13 12:35 65536 –a—— C:\WINDOWS\system32\nwwks.dll
2006-10-13 12:35 64000 –a—— C:\WINDOWS\system32\nwapi32.dll
2006-10-13 12:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"
"MJUM"="\"C:\\Documents and Settings\\Mustainer\\MJUM.exe\""
"ISPP"="\"C:\\Documents and Settings\\Mustainer\\ISPP.exe\""
"TJOR"="\"C:\\Documents and Settings\\Mustainer\\TJOR.exe\""
"FKKJ"="\"C:\\Documents and Settings\\Mustainer\\FKKJ.exe\""
"BNGA"="\"C:\\Documents and Settings\\Mustainer\\BNGA.exe\""
"AITM"="\"C:\\Documents and Settings\\Mustainer\\AITM.exe\""
"BSSU"="\"C:\\Documents and Settings\\Mustainer\\BSSU.exe\""
"LCRT"="\"C:\\Documents and Settings\\Mustainer\\LCRT.exe\""
"BQPM"="\"C:\\Documents and Settings\\Mustainer\\BQPM.exe\""
"JTBN"="\"C:\\Documents and Settings\\Mustainer\\JTBN.exe\""
"FKJK"="\"C:\\Documents and Settings\\Mustainer\\FKJK.exe\""
"UDBO"="\"C:\\Documents and Settings\\Mustainer\\UDBO.exe\""
"BDEM"="\"C:\\Documents and Settings\\Mustainer\\BDEM.exe\""
"DTQT"="\"C:\\Documents and Settings\\Mustainer\\DTQT.exe\""
"WinInit"="\"C:\\DOCUME~1\\MUSTAI~1\\LOCALS~1\\Temp\\1014548.exe \" "
"ECLC"="\"C:\\Documents and Settings\\Mustainer\\ECLC.exe\""
"NEKF"="\"C:\\Documents and Settings\\Mustainer\\NEKF.exe\""
"KKAC"="\"C:\\Documents and Settings\\Mustainer\\KKAC.exe\""
"RNCN"="\"C:\\Documents and Settings\\Mustainer\\RNCN.exe\""
"DGJS"="\"C:\\Documents and Settings\\Mustainer\\DGJS.exe\""
"FHTB"="\"C:\\Documents and Settings\\Mustainer\\FHTB.exe\""
"QJJS"="\"C:\\Documents and Settings\\Mustainer\\QJJS.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"osCheck"="\"C:\\NortonBETA\\osCheck.exe\""
"SvcManager"="secures3.exe"
"PWRISOVM.EXE"="C:\\PowerISO\\PWRISOVM.EXE"
"AutoSys"="C:\\WINDOWS\\system32\\autosys.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.exe.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma Loader.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin 802.11g Wireless Card Utility.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Belkin\\BELKIN~1.11G\\utility.exe "
"item"="Belkin 802.11g Wireless Card Utility"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DesktopEarth AutoStart.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\DesktopEarth AutoStart.lnk"
"backup"="C:\\WINDOWS\\pss\\DesktopEarth AutoStart.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\WINDOWS\\Installer\\{DBA5E973-660D-4CBE-A469-F5C37FBF0CE4}\\_C1A9BF9D98647632ED5172.exe "
"item"="DesktopEarth AutoStart"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
"backup"="C:\\WINDOWS\\pss\\Google Updater.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Google\\GOOGLE~2\\GOOGLE~1.EXE -systray -startup"
"item"="Google Updater"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\MICROS~2\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SmartUI.lnk]
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Scansoft\\PAPERP~1\\SmartUI\\SmartUI.exe "
"item"="SmartUI"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mustainer^Start Menu^Programs^Startup^desktop.ini]
"backup"="C:\\WINDOWS\\pss\\desktop.iniStartup"
"location"="Startup"
"item"="desktop"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced Tools Check]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ADVCHK"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bcmwltry]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bcmwltry"
"hkey"="HKLM"
"command"="bcmwltry.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ccApp"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dslagent"
"hkey"="HKLM"
"command"="dslagent.exe USB"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FilmLoop]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FilmLoop"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\FilmLoop Player\\FilmLoop.exe\" -hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleDesktop"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GSICONEXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="gsicon"
"hkey"="HKLM"
"command"="gsicon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GsiFinal]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rundll32 gspndll"
"hkey"="HKLM"
"command"="rundll32 gspndll.dll,postInstall final"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="InCD"
"hkey"="HKLM"
"command"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IndexSearch"
"hkey"="HKLM"
"command"="C:\\Program Files\\Scansoft\\PaperPort\\IndexSearch.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWBMOUSE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="lwbwheel"
"hkey"="HKLM"
"command"="C:\\Micro innovations\\Mouse\\1.0\\lwbwheel.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="pptd40nt"
"hkey"="HKLM"
"command"="C:\\Program Files\\Scansoft\\PaperPort\\pptd40nt.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PP8 SE Reminder]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="navLoad"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Scansoft\\PaperPort\\WebEreg\\NAVBrowser.exe\" -r \"C:\\Program Files\\Scansoft\\PaperPort\\WebEreg\\navLoad.ini\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoveCpl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RemoveCpl"
"hkey"="HKLM"
"command"="RemoveCpl.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BrStDvPt"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SOUNDMAN"
"hkey"="HKLM"
"command"="SOUNDMAN.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleToolbarNotifier"
"hkey"="HKCU"
"command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SynTPEnh"
"hkey"="HKLM"
"command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SynTPLpr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tesco internet phone]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TescoIP"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Tesco internet phone\\TescoIP.exe\" /autostart"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ViewMgr"
"hkey"="HKLM"
"command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000001
"BackupNoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ http://www.lucasarts.com/games/swrepublicc…RepCommando.jpg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Mustainer.job

