Spyware / Malware / Virus Removal

[Resolved] imsorryinternet malware

13 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1December 28, 2007, 10:19 PM UTC

I've been trying to clean up my son's pc for a couple of days now.
Issues
1.There is a toolbar on the side of ie that won't go away. It's called imsorryinternet. I've seen other posts about it so at least I know I'm not the first.

2.avast keeps trying to reboot. even after I reboot.

3.qdrmodule11.exe keeps trying to acces the internet.

Thanks in advance for any help.

B. J.

Logfile of HijackThis v1.99.1
Scan saved at 3:09:40 PM, on 12/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ .exe
C:\Program Files\QuickTime\qttask .exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp .exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
C:\Program Files\Winamp\winampa .exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\Program Files\QdrModule\QdrModule11 .exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pbnation.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
F3 - REG:win.ini: load=C:\WINDOWS\system32\ddayy.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [885e0d18] rundll32.exe "C:\WINDOWS\system32\jayuohql.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: V CAST Music Monitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab55668.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\kxmxifom.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Trevuren

Post #2December 29, 2007, 5:40 AM UTC

Hello Diamond Paintball and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem.

Please download this file - combofix.exe by sUBs

You must download it to and run it from your Desktop
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren

Deleted Member

Post #3December 29, 2007, 4:43 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 9:42:16 AM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask .exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pbnation.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: {5bc58e92-91fe-35d9-78f4-e356c73aa356} - {653aa37c-653e-4f87-9d53-ef1929e85cb5} - C:\WINDOWS\system32\qaarwxrq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [885e0d18] rundll32.exe "C:\WINDOWS\system32\jayuohql.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: V CAST Music Monitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab55668.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ComboFix 07-12-29.5 - Owner 2007-12-29 9:30:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.436 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Local Settings\Temporary Internet Files\Content.IE5\70UURKJ1\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ddayy.dll
C:\WINDOWS\system32\ddayy.exe
.
—- Previous Run ——-
.
C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive9.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\QdrModule11 .exe
C:\Program Files\QdrModule\QdrModule11.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\yyadd.ini
C:\WINDOWS\system32\yyadd.ini2
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService

((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.

2007-12-28 09:14 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2007-12-28 01:07 . 2007-12-28 09:03 d——– C:\VundoFix Backups
2007-12-28 00:26 . 2007-12-28 00:26 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 00:25 . 2007-12-28 00:25 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-28 00:06 . 2007-12-28 00:06 341,504 –a—— C:\WINDOWS\system32\RCX2B.tmp
2007-12-27 18:54 . 2007-12-27 18:54 341,504 –a—— C:\WINDOWS\system32\RCX27.tmp
2007-12-27 10:38 . 2007-12-27 10:38 1,008,750 —hs—- C:\WINDOWS\system32\tfmxlaqa.ini
2007-12-26 17:31 . 2007-12-28 15:06 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2007-12-25 22:39 . 2007-12-27 10:38 1,020,007 —hs—- C:\WINDOWS\system32\oppdmahv.ini
2007-12-25 22:36 . 2007-12-25 22:36 1,019,097 —hs—- C:\WINDOWS\system32\dsrqdhpb.ini
2007-12-24 22:36 . 2007-12-24 22:36 1,009,966 —hs—- C:\WINDOWS\system32\iuoatgvo.ini
2007-12-23 22:33 . 2007-12-24 22:34 1,009,906 —hs—- C:\WINDOWS\system32\nleyvafv.ini
2007-12-22 22:45 . 2007-12-22 22:45 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-22 22:45 . 2007-12-22 22:45 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-19 18:40 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2007-12-19 18:38 . 2007-12-19 18:38 d——– C:\Program Files\Microsoft.NET
2007-12-19 18:34 . 2007-12-19 18:53 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-19 18:33 . 2007-12-19 18:33 dr-h—– C:\MSOCache
2007-12-01 12:03 . 2007-12-28 19:33 d——– C:\Documents and Settings\Owner\Shared
2007-12-01 12:03 . 2007-12-28 19:33 d——– C:\Documents and Settings\Owner\Incomplete
2007-12-01 12:02 . 2007-12-01 12:02 d——– C:\Program Files\LimeWire
2007-12-01 12:02 . 2007-12-26 12:30 d——– C:\Documents and Settings\Owner\Application Data\LimeWire
2007-11-29 17:35 . 2004-08-04 12:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-29 16:33 ——— d—–w C:\Program Files\Windows Defender
2007-12-29 16:33 ——— d—–w C:\Program Files\Winamp
2007-12-29 02:32 ——— d—–w C:\Program Files\QuickTime
2007-12-28 21:52 11,706,400 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-28 16:14 ——— d—–w C:\Program Files\Java
2007-12-28 16:08 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 08:30 137,564 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-28 07:27 ——— d—–w C:\Program Files\Lavasoft
2007-12-28 07:27 ——— d—–w C:\Documents and Settings\Owner\Application Data\Lavasoft
2007-12-20 03:49 ——— d—–w C:\Documents and Settings\Owner\Application Data\U3
2007-12-20 01:39 ——— d—–w C:\Program Files\Microsoft Works
2007-12-04 14:56 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{653aa37c-653e-4f87-9d53-ef1929e85cb5}]
C:\WINDOWS\system32\qaarwxrq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"QdrModule11"="C:\Program Files\QdrModule\QdrModule11.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2007-12-28 19:32]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 06:00]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"885e0d18"="C:\WINDOWS\system32\jayuohql.dll" []

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-09-17 07:19:14]
V CAST Music Monitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe [2005-11-30 11:32:10]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-02-08 14:03 278528 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 –a—— C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6adc7af9-cd74-11d9-b105-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

.
Contents of the 'Scheduled Tasks' folder
"2005-12-25 16:33:56 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
"2007-12-29 08:55:01 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 09:36:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-29 9:39:19 - machine was rebooted [Owner]
.
2007-12-13 10:04:01 — E O F —

Trevuren

Post #4December 29, 2007, 6:09 PM UTC

Hi Diamond Paintball.

This problem that you are having with your machine is much more serious than you think. Your system is currently infected by a brand new infection which is wreaking havoc with users' systems across the internet. Our specialists are working on a "cure" but it may be a while in coming, if ever it does. In many cases, we just have the person reformat their hard drive and reinstall due to the damage done. In your case, we may be able to salvage your system but you must follow my instructions to the letter and perform the work required as soon as possible. It is possible that we may have to go through this process more than once, so be prepared.

Here are the instructions for you to follow:

A. Until your system has been deemed to be clean of all infection, please stay offline (except to come here) and use it as little as possible (only to do the work requested.

B. Using the ADD/Remove Programs module in your Control Panel, please UNINSTALL the following programs that have been infected and are now corrupted:

PowerDVD
Windows Defender
GoogleToolbarNotifier
jre1.6.0_03
QuickTime

All these programs may be downloaded from the internet and reinstalled once we have finished cleaning your system.

C. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\RCX2B.tmp
C:\WINDOWS\system32\RCX27.tmp
C:\WINDOWS\system32\tfmxlaqa.ini
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\oppdmahv.ini
C:\WINDOWS\system32\dsrqdhpb.ini
C:\WINDOWS\system32\iuoatgvo.ini
C:\WINDOWS\system32\nleyvafv.ini
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for

Folder::
C:\VundoFix Backups
C:\Program Files\Windows Defender
C:\Program Files\Winamp
C:\Program Files\QuickTime
C:\Program Files\CyberLink
C:\Program Files\Google

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{653aa37c-653e-4f87-9d53-ef1929e85cb5}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=-
"MsnMsgr"=-
"QdrModule11"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"=-
"QuickTime Task"=-
"885e0d18"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html]
"CLSID"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{807563E5-5146-11D5-A672-00B0D022E945}]

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply after you re-enable all the programs that were disabled during the running of ComboFix:

Combofix.txt
A new HijackThis log.

Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Deleted Member

Post #5December 29, 2007, 7:18 PM UTC

I'm not sure I got my Avast resident scanner back on.