Completion time: 07-01-13 19:17:12
Post #6
Hi MrC - this is the Removal Information from SuperAntiSpyware SUPERAntiSpyware Scan Log Generated 01/13/2007 at 09:54 PM Application Version : 3.4.1000 Core Rules Database Version : 3164 Trace Rules Database Version: 1176 Scan type : Complete Scan Total Scan Time : 01:47:09 Memory items scanned : 466 Memory threats detected : 1 Registry items scanned : 6196 Registry threats detected : 8 File items scanned : 71788 File threats detected : 10 Trojan.Downloader-MDM/EX C:\WINDOWS\SYSTEM32\SECURES3.EXE C:\WINDOWS\SYSTEM32\SECURES3.EXE [SvcManager] C:\WINDOWS\SYSTEM32\SECURES3.EXE C:\PYDMJR.EXE C:\WINDOWS\SYSTEM32\SECURES3.PDF Adware.Tracking Cookie C:\Documents and Settings\Mustainer\Cookies\mustainer@zedo[1].txt C:\Documents and Settings\Mustainer\Cookies\mustainer@zedo[2].txt Browser Hijacker.Internet Explorer Settings Hijack HKU\S-1-5-21-2685824929-2560319674-3627639801-1004\Software\Microsoft\Internet Explorer\Main#Start Page [ c:\secure32.html ] HKLM\Software\Microsoft\Internet Explorer\Main#Start Page [ c:\secure32.html ] HKU\S-1-5-21-2685824929-2560319674-3627639801-1004\Software\Microsoft\Internet Explorer\Main#Default_Page_URL [ c:\secure32.html ] HKLM\Software\Microsoft\Internet Explorer\Main#Default_Page_URL [ c:\secure32.html ] HKU\S-1-5-21-2685824929-2560319674-3627639801-1004\Software\Microsoft\Internet Explorer\Main#Local Page [ c:\secure32.html ] HKLM\Software\Microsoft\Internet Explorer\Main#Local Page [ c:\secure32.html ] Trojan.Downloader-SvcManager HKLM\Software\Microsoft\Windows\CurrentVersion\Run#SvcManager [ secures3.exe ] Trojan.LoadAdv-Gen C:\WINDOWS\SYSTEM32\LOADADV559.EXE Unclassified.Unknown Origin/System C:\WINDOWS\SYSTEM32\NETUI0.EXE C:\WINDOWS\SYSTEM32\WMPENCEN.EXE Trojan.SpySheriff C:\XRSKP.EXE C:\YJVPQ.EXE
Post #8
This is the new Hijackthis scan log


Logfile of HijackThis v1.99.1
Scan saved at 10:31:58 PM, on 13/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\1.exe
C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\DesktopEarth\DesktopEarth.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\Rar$EX00.317\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\NortonBETA\osCheck.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MJUM] "C:\Documents and Settings\Mustainer\MJUM.exe"
O4 - HKCU\..\Run: [ISPP] "C:\Documents and Settings\Mustainer\ISPP.exe"
O4 - HKCU\..\Run: [TJOR] "C:\Documents and Settings\Mustainer\TJOR.exe"
O4 - HKCU\..\Run: [FKKJ] "C:\Documents and Settings\Mustainer\FKKJ.exe"
O4 - HKCU\..\Run: [BNGA] "C:\Documents and Settings\Mustainer\BNGA.exe"
O4 - HKCU\..\Run: [AITM] "C:\Documents and Settings\Mustainer\AITM.exe"
O4 - HKCU\..\Run: [BSSU] "C:\Documents and Settings\Mustainer\BSSU.exe"
O4 - HKCU\..\Run: [LCRT] "C:\Documents and Settings\Mustainer\LCRT.exe"
O4 - HKCU\..\Run: [BQPM] "C:\Documents and Settings\Mustainer\BQPM.exe"
O4 - HKCU\..\Run: [JTBN] "C:\Documents and Settings\Mustainer\JTBN.exe"
O4 - HKCU\..\Run: [FKJK] "C:\Documents and Settings\Mustainer\FKJK.exe"
O4 - HKCU\..\Run: [UDBO] "C:\Documents and Settings\Mustainer\UDBO.exe"
O4 - HKCU\..\Run: [BDEM] "C:\Documents and Settings\Mustainer\BDEM.exe"
O4 - HKCU\..\Run: [DTQT] "C:\Documents and Settings\Mustainer\DTQT.exe"
O4 - HKCU\..\Run: [WinInit] "C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\1014548.exe "
O4 - HKCU\..\Run: [ECLC] "C:\Documents and Settings\Mustainer\ECLC.exe"
O4 - HKCU\..\Run: [NEKF] "C:\Documents and Settings\Mustainer\NEKF.exe"
O4 - HKCU\..\Run: [KKAC] "C:\Documents and Settings\Mustainer\KKAC.exe"
O4 - HKCU\..\Run: [RNCN] "C:\Documents and Settings\Mustainer\RNCN.exe"
O4 - HKCU\..\Run: [DGJS] "C:\Documents and Settings\Mustainer\DGJS.exe"
O4 - HKCU\..\Run: [FHTB] "C:\Documents and Settings\Mustainer\FHTB.exe"
O4 - HKCU\..\Run: [QJJS] "C:\Documents and Settings\Mustainer\QJJS.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe"
O4 - Global Startup: DesktopEarth AutoStart.lnk = ?
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bejeweled…ploader_v10.cab
O20 - Winlogon Notify: !SASWinLogon - C:\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: browsewm.exe - Unknown owner - C:\WINDOWS\system32\browsewm.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: d3dx9_24.exe - Unknown owner - C:\WINDOWS\system32\d3dx9_24.exe (file missing)
O23 - Service: dsquery.exe - Unknown owner - C:\WINDOWS\system32\dsquery.exe (file missing)
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: inetcomm.exe - Unknown owner - C:\WINDOWS\system32\inetcomm.exe (file missing)
O23 - Service: ipsecsnp.exe - Unknown owner - C:\WINDOWS\system32\ipsecsnp.exe (file missing)
O23 - Service: ipxpromn.exe - Unknown owner - C:\WINDOWS\system32\ipxpromn.exe (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\NortonBETA\isPwdSvc.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mcicda.exe - Unknown owner - C:\WINDOWS\system32\mcicda.exe (file missing)
O23 - Service: mfc42.exe - Unknown owner - C:\WINDOWS\system32\mfc42.exe (file missing)
O23 - Service: mqupgrd.exe - Unknown owner - C:\WINDOWS\system32\mqupgrd.exe (file missing)
O23 - Service: msrecr40.exe - Unknown owner - C:\WINDOWS\system32\msrecr40.exe (file missing)
O23 - Service: psisdecd.exe - Unknown owner - C:\WINDOWS\system32\psisdecd.exe
O23 - Service: resutils.exe - Unknown owner - C:\WINDOWS\system32\resutils.exe (file missing)
O23 - Service: sfcfiles.exe - Unknown owner - C:\WINDOWS\system32\sfcfiles.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: syntpfcs.exe - Unknown owner - C:\WINDOWS\system32\syntpfcs.exe (file missing)
O23 - Service: wintrust.exe - Unknown owner - C:\WINDOWS\system32\wintrust.exe (file missing)
Post #9 last edited
First Please………

Please move HJT into its own permanent folder so backups can be made and found.
example: C:\HJT\HiJackthis.exe, C:\Program Files\HJT\HiJackThis.exe or C:\MyDocuments\HJT\HighJackThis.exe

————————–

1. Please download The Avenger by Swandog46 to your Desktop.

* Click on Avenger.zip to open the file
* Extract avenger.exe to your desktop
* Don't run it yet!