Logfile of HijackThis v1.99.1
Scan saved at 12:15:14 PM, on 12/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pbnation.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: V CAST Music Monitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab55668.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ComboFix 07-12-30.1 - Owner 2007-12-29 11:53:20.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.415 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\dsrqdhpb.ini
C:\WINDOWS\system32\iuoatgvo.ini
C:\WINDOWS\system32\nleyvafv.ini
C:\WINDOWS\system32\oppdmahv.ini
C:\WINDOWS\system32\RCX27.tmp
C:\WINDOWS\system32\RCX2B.tmp
C:\WINDOWS\system32\tfmxlaqa.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink
C:\Program Files\Google
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\Readme.txt
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_en.dll
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime
C:\Program Files\QuickTime\Plugins\nsIQTScriptablePlugin.xpt
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\Winamp
C:\Program Files\Winamp\burnlib.dll
C:\Program Files\Winamp\demo.mp3
C:\Program Files\Winamp\eMusic\EMusicClient.exe
C:\Program Files\Winamp\eMusic\eMusicClient.ico
C:\Program Files\Winamp\eMusic\eMusicClient.ini
C:\Program Files\Winamp\eMusic\roundtarget.ico
C:\Program Files\Winamp\eMusic\Uninst-eMusic-promotion.exe
C:\Program Files\Winamp\install.ini
C:\Program Files\Winamp\Kuppers_Elektro-Tek_Radio_Edit.mp3
C:\Program Files\Winamp\libFLAC.dll
C:\Program Files\Winamp\libmp4v2.dll
C:\Program Files\Winamp\libsndfile.dll
C:\Program Files\Winamp\nde.dll
C:\Program Files\Winamp\nscrt.dll
C:\Program Files\Winamp\pconfig.dcf
C:\Program Files\Winamp\Plugins\avs\AddBorder.ape
C:\Program Files\Winamp\Plugins\avs\avsres_texer_circle_edgeonly_19x19.bmp
C:\Program Files\Winamp\Plugins\avs\avsres_texer_circle_edgeonly_29x29.bmp
C:\Program Files\Winamp\Plugins\avs\avsres_texer_circle_heavyblur_19x19.bmp
C:\Program Files\Winamp\Plugins\avs\avsres_texer_circle_heavyblur_21x21.bmp
C:\Program Files\Winamp\Plugins\avs\avsres_texer_circle_sharp_19x19.bmp
C:\Program Files\Winamp\Plugins\avs\colormap.ape
C:\Program Files\Winamp\Plugins\avs\Community Picks\Acid - Twitchy liquid stuff (mixing plastics mix by tuggummi).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\amphirion - Ex Deux Mechanica.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Amphirion - Geometric Sustinance.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Degnic - Data flow.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Degnic - Fractal (slo-mo metallic) (u).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Degnic - Fury (extreme remix) by fsk.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Degnic - Helium.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\degnic - spirit realm (plasmoid rmx).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\duo - alien intercourse 4.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\duo - Alienated (evilrice trinity tron remix).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Duo - Hash the Planet.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\duo - warm freeform.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\el-vis - golden.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\el-vis - hubble002.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\el-vis - rittaufdemfeuerstrahl.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\el-vis - spindle.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\fUk - afterburner remix.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\fUk - cube.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\fUk - ice cube.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Jay-Fatboy - Pieces of a Dead world.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Jheriko - Alien Device (Gallery Remix by Zamuz).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\NemoOrange - Building Blocks.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\NemoOrange - Clockwork.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\NemoOrange - the Light of Speed.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\NemoOrange vs el-vis - dreamtime2.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\S_KuPeRS - Curvism 002 (Tuggummi's Paprika Mix).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\s_kupers - gace.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\s_kupers - the revenge of mt. doom.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Shock Value - Architectural Design (v.1.01).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\shock value - source of power.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Tonic - One More (BW Contest).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Tonic - Zoomed Picture from One Insect.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Tuggummi - Let me out!.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Tuggummi - Shiny metal curves.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Butterfly Caught.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Daedalus.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Don't Trip and Drive.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Goldie.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Mister Santa.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Seismogrid.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Silk Strings.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\UnConeD - Tokyo Bullet.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\yathosho - interlaced.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\yathosho - sakura.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Yathosho - SKOGSKLOCKA™.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\zamuz - big bang.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Zamuz - Explosive Virus.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\zamuz - spiritual.avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\zamuz meets tuggummi - fat balls (wallpaper wannabe candy theme).avs
C:\Program Files\Winamp\Plugins\avs\Community Picks\Zevensoft - Ocean4.avs
C:\Program Files\Winamp\Plugins\avs\convolution.ape
C:\Program Files\Winamp\Plugins\avs\flow3.0-5.bmp
C:\Program Files\Winamp\Plugins\avs\fyrewurx.ape
C:\Program Files\Winamp\Plugins\avs\multifilter.ape
C:\Program Files\Winamp\Plugins\avs\skupers_lp6_02.bmp
C:\Program Files\Winamp\Plugins\avs\skupers_lp7_01.bmp
C:\Program Files\Winamp\Plugins\avs\sv_architectimage_256.bmp
C:\Program Files\Winamp\Plugins\avs\sv_architectimage_buffer.bmp
C:\Program Files\Winamp\Plugins\avs\sv_texer_simplefade.bmp
C:\Program Files\Winamp\Plugins\avs\texer.ape
C:\Program Files\Winamp\Plugins\avs\texer2.ape
C:\Program Files\Winamp\Plugins\avs\tug_3dpack_texer4.bmp
C:\Program Files\Winamp\Plugins\avs\tug_bit2_texer5.bmp
C:\Program Files\Winamp\Plugins\avs\tug_ti_texer2.bmp
C:\Program Files\Winamp\Plugins\avs\whacko6-06.bmp
C:\Program Files\Winamp\Plugins\avs\whacko6-07.bmp
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\amphirion - nebulous (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\D&L; - Life Is Violated.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Degnic-Adrealine rush.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Degnic - Retrowall (Yathosho's Supermicrocosm).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Duo - Alien Heart.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Duo - Brainstorm.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\EL-VIS - Molecules (S_KuPeRS Remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\el-vis - soundscape III (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\fck - checkers with metaballs (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\horse-fly - jinx (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\jheriko - not quite a bendy tunnel (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\justin - newpoop (for wa5).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\justin - the landscape is killing me (wa5remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\L1quid - Take the Veil.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Dragonscales.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Encapsulade.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Freekwyrms.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Lilypod.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Mist Wisps.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Nebulating - Hypercolorspace.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Reverb - Deep Net.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Slyde - Tri.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Solar Flaire.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Spintronics - Backspin.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Starslappin.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Street Art - Fire Inside.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Swoo - Slow.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Nic01 - Rototronik.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\nixa - smell of music (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\p-k - bumpy.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - …hidden track….avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - A Tribute To Degnic.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Arctic Rainbow.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Chinook.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - female demands.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Hexual Healing.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Inverse Kinetics.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Kingish.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Spirit Realm (Degnic's Plasmoid RMX).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Texering 002.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Upward Current.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\skupers - chinook (exclusive version).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\splendora.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Aqua-fumes.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Club Seizure (color enhanced mix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Different Load.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Electro blobs.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Kaleidofied.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Magma Flow II.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Multiple Orgasms.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Odour Control.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Pina Colada.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Scope in Spotlight II.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Solero Shots.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Square Minded.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Worm-O-Rama (Raz Remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Zero-G Maze.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Cartoon Trip.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Containment.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Cubic Flower.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Jello Cube.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Mercury.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Neon Coaster.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Plankton.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Reflectocube.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Speeder 3K.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - TC Plasma.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Tie Tunnel SSC.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Zero-G Maze II.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD -Retrosquares.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD -Zero-G Maze III.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\yathosho - fabric (skupers remix).avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\Yathosho - microcosm 02.avs
C:\Program Files\Winamp\Plugins\avs\Winamp 5 Picks\zxe-Urantia.avs
C:\Program Files\Winamp\Plugins\CDDBControlWinamp.dll
C:\Program Files\Winamp\Plugins\CDDBUIWinamp.dll
C:\Program Files\Winamp\Plugins\dsp_sps.dll
C:\Program Files\Winamp\Plugins\DSP_SPS\cockos - octave down.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\cockos - octave up.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\cockos - pitch down.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\cockos - variable length delay.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - delay (with feedback).sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - huge massive speederupper.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - loop sampler.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - low res delay.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - mix to mono.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - resolution reduction.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - reverseness.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - simple delay.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - simple pitch and tempo (half-2x) control.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - simple volume control.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - stereo channel swap.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - stupid stereo voice removal.sps
C:\Program Files\Winamp\Plugins\DSP_SPS\justin - tremolo and pingpong.sps
C:\Program Files\Winamp\Plugins\enc_aacplus.dll
C:\Program Files\Winamp\Plugins\enc_flac.dll
C:\Program Files\Winamp\Plugins\enc_lame.dll
C:\Program Files\Winamp\Plugins\enc_wav.dll
C:\Program Files\Winamp\Plugins\enc_wma.dll
C:\Program Files\Winamp\Plugins\freeform\xml\about\about.maki
C:\Program Files\Winamp\Plugins\freeform\xml\about\about.xml
C:\Program Files\Winamp\Plugins\freeform\xml\about\BarcodeFont.ttf
C:\Program Files\Winamp\Plugins\freeform\xml\about\BarcodeFont.txt
C:\Program Files\Winamp\Plugins\freeform\xml\about\title.png
C:\Program Files\Winamp\Plugins\freeform\xml\about\wasabi.png
C:\Program Files\Winamp\Plugins\freeform\xml\checkbox\checkbox.xml
C:\Program Files\Winamp\Plugins\freeform\xml\combobox\combobox.xml
C:\Program Files\Winamp\Plugins\freeform\xml\dropdownlist\dropdownlist.xml
C:\Program Files\Winamp\Plugins\freeform\xml\guiobjects.xml
C:\Program Files\Winamp\Plugins\freeform\xml\historyeditbox\historyeditbox.m
C:\Program Files\Winamp\Plugins\freeform\xml\historyeditbox\historyeditbox.maki
C:\Program Files\Winamp\Plugins\freeform\xml\historyeditbox\historyeditbox.xml
C:\Program Files\Winamp\Plugins\freeform\xml\menubutton\menubutton.m
C:\Program Files\Winamp\Plugins\freeform\xml\menubutton\menubutton.maki
C:\Program Files\Winamp\Plugins\freeform\xml\menubutton\menubutton.xml
C:\Program Files\Winamp\Plugins\freeform\xml\msgbox\msgbox.xml
C:\Program Files\Winamp\Plugins\freeform\xml\pathpicker\pathpicker.xml
C:\Program Files\Winamp\Plugins\freeform\xml\popupmenu\popupitem.m
C:\Program Files\Winamp\Plugins\freeform\xml\popupmenu\popupitem.maki
C:\Program Files\Winamp\Plugins\freeform\xml\popupmenu\popupmenu.xml
C:\Program Files\Winamp\Plugins\freeform\xml\statusbar\statusbar.xml
C:\Program Files\Winamp\Plugins\freeform\xml\tabsheet\buttons.png
C:\Program Files\Winamp\Plugins\freeform\xml\tabsheet\tabsheet.xml
C:\Program Files\Winamp\Plugins\freeform\xml\titlebox\titlebox.xml
C:\Program Files\Winamp\Plugins\freeform\xml\tooltips\tooltips-elements.png
C:\Program Files\Winamp\Plugins\freeform\xml\tooltips\tooltips-elements.xml
C:\Program Files\Winamp\Plugins\freeform\xml\tooltips\tooltips.m
C:\Program Files\Winamp\Plugins\freeform\xml\tooltips\tooltips.maki
C:\Program Files\Winamp\Plugins\freeform\xml\tooltips\tooltips.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\fonts\button-font-normal.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\fonts\button-font-small.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\fonts\default-font.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\fonts\titlebar-font.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-button-pressed.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-button.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-left.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-middle.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-right.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\garbage\text_bg.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\menu\background.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\menu\selbar.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\menu\window-elements.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\Scripts\debug.sym
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\Scripts\standardframe.m
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\Scripts\standardframe.maki
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\Scripts\titlebar.m
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\Scripts\titlebar.maki
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\wasabi.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\background.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\error.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\framewnd-windowshade.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\scrollgrips.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\transparent.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\tree-sort-icon.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\window\window-elements.png
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\components.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\garbage-elements.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\buttonbar.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\objectframe.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\panel.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\window-embedded.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\window.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\old.system-colors.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\old.system-elements.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\system-colors.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\system-element-aliases.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\system-elements.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\system-groups.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\button\button.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\editbox\editbox.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\slider\slider.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\standardframe\standardframe-elements.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\standardframe\standardframe.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\text\text.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\titlebar\titlebar.xml
C:\Program Files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\xuiobjects.xml
C:\Program Files\Winamp\Plugins\gen_ff.dll
C:\Program Files\Winamp\Plugins\gen_hotkeys.dll
C:\Program Files\Winamp\Plugins\gen_jumpex.dll
C:\Program Files\Winamp\Plugins\gen_ml.dll
C:\Program Files\Winamp\Plugins\gen_ml.ini
C:\Program Files\Winamp\Plugins\gen_tray.dll
C:\Program Files\Winamp\Plugins\in_cdda.cdb
C:\Program Files\Winamp\Plugins\in_cdda.dll
C:\Program Files\Winamp\Plugins\in_dshow.dll
C:\Program Files\Winamp\Plugins\in_flac.dll
C:\Program Files\Winamp\Plugins\in_linein.dll
C:\Program Files\Winamp\Plugins\in_midi.dll
C:\Program Files\Winamp\Plugins\in_mod.dll
C:\Program Files\Winamp\Plugins\in_mp3.dll
C:\Program Files\Winamp\Plugins\in_mp4.dll
C:\Program Files\Winamp\Plugins\in_nsv.dll
C:\Program Files\Winamp\Plugins\in_vorbis.dll
C:\Program Files\Winamp\Plugins\in_wave.dll
C:\Program Files\Winamp\Plugins\in_wm.dll
C:\Program Files\Winamp\Plugins\lame_enc.dll
C:\Program Files\Winamp\Plugins\milk_img.ini