—————————-

Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
browsewm.exe

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

Do the same for these:

d3dx9_24.exe
dsquery.exe
inetcomm.exe
ipsecsnp.exe
ipxpromn.exe
LicCtrl Service
mcicda.exe
mfc42.exe
mqupgrd.exe
msrecr40.exe
psisdecd.exe
resutils.exe -
sfcfiles.exe -
syntpfcs.exe
wintrust.exe

————————————

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

C:\WINDOWS\system32\1.exe

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKCU\..\Run: [MJUM] "C:\Documents and Settings\Mustainer\MJUM.exe"
O4 - HKCU\..\Run: [ISPP] "C:\Documents and Settings\Mustainer\ISPP.exe"
O4 - HKCU\..\Run: [TJOR] "C:\Documents and Settings\Mustainer\TJOR.exe"
O4 - HKCU\..\Run: [FKKJ] "C:\Documents and Settings\Mustainer\FKKJ.exe"
O4 - HKCU\..\Run: [BNGA] "C:\Documents and Settings\Mustainer\BNGA.exe"
O4 - HKCU\..\Run: [AITM] "C:\Documents and Settings\Mustainer\AITM.exe"
O4 - HKCU\..\Run: [BSSU] "C:\Documents and Settings\Mustainer\BSSU.exe"
O4 - HKCU\..\Run: [LCRT] "C:\Documents and Settings\Mustainer\LCRT.exe"
O4 - HKCU\..\Run: [BQPM] "C:\Documents and Settings\Mustainer\BQPM.exe"
O4 - HKCU\..\Run: [JTBN] "C:\Documents and Settings\Mustainer\JTBN.exe"
O4 - HKCU\..\Run: [FKJK] "C:\Documents and Settings\Mustainer\FKJK.exe"
O4 - HKCU\..\Run: [UDBO] "C:\Documents and Settings\Mustainer\UDBO.exe"
O4 - HKCU\..\Run: [BDEM] "C:\Documents and Settings\Mustainer\BDEM.exe"
O4 - HKCU\..\Run: [DTQT] "C:\Documents and Settings\Mustainer\DTQT.exe"
O4 - HKCU\..\Run: [WinInit] "C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\1014548.exe "
O4 - HKCU\..\Run: [ECLC] "C:\Documents and Settings\Mustainer\ECLC.exe"
O4 - HKCU\..\Run: [NEKF] "C:\Documents and Settings\Mustainer\NEKF.exe"
O4 - HKCU\..\Run: [KKAC] "C:\Documents and Settings\Mustainer\KKAC.exe"
O4 - HKCU\..\Run: [RNCN] "C:\Documents and Settings\Mustainer\RNCN.exe"
O4 - HKCU\..\Run: [DGJS] "C:\Documents and Settings\Mustainer\DGJS.exe"
O4 - HKCU\..\Run: [FHTB] "C:\Documents and Settings\Mustainer\FHTB.exe"
O4 - HKCU\..\Run: [QJJS] "C:\Documents and Settings\Mustainer\QJJS.exe"
O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe"
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bejeweled…ploader_v10.cab
O23 - Service: browsewm.exe - Unknown owner - C:\WINDOWS\system32\browsewm.exe (file missing)
O23 - Service: d3dx9_24.exe - Unknown owner - C:\WINDOWS\system32\d3dx9_24.exe (file missing)
O23 - Service: dsquery.exe - Unknown owner - C:\WINDOWS\system32\dsquery.exe (file missing)
O23 - Service: inetcomm.exe - Unknown owner - C:\WINDOWS\system32\inetcomm.exe (file missing)
O23 - Service: ipsecsnp.exe - Unknown owner - C:\WINDOWS\system32\ipsecsnp.exe (file missing)
O23 - Service: ipxpromn.exe - Unknown owner - C:\WINDOWS\system32\ipxpromn.exe (file missing)
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing)
O23 - Service: mcicda.exe - Unknown owner - C:\WINDOWS\system32\mcicda.exe (file missing)
O23 - Service: mfc42.exe - Unknown owner - C:\WINDOWS\system32\mfc42.exe (file missing)
O23 - Service: mqupgrd.exe - Unknown owner - C:\WINDOWS\system32\mqupgrd.exe (file missing)
O23 - Service: msrecr40.exe - Unknown owner - C:\WINDOWS\system32\msrecr40.exe (file missing)
O23 - Service: psisdecd.exe - Unknown owner - C:\WINDOWS\system32\psisdecd.exe
O23 - Service: resutils.exe - Unknown owner - C:\WINDOWS\system32\resutils.exe (file missing)
O23 - Service: sfcfiles.exe - Unknown owner - C:\WINDOWS\system32\sfcfiles.exe
O23 - Service: syntpfcs.exe - Unknown owner - C:\WINDOWS\system32\syntpfcs.exe (file missing)
O23 - Service: wintrust.exe - Unknown owner - C:\WINDOWS\system32\wintrust.exe (file missing)

Click on Fix Checked and exit HijackThis.

—————–

Back to the Avenger….

2. Copy all the text contained in the code box below to your Clipboard by highlighting it, then right click on it and choose Copy [or by pressing (Ctrl+C)]:

Files to delete:

C:\WINDOWS\system32\autosys.exe
C:\Documents and Settings\Mustainer\MJUM.exe
C:\Documents and Settings\Mustainer\ISPP.exe
C:\Documents and Settings\Mustainer\TJOR.exe
C:\Documents and Settings\Mustainer\FKKJ.exe
C:\Documents and Settings\Mustainer\BNGA.exe
C:\Documents and Settings\Mustainer\AITM.exe
C:\Documents and Settings\Mustainer\BSSU.exe
C:\Documents and Settings\Mustainer\LCRT.exe
C:\Documents and Settings\Mustainer\BQPM.exe
C:\Documents and Settings\Mustainer\JTBN.exe
C:\Documents and Settings\Mustainer\FKJK.exe
C:\Documents and Settings\Mustainer\UDBO.exe
C:\Documents and Settings\Mustainer\BDEM.exe
C:\Documents and Settings\Mustainer\DTQT.exe
C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\1014548.exe
C:\Documents and Settings\Mustainer\ECLC.exe
C:\Documents and Settings\Mustainer\NEKF.exe
C:\Documents and Settings\Mustainer\KKAC.exe
C:\Documents and Settings\Mustainer\RNCN.exe
C:\Documents and Settings\Mustainer\DGJS.exe
C:\Documents and Settings\Mustainer\FHTB.exe
C:\Documents and Settings\Mustainer\QJJS.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\browsewm.exe
C:\WINDOWS\system32\d3dx9_24.exe
C:\WINDOWS\system32\dsquery.exe
C:\WINDOWS\system32\inetcomm.exe
C:\WINDOWS\system32\ipsecsnp.exe
C:\WINDOWS\system32\ipxpromn.exe
C:\WINDOWS\system32\mcicda.exe
C:\WINDOWS\system32\mfc42.exe
C:\WINDOWS\system32\mqupgrd.exe
C:\WINDOWS\system32\msrecr40.exe
C:\WINDOWS\system32\psisdecd.exe
C:\WINDOWS\system32\resutils.exe
C:\WINDOWS\system32\sfcfiles.exe
C:\WINDOWS\system32\syntpfcs.exe
C:\WINDOWS\system32\wintrust.exe



Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

* Under "Script file to execute" choose "Input Script Manually".
* Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
* Right click in the new window and choose Paste or use (Ctrl+V). This will paste the text from the clipboard into the new window.
* Click Done
* Now click on the Green Light to begin execution of the script
* Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

* It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
* On reboot, it will briefly open a black command window on your desktop, this is normal.
* After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
* The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

——————–

Open HijackThis. Click on 'Open the miscellaneous tools section'
Click on 'Delete an NT Service'
Paste in this:

browsewm.exe

and click 'OK'

Do the same for all of these:

d3dx9_24.exe
dsquery.exe
inetcomm.exe
ipsecsnp.exe
ipxpromn.exe
LicCtrl Service
mcicda.exe
mfc42.exe
mqupgrd.exe
msrecr40.exe
psisdecd.exe
resutils.exe -
sfcfiles.exe -
syntpfcs.exe
wintrust.exe