C:\Program Files\Winamp\Plugins\milk_msg.ini
C:\Program Files\Winamp\Plugins\milkdrop.html
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Anuera.milk
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Devil's Disco Night(Inverted Electron Flow rmx).milk
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Devil's Disco Night.milk
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Life in the drains.milk
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Radicalizing my brain cells.milk
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Soul Amplifier(Unreal remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\[Ishan] - Soul Amplifier.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Accelerator (Hot Lead Transfusion).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Agitator.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Airhandler (Last Breath - Calm).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Airhandler (Last Breath - Crab).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Airhandler (Principle of Sharing).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Arcworld (Arcwheel - Train Wheel).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Calabi-Jau Space Bar.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Chromatic Abyss (Refined Abyss Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Cinnamon Wrench (Candy Crane).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Contortion (Flair Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Curse of the Mirror Emu.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - ddummyy (04u0404).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Gemstone Factory.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Graft (First Rate Heart).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Gravity Lensing (Psycho Remorse).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Hard Drink (Half-Infinitea).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Kevlar Abyss.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Limit Edition (Some Days).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Madness Teaches us to Fly.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Negative Sun IV.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Potion of Spirits.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Pyrokinesis.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Songflower (Hybrid Plant).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Songflower (Moss Posy).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Soul Conductor.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Aderrasi - Straight Tropical Coal (Elysium Channel).milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - 4-20 =).milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - Baked Dimensions [Bass Trip].milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - Chinese Fingerbang (cao ni ma =]) - PieturP colors.milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - demon isolation.milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - insertion point.milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - mushroom rainbows[2].milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - mushroom rainbows[acid Storm].milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - Narcotic Hypnotic.milk
C:\Program Files\Winamp\Plugins\Milkdrop\baked - TraPped EnCounter.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Bmelgren - Acid Iris.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Bmelgren - Pentultimate Nerual Slipstream (Tweak 2).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Bmelgren & Krash - Rainbow Orb Peacock (Centred Journey Mix 2).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Bmelgren & Krash - Rainbow Orb Peacock (Lonely Signal Gone Mad Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Bmelgren & Krash - Rainbow Orb Peacock (Unknowable Mix 5).milk
C:\Program Files\Winamp\Plugins\Milkdrop\BrainStain-114 outside.milk
C:\Program Files\Winamp\Plugins\Milkdrop\BrainStain-Blackwidow.milk
C:\Program Files\Winamp\Plugins\Milkdrop\BrainStain-projection room.milk
C:\Program Files\Winamp\Plugins\Milkdrop\BrainStain-re entry.milk
C:\Program Files\Winamp\Plugins\Milkdrop\CatalystTheElder - Geometric_Entertainment_Freaky_Geometry_phat_frame_rate_edit.milk
C:\Program Files\Winamp\Plugins\Milkdrop\che - adela the flower.milk
C:\Program Files\Winamp\Plugins\Milkdrop\che - barcode infidelity.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Che - Burning Hus.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Che - Escape.milk
C:\Program Files\Winamp\Plugins\Milkdrop\che - terracarbon stream.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Che - Watch & Fly.milk
C:\Program Files\Winamp\Plugins\Milkdrop\DaNOnE - Highway to Heaven (rotating).milk
C:\Program Files\Winamp\Plugins\Milkdrop\EMPR - Random - Look mama, I'm on TV! 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - angels of decay.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - dark side of the moon (plus a few more hits and a pill).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 03 music.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 04 music minimal.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 05 and proton lights (+Krash's beat code) _Phat_remix02b.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 05 and proton lights (+Krash's beat code) _Phat_remix03 madhatter_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 05 and proton lights (+Krash's beat code) _Phat_remix07 recursive demons.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - heater core C_Phat's_class + sparks_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - heater core C_Phat's_on route_mix+beam.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - multisphere 01 B_Phat_Ra_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - nematodes E daemon.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - pointfield 09 the gases beyond 85c.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - pulsecube ee bounce.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 05 - rave on acid.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 08 - rave on a lot of acid and some K.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 13 - definitive fast.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 13 - definitive.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 15 - kaleidoscope b.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - sarc c_Phats Zoom Mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - spark C.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - spark C_Phat_Jester_Mix_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. - starburst 10 aurora distalis.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - CAT Scan (Nirvana flux).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - CAT Scan.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 08 nematode_Teal_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 11 sentinel C_poltergeist_mix response daemon.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 14 sentinel 616.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 18 hallway.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 19 Portal.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - cubetrace - v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. + Phat + fiShbRaiN + Redi Jedi - pictures of insanity(Run Away! Run Away! mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. 3d-glasses.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. and Zylot - skylight (Stained Glass Majesty mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. and Zylot and Phat - Pointfield 9 (Hypnotic Orbit_bass_responce_mix)_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S. planetfunk-10 - tracers E_phat_edit.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S._Phat Whale_soul-monitor danger - music.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - Arm_upgrades - transformer.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - Flare.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - Flare_dig_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - spectrum bubble field.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - spectrum bubble new colors WF2 chaos theory_cage.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - spectrum bubble new colors_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Cool Bug v2 + (Krash's beat detection).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat detached centerpoint_made_for_highest_texture_size.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat detached starpoint_Circle_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer - light in the distance.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer - pulsate B.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer - pulsate nubsy_pointer.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat last of it's kind_jungle_flower_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat last of it's kind_sinking.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Non-eucliden.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Quadrent_fractal.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Speak with the orb_more_colour_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Target_practice.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Eo.S.+Phat_whole_lota_tilein'_goin'_on_v4.milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN - betelguese.milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN - blueprint.milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN - planet x_Phat+Eo.S._inFlux_gravity well mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN - the machine that conquered the world (domination remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN - white scream firefly.milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN - witchcraft.milk
C:\Program Files\Winamp\Plugins\Milkdrop\fiShbRaiN + Eo.S._Phat - The Machine Final.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Fvese - Multi Circle.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Fvese - Round and Round (geiss gamma mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Fvese - Snowflake Like 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Fvese - The Tunnel (Final Stage Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Fvese - Zoom Effects (Remix 2).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Aieeeeee!!!.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Asymptote.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Bass Kaleidosphere.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Bass Zoom.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Bipolar 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Bipolar 5.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Bonfire.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Bright Fiber Matrix 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Calligraphy.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Cartographie.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Cepiasound.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Color Tones 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Constant Velocity.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Corpus Callosum.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Cosmic Dust 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Cosmic Dust 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Cruzin'.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Cycloid 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Davod The Pod.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - De La Moutard 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Descent.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Digital Smoke.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Downward Spiral.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Dynamic Swirls 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Eddies 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Eggs.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - El Cubismo.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Feedback 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Festive.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Fiberglass.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Flotsam.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Flower Blossom.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Four Kinds of Amphetamines.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Galaxy 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Greenland.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Happy Drops.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Heavenly 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - High Dynamic Range.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Hovering.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Hurricane.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Hyperion.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Inkblot.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Iris.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Julia Fractal 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Many Colors 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Mega Swirl 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Mega Swirl 3.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Microcosm.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Music Box.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Octopus Ever Changing.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Octopus Gold with Dots.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Octopus.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Pelota De Fuego.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Pistons.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Planet 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Reducto Absurdum.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Reducto Ad Nauseum.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Rocket.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Runoff.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Script.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Serpent.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Shake.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Shift.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Sinews 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Solar Flare.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Space Voyage (High-Warp).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Spacedust.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Starfish 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Supernova 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Surface.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Swirl 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Swirlie 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Swirlie 4.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Swirlie 5.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Three And A Half Kinds Of Amphetamines.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Trampoline.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Two-Pointed Pulsagon.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Ultrafast.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Volume Zoom.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Vortex 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Warp Of Dali 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss - Waterfall.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss & Rovastar - Notions Of Tonality 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss & Rovastar - The Chaos Of Colours (sprouting dimentia mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss & Rovastar - Tokamak (Naked Intrusion Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Geiss & TobiasWolfBoi - Cataract Slipstream.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Idiot - Cortex (Spiritual Visions Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\idiot - Forty Six and 2 (pushit!).milk
C:\Program Files\Winamp\Plugins\Milkdrop\idiot - Forty Six and 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\idiot - Nucleus.milk
C:\Program Files\Winamp\Plugins\Milkdrop\idiot - Random Water Colours (Justify my stupidity).milk
C:\Program Files\Winamp\Plugins\Milkdrop\idiot - Random Water Colours.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Idiot - Tentacle Dreams (Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Idiot - Typomatic (Remix 2).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Idiot - What Is.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Idiot & Che - Various Abstract Effects.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Illusion - Heavenly Eye.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Illusion & Rovastar - Clouded Bottle.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Illusion & Unchained - Frozen Eye 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Digital Flame.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Dynamic Borders 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Heatwaves.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - interwoven (nightmare weft).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - interwoven (nightmare weft)_Phats_Maybe_Ill_Go_To_A_Party.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Molten Indecision (Rozzor Hot Fast tweak).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Snowflake Halo.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - systolic pressure (Eo.S. remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Twisting Indecision.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Vinyl Disk.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - War Machine (Shifting Complexity Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash - Windowframe To Mega Swirl 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Fvese - Molten Indecision (Fvese Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Idiot - Memories Of The Castle.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Illusion - Spiral Movement.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - A Million Miles from Earth (Ripple Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Altars Of Madness (Mad Ocean Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S Golden Remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. hall of ghouls Remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Killer Death Bunny Remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Moire Remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Stars Remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Vortex Remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons (Distant Memory Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Rainbow Orb.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Switching Polygons.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Rovastar - The Devil Is In The Details.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Telek - Real Noughts and Crosses (Random Ending).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash & Zylot - Inside The Planar Portal (Indecision Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Krash + Eo.S. - Photographic Sentinel.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress - Acid Universes (Big Bang Interferences Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress - Acid Universes.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress - Acoustic Nerve Impulses (Primary Colors Of Sound Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress - Snowing Fiber City.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress & Darius - Pursuing The Sunset.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress & Juppy - Dancer.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Mstress & Zylot - Acid UFO.milk
C:\Program Files\Winamp\Plugins\Milkdrop\mstress and rovastar - carnival of madness (dancing worms) Studio Music Mod.milk
C:\Program Files\Winamp\Plugins\Milkdrop\nil - Cid and Lucy.milk
C:\Program Files\Winamp\Plugins\Milkdrop\nil - Disco Comet.milk
C:\Program Files\Winamp\Plugins\Milkdrop\nil - Vortex of Vortices.milk
C:\Program Files\Winamp\Plugins\Milkdrop\nil & EMPR - Electron Flow (Copper Wire Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\nil & EMPR - Ruby Nirvana.milk
C:\Program Files\Winamp\Plugins\Milkdrop\phat + Eo.S. - Bass_responce_Red_Movements_Disorienting nebula3.milk
C:\Program Files\Winamp\Plugins\Milkdrop\phat + Eo.S. - ouch.milk
C:\Program Files\Winamp\Plugins\Milkdrop\phat + Eo.S. - single cel angel birth.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat and Eo.S. _ shapes are cool smoke move2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Eo.S. Eyes_spiral_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Eo.S. rainbow bubble_mid3-###### me dood.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Eo.S._Data_swimmer.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Eo.S._Swim_waveform_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. I_hope_someone_will_see_this_triping_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. rainbow bubble_mid3-###### me dood-flash.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. spiral_faces_ravers_phantom.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. work with lines.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat+Eo.S_Mandala_Chasers_remix_Circles_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat+Eo.S_Mandala_Chasers_remix_spectrum.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat+fiShbRaiN+Eo.S_Mandala_Chasers_remix - www.eos4life.com.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Phat+fiShbRaiN+Eo.S_Mandala_Chasers_remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\PieturP - triptrap_(getting_concrete_visions_through_a_diafragma_version).milk
C:\Program Files\Winamp\Plugins\Milkdrop\PieturP - triptrap_(ultimate-trip-mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - acid in your brain.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - acid in your pants.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane 2 hits please.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane. no more!.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - atomic reaction.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - atoms in hell.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - brainfart remix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - i dont think those were portabello mushrooms.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - i think i took a wrong turn in a bad part of town.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - i was here till this came on.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - multiple points of origin, one destination.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - my pupil is big.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - off the fadar (no sweeps or bleeps, but alotta creeps).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - off the fadar.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - perplexium.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - pladman visits the sevendys.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - pladman.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - porthole to the underworld(dround in a vat of milk).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - porthole to the underworld(hit by a bus edition).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - quit smoking my water,you dick.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - static fusion.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - static ideas in a dynamic world.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - subspace of reality.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - triptacular to the max(maxtacular to the trip remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - welcome to the underworld(remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Redi Jedi - your radar may have a few kinks in it.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Reenen - phoenix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rocke - Cold Love (Tei Zwaa).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rocke - Personal Comet.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - A Million Miles From Earth (Drift Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - A Million Miles From Earth (Wormhole Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - A Million Miles from Earth.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Harlequin's Madness (Dark Disorder Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Harlequin's Madness.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Madness (Boxfresh Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Madness 4 (Spirit Of Twisted Madness Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Braindance 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Chapel Of Ghouls (Havok Plasma Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Chemical Spirituality.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Dark Ritual (Star Of Destiny Denied Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Dark Ritual (Star Of Destiny Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Demon Sunflower (Double Resistance Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Dreamcatcher.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Explosive Minds.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Eye On Reality (Mega 3 Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Forgotten Moon.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Fantic Dancing Lights Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Galaxy Swirl Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Upspoken Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Upspoken Mix)_Phat_Speak_When_Spoken_2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Halcyon Dreams 3.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Delight (Endless Tunnel Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Dynamic Fractal (Dual Spiral Mix ).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Dynamic Fractal 1.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Dynamic Fractal 3.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Fractal Encounter 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Fractal Encounter.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Liquid Dragon.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Living Wall.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Spirit (Twisted Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Hyperspace.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Inner Thoughts (Bright Dawn Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Jester's Awakening.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Jester's Calling 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Mosaics Of Ages.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Omnipresence Resurrection (Raw Mix)_Phat_Plazma_Soul_2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Oozing Resistance.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Paradigm Sphere.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Power Trip.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Sea Life.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Sea Shells.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Snapshot Of Space.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Solarized Space (Space DNA Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Solarized Space.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Starquake (Sunquake Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - The Chaos Of Colours.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - The Shroomery.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Timeless Voyage.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Tripmaker (Space Trip Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Tripmaker.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - Trippy S..milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Brainwaves.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Movement (After Dark Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Movement.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Organic Light.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Che - Adela The Flower (Altars Of Madness Mix 2).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Che - Asylum Animations.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Che - Definitly Not For The Epileptic (Inner Perspective Of Life Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Fvese - Dark Subconscious.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Fvese - Mosaic Waves.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Fvese - Paranormal Static.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Dynamic Swirls 3 (Broken Destiny Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Dynamic Swirls 3 (Smoke Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Dynamic Swirls 3 (Voyage Of Twisted Souls Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Hurricane Nightmare.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Ice Planet.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Octoplasm.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Idiot24-7 - Balk Acid.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Idiot24-7 - Mixed Emotions (Harlequin's Shame Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Krash - Cerebral Demons.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Krash - Rainbow Deflection.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Krash - Sweetness & Light.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Loadus - FractalDrop (Active Sparks Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Rocke - Sugar Spun Sister.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Telek - Altars of Madness (Rolling Oceans Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Ambrosia Mystic (Dark Heart Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Demonology (Vampire Soul Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Unclaimed Wreckage 2 (Mystic Stake Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Voodoo Chess Magnet (Everglow Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Azirphaeli's Plan (Multiplan Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Crystal Ball (Many Visions Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Inside The Transdimensional Portal.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Narell's Fever.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rozzor - Color Breaks its Boycott (shape mod).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rozzor & Rovastar - Altars Of Madness 3 (ooze tweak with custom wave).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rozzor & StudioMusic - Vertigyny (Geiss shape mod).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Rozzor and Idiot - Any Other Deep Rising.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Scanner (@ztec)2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - a thousand monkeys_phat_edit (subliminal mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - artefact.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - brain coral (left brained).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - brain coral.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - cellular_Phat_Spinny_Slide_mix_v2_Time_Mod_tan.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - cellular_Phat_Spinny_Swimmer_mix_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - cellular_Phat_YAK_Infusion_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - deep sea hydra spectrum.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - digi.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - escape the worm - Eo.S. + Phat - Before_It_Eats_Your_Brain_Mix_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - escape the worm - Eo.S. + Phat 5362.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - feathers (angel wings).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - fractal grinder (opalescent).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - fractal grinder.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - fuzzball.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - glassworms flare.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - kiwi fruit.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - lattice (eclipse) Phat + Eo.S. more color mix_v2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - lazerspecs_phat_edit.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - mandala.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - morphid.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - neon pulse (reactive).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - pipes (metallic).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - ralter oilslick b.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - robotopia.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - spincycle c.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - swarm.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - tadpole evolution (static mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - tumbling cubes.milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter - urchin mod.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (Bubble Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (inside the neural net).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (shattered mind).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (Slide Plane).milk
C:\Program Files\Winamp\Plugins\Milkdrop\shifter & fiShbRaiN - witchcraft (i'm melting).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - (Sex is like math) Add the bed, subtract the clothes, divide the legs and hope to hell you don't multiply.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - Cherished Desires.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - Intuitive Awareness (stimulus effect mix) .milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - Intuitive Awareness (Traces of Love mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - Personification.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - Quick Fix (dramatic mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music - Take Your Pick (Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music & Unchained - Just Ain't Right (It's alright though Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music & Unchained + Phat and E.o.S - How it feel's to be Alive.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music and Redi Jedi - Passionate Behavior.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Studio Music and Redi Jedi - Shimmering Love (remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\StudioMusic - Harmonic Bliss (elated mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\StudioMusic - Twisted Galaxy.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Tag - Cradle of Life(remix of yin 315).milk
C:\Program Files\Winamp\Plugins\Milkdrop\TEcHNO & SandStorm - Psychodelic Highway.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Telek - City Helix Lattice.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Telek - Directive Swagger (Spectral Inferno) (fix…) maybe.. YES.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Telek - Globetrotting (Sailors Delight Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Telek - Slow Shift Matrix (bb4.5).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Telek - Target Practice (tracking, retreat, slide).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Telek EMPR - Scanner - Trust me, I've got a Melways.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - A Matter Of Taste (Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - All You Can Eat.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Beat Demo (Demonology Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Beat Demo 1.0.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Cartoon Factory.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Cranked On Failure.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Custom Gramatix (Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - French Clothing.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Games With Light & Sound.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - God Of The Game (Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Goo Kung Fu.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Goofy Beat Detection.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Housed In A Childish Mind.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Jaded Emotion.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Jaundice.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Making a Science of It 4.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Morat's Final Voyage.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Painful Plasma (Multi-Wave Mirrored Rage) – Rozzor triangle tweak.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Perverted Dialect.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Picture Of Poison.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Proper Identification (Breaks Remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Resistance.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Ribald Ballad.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Unclaimed Wreckage 2 (Shamanic).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained - Unified Drag 2.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained & Che - Oddnezz 3.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained & Illusion - Logic Morph.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained & Rovastar - Rainbow Obscura.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Unchained & Rovastar - Xen Traffic.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Valhala - Core.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Valhala - FallingUp.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Valhala - HappyTrip.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Valhala - Sound Reactror.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Valhala - The all seeing eyeV0.4.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Vovan - Bass With Flover.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 240 - Electric universe.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 250 - Artificial poles of the continuum.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 250 - Artificial poles of the continuum_Phat's_star_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 253 - Artificial poles of the continuum (remix #3).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 280 - Coming home.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 290 - Sonic brainstorm.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 293 - Sonic brainstorm (inner state - group experience mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 300 - Daydreamer.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 302 - Daydreamer (remix 2).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 311 - Ocean of Light (bouncing off mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 313 - Ocean of Light (ESP).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 315 - Ocean of Light (yo im peakin yo Eo.S.-Phat).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 317 - Ocean of Light (y remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 321 - Pastel fantasies (remix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 324 - Pastel fantasies (beat sensitive liquid heaven color leak mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 325 - Pastel fantasies (angelic intervention).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 326 - Pastel fantasies (angelic intervention harmonic solo)_Phats_slow_mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 327 - Pastel fantasies (freeform funk).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin - 340 - Under the sun (resonant consciousness 2005).milk