Post a fresh HJT log and the avenger.txt, MrC
Post #11
Hey MrC I got as far as the Hijackthis scan but had trouble locating all of these O23 - Service: browsewm.exe - Unknown owner - C:\WINDOWS\system32\browsewm.exe (file missing) O23 - Service: d3dx9_24.exe - Unknown owner - C:\WINDOWS\system32\d3dx9_24.exe (file missing) O23 - Service: dsquery.exe - Unknown owner - C:\WINDOWS\system32\dsquery.exe (file missing) O23 - Service: inetcomm.exe - Unknown owner - C:\WINDOWS\system32\inetcomm.exe (file missing) O23 - Service: ipsecsnp.exe - Unknown owner - C:\WINDOWS\system32\ipsecsnp.exe (file missing) O23 - Service: ipxpromn.exe - Unknown owner - C:\WINDOWS\system32\ipxpromn.exe (file missing) O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - rundll32.exe (file missing) O23 - Service: mcicda.exe - Unknown owner - C:\WINDOWS\system32\mcicda.exe (file missing) O23 - Service: mfc42.exe - Unknown owner - C:\WINDOWS\system32\mfc42.exe (file missing) O23 - Service: mqupgrd.exe - Unknown owner - C:\WINDOWS\system32\mqupgrd.exe (file missing) O23 - Service: msrecr40.exe - Unknown owner - C:\WINDOWS\system32\msrecr40.exe (file missing) O23 - Service: psisdecd.exe - Unknown owner - C:\WINDOWS\system32\psisdecd.exe O23 - Service: resutils.exe - Unknown owner - C:\WINDOWS\system32\resutils.exe (file missing) O23 - Service: sfcfiles.exe - Unknown owner - C:\WINDOWS\system32\sfcfiles.exe O23 - Service: syntpfcs.exe - Unknown owner - C:\WINDOWS\system32\syntpfcs.exe (file missing) O23 - Service: wintrust.exe - Unknown owner - C:\WINDOWS\system32\wintrust.exe (file missing) so i went ahead and ran the scan on the rest of the ones you told me to check off. I ran Avenger and pasted the list you gave me and hit the green light. The 1st Yes prompt came up but then an error message Error: selected file does not appear to be a valid script i clicked OK next message was Press OK to log error and continue or Cancel to abort i clicked OK then a 3rd box saying Error code: 0 i click OK and this is as far as i got also of the list of browsewm.exe only one of the ones listed i had to actually hit Stop on, all the others said automatic but i disabled all the ones you listed. I hope i've done everything right so far.
Post #13
i copy and pasted it in avenger again and get the same sequence of error messages i tried it two way - with and without the opening line of Files to delete:
Post #14
Is this the code you used? Try it again.


Files to delete:

C:\WINDOWS\system32\autosys.exe
C:\Documents and Settings\Mustainer\MJUM.exe
C:\Documents and Settings\Mustainer\ISPP.exe
C:\Documents and Settings\Mustainer\TJOR.exe
C:\Documents and Settings\Mustainer\FKKJ.exe
C:\Documents and Settings\Mustainer\BNGA.exe
C:\Documents and Settings\Mustainer\AITM.exe
C:\Documents and Settings\Mustainer\BSSU.exe
C:\Documents and Settings\Mustainer\LCRT.exe
C:\Documents and Settings\Mustainer\BQPM.exe
C:\Documents and Settings\Mustainer\JTBN.exe
C:\Documents and Settings\Mustainer\FKJK.exe
C:\Documents and Settings\Mustainer\UDBO.exe
C:\Documents and Settings\Mustainer\BDEM.exe
C:\Documents and Settings\Mustainer\DTQT.exe
C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\1014548.exe
C:\Documents and Settings\Mustainer\ECLC.exe
C:\Documents and Settings\Mustainer\NEKF.exe
C:\Documents and Settings\Mustainer\KKAC.exe
C:\Documents and Settings\Mustainer\RNCN.exe
C:\Documents and Settings\Mustainer\DGJS.exe
C:\Documents and Settings\Mustainer\FHTB.exe
C:\Documents and Settings\Mustainer\QJJS.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\browsewm.exe
C:\WINDOWS\system32\d3dx9_24.exe
C:\WINDOWS\system32\dsquery.exe
C:\WINDOWS\system32\inetcomm.exe
C:\WINDOWS\system32\ipsecsnp.exe
C:\WINDOWS\system32\ipxpromn.exe
C:\WINDOWS\system32\mcicda.exe
C:\WINDOWS\system32\mfc42.exe
C:\WINDOWS\system32\mqupgrd.exe
C:\WINDOWS\system32\msrecr40.exe
C:\WINDOWS\system32\psisdecd.exe
C:\WINDOWS\system32\resutils.exe
C:\WINDOWS\system32\sfcfiles.exe
C:\WINDOWS\system32\syntpfcs.exe
C:\WINDOWS\system32\wintrust.exe