C:\Program Files\Winamp\Plugins\Milkdrop\yin + Phat + Eo.S. - Dreams of Blood.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Block Of Sound (Abstract Architecture Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Block Of Sound (Fractal Construction Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Burning Passion.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Color Of Music.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Crosshair Dimension (Light of Ages).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Digiscape Advanced Processor.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - DISCO INFERNO.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Fusion.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - light of the path.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Magma Crawl.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Mixing Pot.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Present for Saddam.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Psyonist (New Eyes Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Rainbow Planet Under Attack.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Riding The Sound Waves.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Rush.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - S. Pulse Virus.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Spiral (Hypnotic)_Phat_Double_Spiral_Mix.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Tunnel Of Illusion.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Visionarie (geiss aspect ratio fix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot - Wisps.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Aderrasi - Oceanic Bassograph (New Jersey Shore Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Boz - Spirit Energy (Angry Soul's reMix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Idiot - ATan2 Demo (Spiraling Mad Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Krash - Extremophile.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Mstress - Celebrate.milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Rovastar - Crystal Ball (Cerimonial Decor Mix).milk
C:\Program Files\Winamp\Plugins\Milkdrop\Zylot & Rovastar - Iouo Stone Morphic Fusion.milk
C:\Program Files\Winamp\Plugins\milkdrop_preset_authoring.html
C:\Program Files\Winamp\Plugins\ml\cache\dashboard.wb
C:\Program Files\Winamp\Plugins\ml\default.vmd
C:\Program Files\Winamp\Plugins\ml\feeds.xml
C:\Program Files\Winamp\Plugins\ml\main.dat
C:\Program Files\Winamp\Plugins\ml\main.idx
C:\Program Files\Winamp\Plugins\ml\metE3BE.vmd
C:\Program Files\Winamp\Plugins\ml\metE3CE.vmd
C:\Program Files\Winamp\Plugins\ml\metE3DE.vmd
C:\Program Files\Winamp\Plugins\ml\metE3ED.vmd
C:\Program Files\Winamp\Plugins\ml\metF390.vmd
C:\Program Files\Winamp\Plugins\ml\metF3A0.vmd
C:\Program Files\Winamp\Plugins\ml\metF3B0.vmd
C:\Program Files\Winamp\Plugins\ml\ml_dash.ini
C:\Program Files\Winamp\Plugins\ml\ml_online.ini
C:\Program Files\Winamp\Plugins\ml\playlists.xml
C:\Program Files\Winamp\Plugins\ml\recent.dat
C:\Program Files\Winamp\Plugins\ml\recent.idx
C:\Program Files\Winamp\Plugins\ml\rss.xml
C:\Program Files\Winamp\Plugins\ml_bookmarks.dll
C:\Program Files\Winamp\Plugins\ml_dash.dll
C:\Program Files\Winamp\Plugins\ml_disc.dll
C:\Program Files\Winamp\Plugins\ml_history.dll
C:\Program Files\Winamp\Plugins\ml_local.dll
C:\Program Files\Winamp\Plugins\ml_nowplaying.dll
C:\Program Files\Winamp\Plugins\ml_online.dll
C:\Program Files\Winamp\Plugins\ml_playlists.dll
C:\Program Files\Winamp\Plugins\ml_pmp.dll
C:\Program Files\Winamp\Plugins\ml_rg.dll
C:\Program Files\Winamp\Plugins\ml_transcode.dll
C:\Program Files\Winamp\Plugins\ml_wire.dll
C:\Program Files\Winamp\Plugins\nscrt.dll
C:\Program Files\Winamp\Plugins\nsvdec_vp5.dll
C:\Program Files\Winamp\Plugins\nsvdec_vp6.dll
C:\Program Files\Winamp\Plugins\out_disk.dll
C:\Program Files\Winamp\Plugins\out_ds.dll
C:\Program Files\Winamp\Plugins\out_wave.dll
C:\Program Files\Winamp\Plugins\pmp_activesync.dll
C:\Program Files\Winamp\Plugins\pmp_ipod.dll
C:\Program Files\Winamp\Plugins\pmp_njb.dll
C:\Program Files\Winamp\Plugins\pmp_p4s.dll
C:\Program Files\Winamp\Plugins\pmp_usb.dll
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\help.htm
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\media_library.jpg
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\media_library_button_row.jpg
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\musicmagic_plugin.jpg
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\musicmagic_recommendations.jpg
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Predixis_WinAmpScrnLogo.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_BL_Cornr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_BottomStretchr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_BR_Cornr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_LeftStretchr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_RightStretchr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_TopL_Cornr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_topStretcher.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_TR_Cornr.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\WinampParty.jpg
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\images\WinAmpScreen1HDR.gif
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\index.htm
C:\Program Files\Winamp\Plugins\Predixis MusicMagic\predixis_winamp.css
C:\Program Files\Winamp\Plugins\q_and_t_vars.gif
C:\Program Files\Winamp\Plugins\read_file.dll
C:\Program Files\Winamp\Plugins\ReplayGainAnalysis.dll
C:\Program Files\Winamp\Plugins\vis_avs.dat
C:\Program Files\Winamp\Plugins\vis_avs.dll
C:\Program Files\Winamp\Plugins\vis_milk.dll
C:\Program Files\Winamp\Plugins\vis_nsfs.dll
C:\Program Files\Winamp\Plugins\vms_desktop.dll
C:\Program Files\Winamp\primosdk.DLL
C:\Program Files\Winamp\Skins\Winamp Modern\about\about.maki
C:\Program Files\Winamp\Skins\Winamp Modern\about\about.xml
C:\Program Files\Winamp\Skins\Winamp Modern\about\about_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\about\about_bolt.png
C:\Program Files\Winamp\Skins\Winamp Modern\about\about_fg.png
C:\Program Files\Winamp\Skins\Winamp Modern\about\about_star.png
C:\Program Files\Winamp\Skins\Winamp Modern\about\eye.png
C:\Program Files\Winamp\Skins\Winamp Modern\notifier\notif-bg-alpha.png
C:\Program Files\Winamp\Skins\Winamp Modern\notifier\notif-bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\beat_displayoverlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\beat_l2.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\beat_left.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\beat_r2.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\beat_right.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\beat_textoverlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\bolt.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_balance.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_config_drawer.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_ct_switch.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_eq.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_mute.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_mute_bg.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_repeat2.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_shufflerepeat.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_videoavs.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\button_volume.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_detach.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_eq.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_mlpl.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_mlpl_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_pl.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_switchto.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_video.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\buttons_vis.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\config_tabs.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\ct_background.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\ct_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\display.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\displayoverlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\drawer_bg.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\drawer_bg_regions.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\drawer_shadow.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\eq_balance.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\Eq_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\eq_textoverlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\main_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\mainregions.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\menubar.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\numfont.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\openclose_overlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\options_bg.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\Options_buttons.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\options_buttons2.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\Options_elements.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\options_more.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\options_scrollbuttons.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\options_slider.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\pe_time.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\pe_time_font.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\playbackstatus.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\player_buttons.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\player_buttons_status.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\progressbar.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\resize_pl.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\resizer.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\seekbar.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\seekpos.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\shufflerepeat_bg.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\shufflerepeat_led.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\smallfont.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\songinfo.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\songinfofont.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\Songtickerfont.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\txt_config.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\player\videoavs_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\videoavs_button_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\videoavs_button_bg2.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\videoavs_button_overlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\videoavs_buttonup_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\videoavs_buttonup_bg2.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\visualization_background.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\visualization_overlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\player\volume_bar_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\attribs.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\beatvisualization.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\beatvisualization.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\buildall.bat
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\configtabs.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\configtabs.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\configtarget.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\configtarget.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\crossfade.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\crossfade.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\debug.sym
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\display.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\display.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\drawer.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\eq.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\eq.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mainmenu.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mainmenu.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mainmenuoverlay.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mainmenuoverlay.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mlmenu.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mlmenu.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mute.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\mute.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\notifications_fade_times.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\notifier.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\notifier.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\plmenu.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\plmenu.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\pltime.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\pltime.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\seek.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\seek.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\seekshade.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\seekshade.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\shadecontrol.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\shadecontrol.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\shadesizepos.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\shadesizepos.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\songinfo.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\songinfo.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\standardframe.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\standardframe.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\titlebar.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\titlebar.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\video.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\video.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\videoavs.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\videoavs.maki
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\vis.m
C:\Program Files\Winamp\Skins\Winamp Modern\scripts\vis.maki
C:\Program Files\Winamp\Skins\Winamp Modern\shade\bg_overlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\buttons.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\buttons_bg.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\buttons2.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\shade\corners.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\display_overlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\led.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\pl_shade.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\playbackstatus.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\seek.png
C:\Program Files\Winamp\Skins\Winamp Modern\shade\shade_bg.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\shade\songtickerfont.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\shade\volume.png
C:\Program Files\Winamp\Skins\Winamp Modern\skin.xml
C:\Program Files\Winamp\Skins\Winamp Modern\standardframe\standardframe-elements.xml
C:\Program Files\Winamp\Skins\Winamp Modern\standardframe\standardframe.xml
C:\Program Files\Winamp\Skins\Winamp Modern\standardframe\window_menus.xml
C:\Program Files\Winamp\Skins\Winamp Modern\titlebar\titlebar.xml
C:\Program Files\Winamp\Skins\Winamp Modern\window\background.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\main.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\main2.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\menu.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\mlwindow.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\plwindow.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\scrollbars.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\Scrollgrips.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\titlebar.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\titlebar_overlay.png
C:\Program Files\Winamp\Skins\Winamp Modern\window\wasabi_window.PNG
C:\Program Files\Winamp\Skins\Winamp Modern\window\window-elements.png
C:\Program Files\Winamp\Skins\Winamp Modern\xml\color-presets.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\configdrawer.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\ml-normal.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\ml.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\notifier-elements.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\notifier-normal.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\notifier.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player-elements-shade.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player-elements.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player-normal-group.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player-normal.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player-shade-group.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player-shade.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\player.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\pledit-normal.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\pledit-shade-group.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\pledit-shade.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\pledit.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\system-colors.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\video-normal.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\video.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\vis-normal.xml
C:\Program Files\Winamp\Skins\Winamp Modern\xml\vis.xml
C:\Program Files\Winamp\studio.xnf
C:\Program Files\Winamp\System\aacPlusDecoder.w5s
C:\Program Files\Winamp\System\db.w5s
C:\Program Files\Winamp\System\filereader.w5s
C:\Program Files\Winamp\System\jnetlib.w5s
C:\Program Files\Winamp\System\jpeg.w5s
C:\Program Files\Winamp\System\playlist.w5s
C:\Program Files\Winamp\System\png.w5s
C:\Program Files\Winamp\System\tagz.w5s
C:\Program Files\Winamp\System\xml.w5s
C:\Program Files\Winamp\tristyn.m3u
C:\Program Files\Winamp\UninstWA.exe
C:\Program Files\Winamp\whatsnew.txt
C:\Program Files\Winamp\Winamp.bm
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Winamp\Winamp.ini
C:\Program Files\Winamp\winamp.lks
C:\Program Files\Winamp\winamp.m3u
C:\Program Files\Winamp\Winamp.m3u8
C:\Program Files\Winamp\Winamp.q1
C:\Program Files\Winamp\winampa .exe
C:\Program Files\Winamp\winampmb.htm
C:\Program Files\Windows Defender
C:\Program Files\Windows Defender\MSASCui .exe
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\autluuas.exe.bad
C:\VundoFix Backups\ayymbnwe.dll.bad
C:\VundoFix Backups\clnfhkol.dll.bad
C:\VundoFix Backups\ddayy.dll.bad
C:\VundoFix Backups\ddayy.exe.bad
C:\VundoFix Backups\jayuohql.dll.bad
C:\VundoFix Backups\kxmxifom.exe.bad
C:\VundoFix Backups\lqhouyaj.ini.bad
C:\VundoFix Backups\pmnliif.dll.bad
C:\VundoFix Backups\qaarwxrq.dll.bad
C:\VundoFix Backups\rhvgoqcs.exe.bad
C:\VundoFix Backups\ukcbsqfd.dll.bad
C:\VundoFix Backups\uqqimqqh.exe.bad
C:\VundoFix Backups\vyihujgk.dll.bad
C:\VundoFix Backups\wxmpvgtn.dll.bad
C:\VundoFix Backups\yyadd.ini.bad
C:\VundoFix Backups\yyadd.ini2.bad
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\ddayy.dll
C:\WINDOWS\system32\ddayy.exe
C:\WINDOWS\system32\dsrqdhpb.ini
C:\WINDOWS\system32\iuoatgvo.ini
C:\WINDOWS\system32\nleyvafv.ini
C:\WINDOWS\system32\oppdmahv.ini
C:\WINDOWS\system32\RCX27.tmp
C:\WINDOWS\system32\RCX2B.tmp
C:\WINDOWS\system32\tfmxlaqa.ini
C:\WINDOWS\system32\yyadd.ini
C:\WINDOWS\system32\yyadd.ini2

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))
.

2007-12-29 11:19 . 2006-12-15 02:09 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2007-12-28 00:26 . 2007-12-28 00:26 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 00:25 . 2007-12-28 00:25 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-19 18:40 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2007-12-19 18:38 . 2007-12-19 18:38 d——– C:\Program Files\Microsoft.NET
2007-12-19 18:34 . 2007-12-19 18:53 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-19 18:33 . 2007-12-19 18:33 dr-h—– C:\MSOCache
2007-12-01 12:03 . 2007-12-29 09:38 d——– C:\Documents and Settings\Owner\Shared
2007-12-01 12:03 . 2007-12-29 09:38 d——– C:\Documents and Settings\Owner\Incomplete
2007-12-01 12:02 . 2007-12-01 12:02 d——– C:\Program Files\LimeWire
2007-12-01 12:02 . 2007-12-26 12:30 d——– C:\Documents and Settings\Owner\Application Data\LimeWire
2007-11-29 17:35 . 2004-08-04 12:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-29 18:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-28 21:52 11,706,400 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-28 16:14 ——— d—–w C:\Program Files\Java
2007-12-28 16:08 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 08:30 137,564 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-28 07:27 ——— d—–w C:\Program Files\Lavasoft
2007-12-28 07:27 ——— d—–w C:\Documents and Settings\Owner\Application Data\Lavasoft
2007-12-20 03:49 ——— d—–w C:\Documents and Settings\Owner\Application Data\U3
2007-12-20 01:39 ——— d—–w C:\Program Files\Microsoft Works
2007-12-04 14:56 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-29_ 9.38.32.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-09-25 05:30:28 135,168 —-a-w C:\WINDOWS\system32\java.exe
+ 2006-12-15 07:30:58 49,248 —-a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 05:30:30 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2006-12-15 07:31:06 53,346 —-a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 06:31:42 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2006-12-15 09:09:14 127,078 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2007-12-30 19:03:36 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_6a4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-09-17 07:19:14]
V CAST Music Monitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe [2005-11-30 11:32:10]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-02-08 14:03 278528 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 –a—— C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6adc7af9-cd74-11d9-b105-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

.
Contents of the 'Scheduled Tasks' folder
"2005-12-25 16:33:56 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 12:04:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-30 12:08:29 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt 2007-12-30 19:08:01
C:\qoobox\ComboFix2.txt 2007-12-29 16:39:20
.
2007-12-13 10:04:01 — E O F —

Trevuren

Post #6December 29, 2007, 8:12 PM UTC

You did well but it appears that the infection has reached your Antivirus. So we continue: I strongly recommend that you print out a copy of the instructions (Steps A through H inclusively) as you will be off line during those steps and unable to read my instructions.

A. Download a fresh copy of Avast from the internet and keep it on your desktop until required.

B. Physically unplug your system from the Internet.

C. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

D. Restart your system in case HijackThis does not ask you to do so itself.

E. Now using the Add/Remove program module, please UNINSTALL Avast.

F. Using Windows Explorer, (Windows key + E), locate and DELETE the following folder, if still present:

C:\Program Files\Alwil

G. Now, still disconnected from the internet, reinstall Avast with the installer that you previously downloaded to your desktop and configure the program as best you can without going online.

H. Plug your system back into the Internet and update Avast to its latest definitions.

I. Now run ComboFix again as we did at the very beginning and keep a copy of the log.

J. Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component. This process will take about 60 minutes or so depending on the amount of data it has to scan.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.

Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:Scan Archives
  Scan Mail Bases
Click OK and, under select a target to scan, select My Computer

When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log and a copy of the newly run ComboFix.txt

Deleted Member

Post #7December 29, 2007, 10:16 PM UTC

ComboFix 07-12-30.1 - Owner 2007-12-30 15:10:20.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.487 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))
.

2007-12-30 13:44 . 2007-12-30 13:44 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-30 13:44 . 2007-12-30 13:44 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-30 13:32 . 2007-12-30 13:32 d——– C:\Program Files\Alwil Software
2007-12-30 13:32 . 2007-12-04 06:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-12-30 13:32 . 2004-01-09 02:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2007-12-30 13:32 . 2007-12-04 05:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-12-30 13:32 . 2007-12-04 07:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-30 13:32 . 2007-12-04 07:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-30 13:32 . 2007-12-04 07:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-30 13:32 . 2007-12-04 07:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-30 13:32 . 2007-12-04 07:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 11:19 . 2006-12-15 02:09 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2007-12-28 00:26 . 2007-12-28 00:26 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 00:25 . 2007-12-28 00:25 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-19 18:40 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2007-12-19 18:38 . 2007-12-19 18:38 d——– C:\Program Files\Microsoft.NET
2007-12-19 18:34 . 2007-12-19 18:53 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-19 18:33 . 2007-12-19 18:33 dr-h—– C:\MSOCache
2007-12-01 12:03 . 2007-12-30 15:09 d——– C:\Documents and Settings\Owner\Shared
2007-12-01 12:03 . 2007-12-30 15:10 d——– C:\Documents and Settings\Owner\Incomplete
2007-12-01 12:02 . 2007-12-01 12:02 d——– C:\Program Files\LimeWire
2007-12-01 12:02 . 2007-12-26 12:30 d——– C:\Documents and Settings\Owner\Application Data\LimeWire
2007-11-29 17:35 . 2004-08-04 12:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-30 21:59 145,628 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-30 21:59 12,335,136 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-29 18:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-29 02:30 8,079,468 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-28 16:14 ——— d—–w C:\Program Files\Java
2007-12-28 16:08 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 07:27 ——— d—–w C:\Program Files\Lavasoft
2007-12-28 07:27 ——— d—–w C:\Documents and Settings\Owner\Application Data\Lavasoft
2007-12-20 03:49 ——— d—–w C:\Documents and Settings\Owner\Application Data\U3
2007-12-20 01:39 ——— d—–w C:\Program Files\Microsoft Works
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 00:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-29_ 9.38.32.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-09-25 05:30:28 135,168 —-a-w C:\WINDOWS\system32\java.exe
+ 2006-12-15 07:30:58 49,248 —-a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 05:30:30 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2006-12-15 07:31:06 53,346 —-a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 06:31:42 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2006-12-15 09:09:14 127,078 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 19:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-12-30 22:00:45 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_604.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 06:00]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-09-17 07:19:14]
V CAST Music Monitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe [2005-11-30 11:32:10]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-02-08 14:03 278528 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 –a—— C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6adc7af9-cd74-11d9-b105-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

*Newly Created Service* - ASWUPDSV
*Newly Created Service* - AVAST!_ANTIVIRUS
*Newly Created Service* - AVAST!_MAIL_SCANNER
*Newly Created Service* - AVAST!_WEB_SCANNER
.
Contents of the 'Scheduled Tasks' folder
"2005-12-25 16:33:56 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 15:12:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-30 15:13:20
C:\qoobox\ComboFix-quarantined-files.txt 2007-12-30 22:13:12
C:\qoobox\ComboFix2.txt 2007-12-30 21:58:47
C:\qoobox\ComboFix3.txt 2007-12-30 20:41:57
C:\qoobox\ComboFix4.txt 2007-12-30 19:08:30
C:\qoobox\ComboFix5.txt 2007-12-29 16:39:20
.
2007-12-13 10:04:01 — E O F —

ComboFix 07-12-30.1 - Owner 2007-12-30 15:10:20.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.487 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))
.

2007-12-30 13:44 . 2007-12-30 13:44 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-30 13:44 . 2007-12-30 13:44 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-30 13:32 . 2007-12-30 13:32 d——– C:\Program Files\Alwil Software
2007-12-30 13:32 . 2007-12-04 06:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-12-30 13:32 . 2004-01-09 02:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2007-12-30 13:32 . 2007-12-04 05:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-12-30 13:32 . 2007-12-04 07:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-30 13:32 . 2007-12-04 07:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-30 13:32 . 2007-12-04 07:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-30 13:32 . 2007-12-04 07:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-30 13:32 . 2007-12-04 07:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 11:19 . 2006-12-15 02:09 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2007-12-28 00:26 . 2007-12-28 00:26 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 00:25 . 2007-12-28 00:25 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-19 18:40 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2007-12-19 18:38 . 2007-12-19 18:38 d——– C:\Program Files\Microsoft.NET
2007-12-19 18:34 . 2007-12-19 18:53 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-19 18:33 . 2007-12-19 18:33 dr-h—– C:\MSOCache
2007-12-01 12:03 . 2007-12-30 15:09 d——– C:\Documents and Settings\Owner\Shared
2007-12-01 12:03 . 2007-12-30 15:10 d——– C:\Documents and Settings\Owner\Incomplete
2007-12-01 12:02 . 2007-12-01 12:02 d——– C:\Program Files\LimeWire
2007-12-01 12:02 . 2007-12-26 12:30 d——– C:\Documents and Settings\Owner\Application Data\LimeWire
2007-11-29 17:35 . 2004-08-04 12:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-30 21:59 145,628 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-30 21:59 12,335,136 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-29 18:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-29 02:30 8,079,468 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-28 16:14 ——— d—–w C:\Program Files\Java
2007-12-28 16:08 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 07:27 ——— d—–w C:\Program Files\Lavasoft
2007-12-28 07:27 ——— d—–w C:\Documents and Settings\Owner\Application Data\Lavasoft
2007-12-20 03:49 ——— d—–w C:\Documents and Settings\Owner\Application Data\U3
2007-12-20 01:39 ——— d—–w C:\Program Files\Microsoft Works
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 00:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-29_ 9.38.32.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-09-25 05:30:28 135,168 —-a-w C:\WINDOWS\system32\java.exe
+ 2006-12-15 07:30:58 49,248 —-a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 05:30:30 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2006-12-15 07:31:06 53,346 —-a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 06:31:42 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2006-12-15 09:09:14 127,078 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 19:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-12-30 22:00:45 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_604.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 06:00]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-09-17 07:19:14]
V CAST Music Monitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe [2005-11-30 11:32:10]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-02-08 14:03 278528 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 –a—— C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6adc7af9-cd74-11d9-b105-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

*Newly Created Service* - ASWUPDSV
*Newly Created Service* - AVAST!_ANTIVIRUS
*Newly Created Service* - AVAST!_MAIL_SCANNER
*Newly Created Service* - AVAST!_WEB_SCANNER
.
Contents of the 'Scheduled Tasks' folder
"2005-12-25 16:33:56 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 15:12:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-30 15:13:20
C:\qoobox\ComboFix-quarantined-files.txt 2007-12-30 22:13:12
C:\qoobox\ComboFix2.txt 2007-12-30 21:58:47
C:\qoobox\ComboFix3.txt 2007-12-30 20:41:57
C:\qoobox\ComboFix4.txt 2007-12-30 19:08:30
C:\qoobox\ComboFix5.txt 2007-12-29 16:39:20
.
2007-12-13 10:04:01 — E O F —

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, December 30, 2007 2:53:34 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 29/12/2007
Kaspersky Anti-Virus database records: 500065
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 42070
Number of viruses found: 10
Number of infected objects: 169
Number of suspicious objects: 0
Duration of the scan process: 00:52:29

Infected Object Name / Virus Name / Last Action
C:\2A.tmp/stream/data0002 Infected: not-a-virus:Downloader.Win32.Agent.q skipped
C:\2A.tmp/stream/data0003 Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\2A.tmp/stream Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\2A.tmp NSIS: infected - 3 skipped
C:\2F.tmp/stream/data0002 Infected: not-a-virus:Downloader.Win32.Agent.q skipped
C:\2F.tmp/stream/data0003 Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\2F.tmp/stream Infected: not-a-virus:AdWare.Win32.Agent.ay skipped
C:\2F.tmp NSIS: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007123020071231\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\hsperfdata_Owner\1636 Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Shared\02 Track 2.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\Documents and Settings\Owner\Shared\07 Track 7.wma Infected: Trojan-Downloader.WMA.Wimad.l skipped
C:\qoobox\Quarantine\C\Program Files\ALWILS~1\Avast4\ashDisp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\CyberLink\PowerDVD\PDVDServ.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\ISM\ism.exe.vir Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\qoobox\Quarantine\C\Program Files\Java\jre1.5.0_11\bin\jusched.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\Java\jre1.6.0_03\bin\jusched.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QdrModule\QdrModule11.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\QuickTime\qttask .exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\Winamp\winampa.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\Program Files\Windows Defender\MSASCui.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\VundoFix Backups\autluuas.exe.bad.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\qoobox\Quarantine\C\VundoFix Backups\ddayy.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\VundoFix Backups\kxmxifom.exe.bad.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\qoobox\Quarantine\C\VundoFix Backups\pmnliif.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\qoobox\Quarantine\C\VundoFix Backups\rhvgoqcs.exe.bad.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\qoobox\Quarantine\C\VundoFix Backups\ukcbsqfd.dll.bad.vir Infected: Trojan.Win32.Pakes.bwd skipped
C:\qoobox\Quarantine\C\VundoFix Backups\uqqimqqh.exe.bad.vir Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\ddayy.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX27.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX2B.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054809.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054810.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054811.dll Infected: Backdoor.Win32.Agent.dlj skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054812.dll Infected: Backdoor.Win32.Agent.dlj skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054813.dll Infected: Backdoor.Win32.Agent.dlj skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054822.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054827.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054828.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054829.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054830.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054831.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054832.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054833.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054834.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054835.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054862.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054872.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054873.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054874.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054876.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054877.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054879.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054880.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP831\A0054881.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055013.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055014.dll Infected: Backdoor.Win32.Agent.dlj skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055027.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055028.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055029.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055030.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055031.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055037.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055038.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055043.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055074.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055086.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055087.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055088.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055089.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055090.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055091.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055092.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0055093.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056087.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056088.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056089.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056090.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056091.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056095.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056097.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056100.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056101.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP832\A0056106.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056150.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056154.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056158.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056159.dll Infected: Trojan.Win32.Pakes.bwd skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056160.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056163.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056178.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056182.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056184.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056185.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056186.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056187.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056188.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056212.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056215.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056216.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056217.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056218.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056220.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056221.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056222.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056233.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056234.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056248.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056254.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056256.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056257.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP833\A0056258.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057234.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057246.Exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057256.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057258.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057259.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057260.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057261.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057264.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057278.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057287.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057288.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057289.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057290.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057292.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057293.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP835\A0057294.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057326.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057327.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057328.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057329.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057331.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057332.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057333.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP836\A0057335.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP837\A0057342.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP837\A0057345.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP837\A0058278.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058333.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058334.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058335.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058336.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058337.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058338.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058362.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058363.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP838\A0058364.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP840\A0058494.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP841\A0058545.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP842\A0058660.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP842\A0058661.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP842\A0058662.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058666.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058667.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058668.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058675.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058676.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058677.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058678.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058679.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058680.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\A0058681.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\TRISTYN.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{A68A1955-1205-4D55-A18B-03D724B98872}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG Object is locked skipped
C:\WINDOWS\system32\ctfmon.exe.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\ZLT00772.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT00776.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP843\change.log Object is locked skipped

Scan process completed.

Trevuren

Post #8December 29, 2007, 10:55 PM UTC

Now things are looking pretty good. A bit of clean up to do and we should be good to go. We have had a good day!!!

A.

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\2A.tmp
C:\2F.tmp
C:\Documents and Settings\Owner\Shared\02 Track 2.wma
C:\Documents and Settings\Owner\Shared\07 Track 7.wma
C:\WINDOWS\system32\ctfmon.exe.tmp

KillAll::

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Next, re-enable all the programs that you disabled prior to running ComboFix.

8. Post the following logs/Reports:

ComboFix.txt
Fresh HijackThis log run after all the other tools have performed their cleanup.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

B. After running ComboFix, please include with the reports your opinion of how your system is now running. If all appears to be alright, give me the OK and we will proceed with the final cleanup proxedures and recommendations.

Deleted Member

Post #9December 29, 2007, 11:19 PM UTC

ComboFix 07-12-30.1 - Owner 2007-12-30 16:04:12.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.573 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\2A.tmp
C:\2F.tmp
C:\Documents and Settings\Owner\Shared\02 Track 2.wma
C:\Documents and Settings\Owner\Shared\07 Track 7.wma
C:\WINDOWS\system32\ctfmon.exe.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2A.tmp
C:\2F.tmp
C:\Documents and Settings\Owner\Shared\02 Track 2.wma
C:\Documents and Settings\Owner\Shared\07 Track 7.wma
C:\WINDOWS\system32\ctfmon.exe.tmp

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))
.

2007-12-30 13:44 . 2007-12-30 13:44 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-30 13:44 . 2007-12-30 13:44 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-30 13:32 . 2007-12-30 13:32 d——– C:\Program Files\Alwil Software
2007-12-30 13:32 . 2007-12-04 06:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-12-30 13:32 . 2004-01-09 02:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2007-12-30 13:32 . 2007-12-04 05:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-12-30 13:32 . 2007-12-04 07:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-30 13:32 . 2007-12-04 07:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-30 13:32 . 2007-12-04 07:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-30 13:32 . 2007-12-04 07:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-30 13:32 . 2007-12-04 07:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 11:19 . 2006-12-15 02:09 49,265 –a—— C:\WINDOWS\system32\jpicpl32.cpl
2007-12-28 00:26 . 2007-12-28 00:26 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 00:25 . 2007-12-28 00:25 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-19 18:40 . 2006-10-26 19:56 32,592 –a—— C:\WINDOWS\system32\msonpmon.dll
2007-12-19 18:38 . 2007-12-19 18:38 d——– C:\Program Files\Microsoft.NET
2007-12-19 18:34 . 2007-12-19 18:53 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-19 18:33 . 2007-12-19 18:33 dr-h—– C:\MSOCache
2007-12-01 12:03 . 2007-12-30 16:05 d——– C:\Documents and Settings\Owner\Shared
2007-12-01 12:03 . 2007-12-30 15:10 d——– C:\Documents and Settings\Owner\Incomplete
2007-12-01 12:02 . 2007-12-01 12:02 d——– C:\Program Files\LimeWire
2007-12-01 12:02 . 2007-12-26 12:30 d——– C:\Documents and Settings\Owner\Application Data\LimeWire
2007-11-29 17:35 . 2004-08-04 12:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-30 21:59 145,628 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-30 21:59 12,335,136 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-29 18:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-28 16:14 ——— d—–w C:\Program Files\Java
2007-12-28 16:08 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 07:27 ——— d—–w C:\Program Files\Lavasoft
2007-12-28 07:27 ——— d—–w C:\Documents and Settings\Owner\Application Data\Lavasoft
2007-12-20 03:49 ——— d—–w C:\Documents and Settings\Owner\Application Data\U3
2007-12-20 01:39 ——— d—–w C:\Program Files\Microsoft Works
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-29_ 9.38.32.03 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-09-25 05:30:28 135,168 —-a-w C:\WINDOWS\system32\java.exe
+ 2006-12-15 07:30:58 49,248 —-a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 05:30:30 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2006-12-15 07:31:06 53,346 —-a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 06:31:42 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2006-12-15 09:09:14 127,078 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 19:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 22:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 22:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-12-30 23:06:45 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_6d4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 06:00]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-09-17 07:19:14]
V CAST Music Monitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe [2005-11-30 11:32:10]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-02-08 14:03 278528 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 –a—— C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
2004-11-15 15:04 135168 –a—— C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6adc7af9-cd74-11d9-b105-806d6172696f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

.
Contents of the 'Scheduled Tasks' folder
"2005-12-25 16:33:56 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 16:07:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-30 16:10:49 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt 2007-12-30 23:10:34
C:\qoobox\ComboFix2.txt 2007-12-30 22:13:23
C:\qoobox\ComboFix3.txt 2007-12-30 21:58:47
C:\qoobox\ComboFix4.txt 2007-12-30 20:41:57
C:\qoobox\ComboFix5.txt 2007-12-30 19:08:30
.
2007-12-13 10:04:01 — E O F —

Logfile of HijackThis v1.99.1
Scan saved at 4:14:18 PM, on 12/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pbnation.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: V CAST Music Monitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music\V CAST Music Monitor.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab55668.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

It seems to be better.
I've got this pc networked with 2 others. How do I check to make sure they aren't infected as well?
Thanks again for the help!

Trevuren

Post #10December 29, 2007, 11:38 PM UTC

First things first. We need to make sure that we have one clean to start with. Those two logs look good. A new search tool has just been made that is said to be able to identify the infected files. We need to run it on your machine first:

1. Go to Start->Run and type in notepad and hit OK.

2. Then copy and paste the content of the following codebox into Notepad:

@echo off
Vfind.exe -ltf "%systemdrive%\* .exe" > Log.txt
Start notepad log.txt

3. Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes. It should look like this on your desktop: [external image: Posted Image]

4. Double click find.bat and copy/paste the resulting log into your next reply.

Deleted Member

Post #11December 29, 2007, 11:55 PM UTC

—-a-w 75,520 2007-12-29 18:19:40 C:\Program Files\Java\jre1.5.0_11\bin\jusched .exe —-a-w 5,674,352 2007-12-28 16:08:18 C:\Program Files\MSN Messenger\MsnMsgr .Exe Entries: 2 (2) Directories: 0 Files: 2 Bytes: 5,749,872 Blocks: 11,231

Trevuren

Post #12December 30, 2007, 12:03 AM UTC last edited December 30, 2007, 12:04 AM UTC

A. UNINSTALL MSN Messenger and delete the entire folder from C:\Program Files\

B. UNINSTALL jre1.5.0_11

C. Run find.bat again and post the results

D. Physically turn off the other machines on your network and do not turn them on until we get this one cleaned.

Deleted Member

Post #13December 30, 2007, 12:11 AM UTC

—-a-w 5,674,352 2007-12-28 16:08:18 C:\RECYCLER\S-1-5-21-93015460-502943142-966930143-1003\Dc22\MsnMsgr .Exe Entries: 1 (1) Directories: 0 Files: 1 Bytes: 5,674,352 Blocks: 11,083 (Looks to me like I need to dump the rec bin. Just wanted you to know I've been trying to pay attention and learn something!)

Trevuren

Post #14December 30, 2007, 12:23 AM UTC

A. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

I suggest that you keep the above program as it is an excellent program, free, does not require an install routine and uses very little resources. It is what I use on my two.

Also, I don't want to get ahead of myself here but PLEASE do not DELETE or UNINSTALL anything until requested to do so because we are going to do some things to save time checking the other machines and we will need some of these programs.

B. Please run find.bat again and post the results.

Deleted Member

Post #15December 30, 2007, 12:31 AM UTC

Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] imsorryinternet malware

✨ Ask AI

Ask AI