—————

If that doesn't work…….

Download and unzip the KillBox to a folder.


Now…
Open up the KillBox
Select the option "Delete on reboot".
Click the button: All Files <—important
Now it should flash green

Now copy the next part in blue: (hightlight them > right click and choose copy)

C:\WINDOWS\system32\autosys.exe
C:\Documents and Settings\Mustainer\MJUM.exe
C:\Documents and Settings\Mustainer\ISPP.exe
C:\Documents and Settings\Mustainer\TJOR.exe
C:\Documents and Settings\Mustainer\FKKJ.exe
C:\Documents and Settings\Mustainer\BNGA.exe
C:\Documents and Settings\Mustainer\AITM.exe
C:\Documents and Settings\Mustainer\BSSU.exe
C:\Documents and Settings\Mustainer\LCRT.exe
C:\Documents and Settings\Mustainer\BQPM.exe
C:\Documents and Settings\Mustainer\JTBN.exe
C:\Documents and Settings\Mustainer\FKJK.exe
C:\Documents and Settings\Mustainer\UDBO.exe
C:\Documents and Settings\Mustainer\BDEM.exe
C:\Documents and Settings\Mustainer\DTQT.exe
C:\DOCUME~1\MUSTAI~1\LOCALS~1\Temp\1014548.exe
C:\Documents and Settings\Mustainer\ECLC.exe
C:\Documents and Settings\Mustainer\NEKF.exe
C:\Documents and Settings\Mustainer\KKAC.exe
C:\Documents and Settings\Mustainer\RNCN.exe
C:\Documents and Settings\Mustainer\DGJS.exe
C:\Documents and Settings\Mustainer\FHTB.exe
C:\Documents and Settings\Mustainer\QJJS.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\browsewm.exe
C:\WINDOWS\system32\d3dx9_24.exe
C:\WINDOWS\system32\dsquery.exe
C:\WINDOWS\system32\inetcomm.exe
C:\WINDOWS\system32\ipsecsnp.exe
C:\WINDOWS\system32\ipxpromn.exe
C:\WINDOWS\system32\mcicda.exe
C:\WINDOWS\system32\mfc42.exe
C:\WINDOWS\system32\mqupgrd.exe
C:\WINDOWS\system32\msrecr40.exe
C:\WINDOWS\system32\psisdecd.exe
C:\WINDOWS\system32\resutils.exe
C:\WINDOWS\system32\sfcfiles.exe
C:\WINDOWS\system32\syntpfcs.exe
C:\WINDOWS\system32\wintrust.exe

Open 'file' in the KillBox menu on top and choose Paste from clipboard

Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES
If you don't get that message, reboot manually.

Your computer must reboot now.

Let me know, Post a fresh HJT log too, MrC
Post #15
Hi MrC

I tried running that list in avenger and got the same error

downloaded killbox and followed the instructions - just rebooted but didnt see any box program or anything happen, hit IE and opened a few pages and no pop ups so far!! by now i'd be bombarded!

here is the new HJT log

Logfile of HijackThis v1.99.1
Scan saved at 2:25:51 AM, on 14/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DesktopEarth\DesktopEarth.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Mustainer\Desktop\HijackThis.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\NortonBETA\osCheck.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [AEHI] "C:\WINDOWS\system32\AEHI.exe"
O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe"
O4 - Global Startup: DesktopEarth AutoStart.lnk = ?
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O20 - Winlogon Notify: !SASWinLogon - C:\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: dsauth.exe - Unknown owner - C:\WINDOWS\system32\dsauth.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\NortonBETA\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


do you think its fixed?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI