What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please help me with this hijackthis log

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):

O2 - BHO: TBSB00808 - {425E30F0-CCC6-4E24-BBEB-BCBD31720B37} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked exit HijackThis and reboot.



Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.



Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make sure that the following are selected:
    • Scan using the following Anti-Virus database:

      + Extended(If available otherwise Standard)
    • Scan Options:

      + Scan Archives
      + Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button
  • Save the file to your desktop.
  • Copy and paste that information in your next post with a new HijackThis log.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed until the scan is complete. This includes your anti-virus. Once you have installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.
Post #17
hi,

this is the results of the ff instruction you gave

for the kapersky scan:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Saturday, March 08, 2008 11:39:26 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 8/03/2008
Kaspersky Anti-Virus database records: 613707
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 64725
Number of viruses found: 15
Number of infected objects: 43
Number of suspicious objects: 0
Duration of the scan process: 03:37:49

Infected Object Name / Virus Name / Last Action
C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\AVG7\log.idx Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\AVG7\l_000101.log Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\AVG7\l_000102.log Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\AVG7\sched-0001.cfg Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\AVG7\sched-0002.cfg Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\McAfee\McAfee Shared Components\Centralv3\CentENU.ini Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config.cch Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config.cch.new Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\HTML Help\hh.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\LastFlashConfig.WFC Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\MMC\dfrg Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-527237240-1708537768-1343024091-500\7b639748-c582-457d-a836-b0a9c1b4f754 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-527237240-1708537768-1343024091-500\Preferred Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Themes\Custom.theme Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\DM\DEVREP\devrep.xml Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\DM\DEVREP\devrepSchema.xdr Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\Application logs\applauncher_all_log.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\Application logs\capman_all_log.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\Application logs\DM_log.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\Application logs\SpecificMPM_log.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\teleca_common_log.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\tlib.info Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Teleca\Telecalib\Logging\tlib.init Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\administrator@82.98.235[1].txt Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\administrator@82.98.235[2].txt Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\administrator@yahoo[1].txt Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\administrator@~~local~~[1].txt Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Customize Links.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Free Hotmail.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Windows Marketplace.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Windows Media.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Links\Windows.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\IE Add-on site.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\IE site on Microsoft.com.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Marketplace.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft At Home.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft At Work.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Welcome to IE7.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\MSN.com.url Object is locked skipped
C:\Documents and Settings\Administrator\Favorites\Radio Station Guide.url Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\ATI\ACE\Profiles.xml Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\52BKMGZW\fwlink[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\VNXCU0H4\fwlink[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\HelpCtr\HelpSessionHistory.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\install.ins Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\rsoplog.bak Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\rsoplog.txt Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup01.log Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup02.log Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008010920080110\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008030120080302\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\History\History.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\History\History.IE5\MSHist012008022920080301\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\java_install_reg.log Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\jusched.log Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\90K7LCBL\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\CKR9N382\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\PWZMBMJ3\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\ZFZ2O0GE\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2C6C.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF301A.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF4DDA.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF50FA.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF6042.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\564MF2OJ\6SXQPBEU\Offline\0x00000001_R Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\564MF2OJ\6SXQPBEU\Offline\0x00000003_R Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\564MF2OJ\6SXQPBEU\Offline\HashFile.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\192_168_0_1[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\buttonForm[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\buttonForm[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\CAJ0VTAD.lpk Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\CAXKNDKU.lpk Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\chg_common[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[3].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[4].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[5].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[6].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[7].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[8].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Common[9].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Context[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\coUA[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\coUA[2].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\ErrorPageTemplate[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\favcenter[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\HHWRAPPER[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\Homepage__SHARED[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\hr[1].bmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\http_404[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\info_48[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\menu_left[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\nusrmgr[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\popup[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\selectable[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\sharedCA16FNK7.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\sharedCA3G00AH.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\sharedCABNUJXI.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\sharedCANBX1X8.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\sharedCATWWJXK.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\sharedCAWAQHQD.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[10].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[11].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[12].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[13].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[14].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[15].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[16].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[17].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[18].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[19].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[20].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[21].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[2].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[3].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[4].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[5].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[6].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[7].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[8].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\shared[9].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\taskbullet[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\tshoot_shared[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\tshoot_shared[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\users32[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\wrapperparam[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DOXM74B\wrapperparam[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Behaviors[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\blank[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\bullet[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\CA1GIWPI.lpk Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\collapsed[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[3].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[4].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[5].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[6].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[7].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Common[8].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\createpage2[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\CreatePage[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\createpage[3] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\css[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\dnserrordiagoff[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\firstpage[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\helpdoc[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\helpdoc[3] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Homepage__DESKTOP[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Homepage__DESKTOP[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\Homepage__SHARED[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\localtext[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\localtext[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\mainpage[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\menu_mid[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\MiniNavBar[1].xml Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\progbar[2].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\sharedCA37911V.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\sharedCAB1WUYM.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\sharedCABEL0H6.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\sharedCAMZUIVE.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\sharedCATC51AC.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[10].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[11].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[12].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[13].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[14].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[15].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[2].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[3].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[4].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[5].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[6].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[7].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[8].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\shared[9].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\tools[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\top[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\users[3] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6V6P2VSP\wrapperparam[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\acct_common[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\background_gradient[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\body[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\buttonForm[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\check[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\chg_common[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Common[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Common[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Common[3].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Common[4].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\ControlFile[1].ipp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\coUA[2].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\guest_disabled[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\helpdoc[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Homepage__DESKTOP[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Homepage__DESKTOP[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Homepage__SHARED[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\Homepage__SHARED[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\menu_right[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\NavBar[1].xml Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\nusrmgr[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\popup[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\pwchange_o[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\selectable[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\selectable[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[2].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[3].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[4].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[5].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[6].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[7].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[8].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\shared[9].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\tshootText[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\tshoot_shared[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\users32[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\watermark_300x[1].bmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\EFIROFUN\wrapperparam[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\body[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\classic[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[3].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[4].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[5].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[6].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[7].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Common[8].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\cpwebvw[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\createpage2[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\down[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\endnode[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\errorPageStrings[2] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\expanded[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Homepage__DESKTOP[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Homepage__SHARED[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\httpErrorPagesScripts[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\mainpage2[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\mainpage[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\mainweb[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\name_common[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\NavBar[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\nusrmgr[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\pw_common[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\Search[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\sharedCA5ZGZSK.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\sharedCAGAD430.css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[10].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[11].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[12].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[13].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[14].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[15].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[16].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[1].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[2].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[3].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[4].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[5].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[6].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[7].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[8].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\shared[9].css Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\SubSite[1].htm Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\taskbullet[1] Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\topbottom[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\wrapperparam[1].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\wrapperparam[2].js Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OPQNGX6V\zteeng1[1].gif Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\My Music\Desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\My Music\Sample Music.lnk Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped
C:\Documents and Settings\Administrator\My Documents\restore.reg Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.ini Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.pol Object is locked skipped
C:\Documents and Settings\Administrator\Recent\12272007355.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\3mobo.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Backup.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Description of the Windows 2000 Recovery Console.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Recent\DSC02206.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\DSC02207.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\DSC02209.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\DSC02232.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\fieldwork.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Hijackthis (2).lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\hijackthis.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\life in abfood.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Local Area Connections.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Local Disk (D).lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\No local connection anymore - Yahoo! Answers.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\pix.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\pixture.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Removable Disk (F).lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Some Network and Dial-Up Connections Icons May Be Missing.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\trinoma.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\Troubleshooting missing network and dial-up connections icons.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Recent\video card permenant damage.lnk Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\Compressed (zipped) Folder.ZFSendToTarget Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\Desktop (create shortcut).DeskLink Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\Mail Recipient.MAPIMail Object is locked skipped
C:\Documents and Settings\Administrator\SendTo\My Documents.mydocs Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Address Book.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Command Prompt.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Notepad.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Synchronize.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Tour Windows XP.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Windows Explorer.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Deewoo.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini Object is locked skipped
C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk Object is locked skipped
C:\Documents and Settings\Administrator\Templates\amipro.sam Object is locked skipped
C:\Documents and Settings\Administrator\Templates\excel.xls Object is locked skipped
C:\Documents and Settings\Administrator\Templates\excel4.xls Object is locked skipped
C:\Documents and Settings\Administrator\Templates\lotus.wk4 Object is locked skipped
C:\Documents and Settings\Administrator\Templates\powerpnt.ppt Object is locked skipped
C:\Documents and Settings\Administrator\Templates\presenta.shw Object is locked skipped
C:\Documents and Settings\Administrator\Templates\quattro.wb2 Object is locked skipped
C:\Documents and Settings\Administrator\Templates\sndrec.wav Object is locked skipped
C:\Documents and Settings\Administrator\Templates\winword.doc Object is locked skipped
C:\Documents and Settings\Administrator\Templates\winword2.doc Object is locked skipped
C:\Documents and Settings\Administrator\Templates\wordpfct.wpd Object is locked skipped
C:\Documents and Settings\Administrator\Templates\wordpfct.wpg Object is locked skipped
C:\Documents and Settings\Administrator\UserData\index.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Desktop\Downloads\BeachLifeEngSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.d skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_images\Blue hills.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_images\Sunset.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_images\Thumbs.db Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_images\Water lilies.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_images\Winter.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_thumbs\Blue hills_thumb.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_thumbs\Sunset_thumb.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_thumbs\Thumbs.db Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_thumbs\Water lilies_thumb.jpg Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Pictures\PicLensMediaFiles\pl_thumbs\Winter_thumb.jpg Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\~Aubrey\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\~Aubrey\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\~Aubrey\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\~Aubrey\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\~Aubrey\Local Settings\Temp\~DF9D52.tmp Object is locked skipped
C:\Documents and Settings\~Aubrey\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe/data0010 Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe/data0011 Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe/data0012 Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe/data0013 Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe/data0014 Infected: not-a-virus:AdWare.Win32.Aureate.a skipped
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe Inno: infected - 5 skipped
C:\Documents and Settings\~Aubrey\ntuser.dat Object is locked skipped
C:\Documents and Settings\~Aubrey\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\njjl.exe.vir Infected: Trojan-Proxy.Win32.Wintu.a skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\pcntrlwb.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.aj skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc10.mp3 Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc228\{3F016245-EF68-429E-A27A-C2EAD3717C3A}\CTCabEx.DLL Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc228\{3F016245-EF68-429E-A27A-C2EAD3717C3A}\_ISUSER.DLL Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc230\{3F016245-EF68-429E-A27A-C2EAD3717C3A}\CTCabEx.DLL Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc230\{3F016245-EF68-429E-A27A-C2EAD3717C3A}\_ISUSER.DLL Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc231\{3F016245-EF68-429E-A27A-C2EAD3717C3A}\CTCabEx.DLL Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc231\{3F016245-EF68-429E-A27A-C2EAD3717C3A}\_ISUSER.DLL Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc232.tmp\Au_.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc233\ywiseext.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc234\2793472\cddb.db Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc235\_ISDel.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc236\_ISDel.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc238\mid_OLIQUIAN-E3D9A7.dgt Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc238\radBDA37.htm Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc239.tmp\Fake Profile\compatibility.ini Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc239.tmp\Fake Profile\compreg.dat Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc239.tmp\Fake Profile\prefs.js Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc239.tmp\Fake Profile\XPC.mfl Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc239.tmp\Fake Profile\xpti.dat Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc239.tmp\setuphook.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc244.TMP\AppleMobileDeviceSupport.msi Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc244.TMP\AppleSoftwareUpdate.msi Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc244.TMP\iTunes.msi Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc244.TMP\iTunesSetupAdmin.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc244.TMP\QuickTime.msi Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc245\firstrun.log Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\DATA.TAG Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\DATA1.CAB Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\DATA1.HDR Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\filter_nt\VULFNTH.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\filter_nt\VULFNTR.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\LANG.DAT Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\LAYOUT.BIN Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\MSUSB_XP.CAB Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\OS.DAT Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_AR.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_BR.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_CN.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_CS.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_DA.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_DE.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_EL.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_EN.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_ES.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_FI.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_FR.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_HE.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_HU.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_IT.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_JA.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_KO.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_NL.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_NO.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_PL.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_PT.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_RU.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_SV.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_TR.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\QFE\Q810090_W2K_SP4_X86_TW.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\ReadMe.doc Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\Release.txt Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\Setup.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUP.INI Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUP.INS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUP.ISS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUP.LID Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0003\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0005\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0006\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0007\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0008\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0009\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\000A\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\000B\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\000E\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0010\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0011\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0012\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0013\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0014\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0015\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0019\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\001A\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\001B\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\001D\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\001E\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\001F\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0021\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0024\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\002D\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0404\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\040C\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0416\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0804\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0816\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\SETUPDIR\0C0C\_Setup.dll Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\VIA.INI Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\VIAUSB20.REV Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\USB2VIA.INF Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\USBEHCI.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\USBHUB20.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\USBPORT.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\VIACB.EXE Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\VIAUSB.INF Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\VULFNTR.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\VUSTR98.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\VUSTRBT.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\WIN98&ME\VUSTRME.SYS Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\_INST32I.EX_ Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\_ISDel.exe Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\_SYS1.CAB Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\_SYS1.HDR Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\_USER1.CAB Object is locked skipped
C:\RECYCLER\S-1-5-21-527237240-1708537768-1343024091-1003\Dc248\_USER1.HDR Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP1\A0000011.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP1\A0000013.dll Infected: not-a-virus:AdWare.Win32.OneStep.d skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP1\A0000014.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP17\A0100650.exe Infected: Trojan-Downloader.Win32.Agent.eim skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP19\A0102689.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP21\A0103776.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP21\A0103780.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP21\A0103785.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP21\A0103786.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP23\A0104809.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP23\A0104813.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0104901.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0104902.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0105894.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0105897.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0105900.dll Infected: Trojan.Win32.BHO.auf skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0105901.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP24\A0105930.exe Infected: Trojan-Downloader.Win32.Agent.iww skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP25\A0106000.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.ah skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP25\A0106001.exe Infected: Backdoor.Win32.Agent.alm skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP25\A0106002.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.ah skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP25\A0107402.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP28\A0109837.exe Infected: Trojan-Proxy.Win32.Wintu.a skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP28\A0109839.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.aj skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP28\change.log Object is locked skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000529.exe Infected: Trojan-Dropper.Win32.VB.lu skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000530.exe Infected: Backdoor.Win32.Small.oy skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000532.dll Infected: Virus.Win32.AutoRun.k skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000533.dll Infected: Virus.Win32.AutoRun.k skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000534.dll Infected: Virus.Win32.AutoRun.k skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000535.dll Infected: Virus.Win32.AutoRun.k skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000536.DLL Infected: Virus.Win32.AutoRun.k skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000537.exe Infected: Backdoor.Win32.Small.oy skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000538.exe Infected: Backdoor.Win32.Small.oy skipped
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP3\A0000539.exe Infected: Backdoor.Win32.Small.oy skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\OLIQUIAN-E3D9A7.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\NtmsData\NTMSDATA Object is locked skipped
C:\WINDOWS\system32\NtmsData\NTMSREG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_704.dat Object is locked skipped
C:\WINDOWS\Temp\ZLT04367.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT04371.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\WinInit.Ini Object is locked skipped
D:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

new Hijackthis Log:

Logfile of HijackThis v1.99.1
Scan saved at 11:46:08 PM, on 3/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\VM303_STI.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Hijackthis\iseeu.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.0.0.0:5050
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [VMSnap3] -C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] -C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ATICCC] -"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [00saskda] -"C:\Program Files\1st Security Agent\newlock.exe" saskda
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\~Aubrey\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - -"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #18
Hello

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.


Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C 

KillAll::
 
File::
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe

Folder::
C:\SDFix
C:\Documents and Settings\All Users\Application Data\ESET

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe


Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\~Aubrey\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  • Post that log back here.

In your next reply post:
MBAM log
ComboFix.txt
New HijackThis log taken after the above scan has run
Post #19
Hello

these are the results of the ff instructions you posted yesterday;

MBAM log

Malwarebytes' Anti-Malware 1.08
Database version: 474

Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 93859
Time elapsed: 53 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 23
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{0be385a3-85a5-4722-b677-68dae891ff21} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{272c0d60-0561-4c83-b3db-eb0a71f9d2eb} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{284477e4-a7cb-4055-9e1b-0ea7cba28945} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{70ca4938-6a0f-4641-a9a9-c936e4c1e7de} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7468213e-010e-4ec6-a17d-642e909ba7ec} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a916af3c-976d-4358-8736-95bea0b5fd2c} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b86f4810-19a9-4050-9ac9-b5cf60b5799a} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bb5b7e14-f8b4-4365-a24d-f4965c33e1ee} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{be45f056-e005-437b-be88-23acf70b0b6a} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c13d4627-02f5-4b03-897a-bf6a90022dd2} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c636f1fc-6ae4-4e6a-90ab-6d61d821a0dd} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cb971ac0-6408-40da-a540-92f9f256f51f} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d5694dfe-43b6-4e05-aa29-8c556c968973} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e2032ec2-a9ac-4ed7-9bdb-ebecacf076f2} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ebab4a71-8c34-461a-b57d-dd041d439555} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f06fea43-0cc3-4bf6-a85b-5efb1c07aa4b} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fc94a0f7-9c7c-4ae2-9106-5c212332b209} (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Deewoo Network Manager (Adware.Radio) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{6FAF665F-1643-43B7-8E5D-314B263CDC24}\RP6\A0016444.dll (Rogue.Multiple) -> Quarantined and deleted successfully.

ComboFix.txt

ComboFix 08-03-01.3 - ~Aubrey 2008-03-09 20:47:52.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\~Aubrey\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\~Aubrey\My Documents\rei\mp3down.exe
C:\Documents and Settings\All Users\Application Data\ESET
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Charon\FND3.NFI
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\EHttpSrv.xml
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\EpfwUser.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\virlog.dat
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\warnlog.dat
C:\SDFix
C:\SDFix\apps\assosfix.reg
C:\SDFix\apps\cliptext.exe
C:\SDFix\apps\download.exe
C:\SDFix\apps\dummy.exe
C:\SDFix\apps\dummy.sys
C:\SDFix\apps\Enable_Command_Prompt.reg
C:\SDFix\apps\ERDNT.E_E
C:\SDFix\apps\ERDNTDOS.LOC
C:\SDFix\apps\ERDNTWIN.LOC
C:\SDFix\apps\ERUNT.EXE
C:\SDFix\apps\ERUNT.LOC
C:\SDFix\apps\fix.reg
C:\SDFix\apps\FixBH.reg
C:\SDFix\apps\FixComponents.reg
C:\SDFix\apps\FIXCU.reg
C:\SDFix\apps\FIXLM.reg
C:\SDFix\apps\FixPath.exe
C:\SDFix\apps\FixRedir.reg
C:\SDFix\apps\FixSchedule.reg
C:\SDFix\apps\FixWebCheck.reg
C:\SDFix\apps\fixXP.reg
C:\SDFix\apps\FixXPsp2.reg
C:\SDFix\apps\grep.exe
C:\SDFix\apps\HPFix.reg
C:\SDFix\apps\HPFix2.reg
C:\SDFix\apps\HPFix3.reg
C:\SDFix\apps\HPFix4.reg
C:\SDFix\apps\HPFix5.reg
C:\SDFix\apps\HPFix6.reg
C:\SDFix\apps\HPFix7.reg
C:\SDFix\apps\isadmin.exe
C:\SDFix\apps\leg2.txt
C:\SDFix\apps\legacy.txt
C:\SDFix\apps\legacybk.txt
C:\SDFix\apps\locate.com
C:\SDFix\apps\LS.exe
C:\SDFix\apps\MD5File.exe
C:\SDFix\apps\MyGcpvFix.reg
C:\SDFix\apps\MyGkFix2.reg
C:\SDFix\apps\Process.exe
C:\SDFix\apps\procs.exe
C:\SDFix\apps\psservice.exe
C:\SDFix\apps\RegDACL.exe
C:\SDFix\apps\regedit.exe
C:\SDFix\apps\Rem.txt
C:\SDFix\apps\Rem2.txt
C:\SDFix\apps\Replace\W2K.exe
C:\SDFix\apps\Replace\w2k\beep.sys
C:\SDFix\apps\Replace\w2k\null.sys
C:\SDFix\apps\Replace\XP.exe
C:\SDFix\apps\Replace\xp\beep.sys
C:\SDFix\apps\Replace\xp\null.sys
C:\SDFix\apps\Reset_AppInit_DLLs.reg
C:\SDFix\apps\RestartIt!.exe
C:\SDFix\apps\Restore_SecurityCenter.reg
C:\SDFix\apps\Restore_SharedAccess.reg
C:\SDFix\apps\sc.exe
C:\SDFix\apps\sed.exe
C:\SDFix\apps\SF.exe
C:\SDFix\apps\shutdown.exe
C:\SDFix\apps\srv2.txt
C:\SDFix\apps\srv2bk.txt
C:\SDFix\apps\svc.txt
C:\SDFix\apps\svcbk.txt
C:\SDFix\apps\swreg.exe
C:\SDFix\apps\swsc.exe
C:\SDFix\apps\unzip.exe
C:\SDFix\apps\vfind.exe
C:\SDFix\apps\WINMSG.EXE
C:\SDFix\apps\winsec.reg
C:\SDFix\apps\zip.exe
C:\SDFix\backups\attrib.exe
C:\SDFix\backups\backupreg.zip
C:\SDFix\backups\backups.zip
C:\SDFix\backups\catchme.log
C:\SDFix\backups\catchme.zip
C:\SDFix\backups\find.exe
C:\SDFix\backups\findstr.exe
C:\SDFix\backups\HOSTS
C:\SDFix\backups\regedit.exe
C:\SDFix\catchme.exe
C:\SDFix\dummy.exe
C:\SDFix\dummy.sys
C:\SDFix\Report.txt
C:\SDFix\RunThis.bat
C:\SDFix\SDFIX_ReadMe_Online.url

.
((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 )))))))))))))))))))))))))))))))
.

2008-03-08 18:38 . 2008-03-08 18:38 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-03-08 18:38 . 2008-03-08 18:38 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-03 20:50 . 2008-03-03 20:51 d——– C:\WINDOWS\ERUNT
2008-03-01 21:22 . 2008-03-01 21:26 d——– C:\Documents and Settings\sanzo\Application Data\Yahoo!
2008-03-01 21:19 . 2008-03-03 20:37 d——– C:\Documents and Settings\sanzo\Application Data\AVG7
2008-02-27 20:44 . 2008-03-09 21:01 6,684,704 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-27 20:44 . 2008-03-09 20:55 80,432 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-27 20:34 . 2008-02-27 20:34 d——– C:\Program Files\ZoneAlarmSB
2008-02-27 20:25 . 2008-02-27 20:25 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-27 20:24 . 2008-02-27 20:35 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-02-27 20:23 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-02-27 20:23 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-02-27 20:18 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-02-27 20:17 . 2008-02-27 20:23 d——– C:\WINDOWS\system32\ZoneLabs
2008-02-27 20:17 . 2008-02-27 20:17 d——– C:\Program Files\Zone Labs
2008-02-27 20:17 . 2008-03-09 20:57 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-02-27 20:15 . 2008-03-09 20:40 d——– C:\WINDOWS\Internet Logs
2008-02-26 22:18 . 2008-03-09 20:08 d——– C:\Documents and Settings\~Aubrey\Application Data\AVG7
2008-02-26 22:16 . 2008-02-26 22:16 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-26 22:16 . 2008-02-26 22:16 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-26 21:52 . 2008-02-26 21:52 d——– C:\Documents and Settings\april\Application Data\Dealio
2008-02-26 21:39 . 2008-03-09 20:55 5,242,880 –a—— C:\Documents and Settings\~Aubrey\ntuser.dat
2008-02-26 01:08 . 2008-02-26 01:08 d——– C:\Program Files\Common Files\SWF Studio
2008-02-26 01:07 . 2008-02-26 21:17 d——– C:\Documents and Settings\~Aubrey\Application Data\Dealio
2008-02-26 01:06 . 2008-02-26 21:41 d——– C:\Program Files\Dealio
2008-02-25 20:34 . 2008-02-27 19:01 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-24 02:26 . 2008-02-24 02:26 d——– C:\Program Files\DivX
2008-02-24 02:02 . 2008-02-24 02:26 dr-h—– C:\Documents and Settings\marion.OLIQUIAN-E3D9A7\Application Data\yahoo!
2008-02-24 02:01 . 2008-02-24 02:01 d——– C:\Documents and Settings\marion.OLIQUIAN-E3D9A7\Application Data\ATI
2008-02-24 01:59 . 2004-08-04 09:07 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-02-21 10:05 . 2008-02-21 10:05 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll
2008-02-21 10:05 . 2008-02-21 10:05 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll
2008-02-17 14:04 . 2008-02-17 14:28 d——– C:\Program Files\Soulseek
2008-02-15 23:52 . 2008-02-15 23:52 d——– C:\Documents and Settings\~Aubrey\Incomplete
2008-02-15 23:51 . 2008-02-15 23:51 d——– C:\WINDOWS\Sun
2008-02-15 23:51 . 2008-02-15 23:51 d——– C:\Documents and Settings\~Aubrey\Application Data\Sun
2008-02-15 23:48 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-02-15 23:45 . 2008-02-15 23:48 d——– C:\Program Files\Java
2008-02-15 23:41 . 2008-02-15 23:41 d——– C:\Program Files\Common Files\Java
2008-02-15 23:33 . 2008-02-17 13:55 d——– C:\Documents and Settings\~Aubrey\Application Data\Imesh MP3 Downloader
2008-02-15 23:32 . 2008-02-15 23:32 d–h—– C:\Program Files\Imesh MP3 Downloader
2008-02-13 23:46 . 2008-02-13 23:46 d——– C:\Documents and Settings\~Aubrey\Application Data\Kazaa Lite
2008-02-13 20:31 . 2008-02-13 20:31 d——– C:\Documents and Settings\All Users\Application Data\Kazaa Lite
2008-02-13 20:06 . 2008-02-15 22:48 d——– C:\My Shared Folder
2008-02-11 09:40 . 2008-02-11 09:40 2,715,648 –a—— C:\WINDOWS\system32\OnlineScanner.ocx
2008-02-11 09:39 . 2008-02-11 09:39 253,952 –a—— C:\WINDOWS\system32\OnlineScannerDLLA.dll
2008-02-11 09:39 . 2008-02-11 09:39 237,568 –a—— C:\WINDOWS\system32\OnlineScannerDLLW.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-09 12:55 5,242,880 —-a-w C:\Documents and Settings\~Aubrey\ntuser.dat
2008-03-09 12:08 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\AVG7
2008-03-06 14:10 3,608,291 —-a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2008_03_06_22_01_54_full.dmp.zip
2008-03-06 14:01 1,391,104 —-a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-03-03 12:33 1,365,504 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-03-03 12:33 1,168,896 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-03-02 15:23 1,906,176 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-03-01 15:12 3,335,168 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-02-29 13:30 27,498 —-a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_02_28_21_58_15_small.dmp.zip
2008-02-27 17:33 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-02-27 17:33 1,326,592 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-02-27 17:22 3,118,592 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-02-26 13:54 ——— d—–w C:\Documents and Settings\april\Application Data\Skype
2008-02-26 13:17 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Dealio
2008-02-25 12:29 ——— d-s—w C:\Documents and Settings\~Aubrey\Application Data\Microsoft
2008-02-24 01:51 ——— d—–w C:\Documents and Settings\april\Application Data\skypePM
2008-02-21 13:14 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-17 05:55 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Imesh MP3 Downloader
2008-02-15 15:51 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Sun
2008-02-13 15:46 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Kazaa Lite
2008-02-08 05:53 110,592 —-a-w C:\WINDOWS\system32\OnlineScannerLang.dll
2008-02-06 13:32 691,545 —-a-w C:\WINDOWS\unins000.exe
2008-02-05 00:48 77,824 —-a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
2008-02-04 15:11 ——— d—–w C:\Program Files\Sony Ericsson
2008-02-03 06:35 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-02 08:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-02-02 08:31 ——— d—–w C:\Program Files\bfgclient
2008-01-28 15:19 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Yahoo!
2008-01-28 15:04 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Macromedia
2008-01-28 14:59 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Teleca
2008-01-28 14:59 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Adobe
2008-01-28 14:58 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\ATI
2008-01-28 14:57 ——— d—–w C:\Documents and Settings\~Aubrey\Application Data\Identities
2008-01-26 14:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-26 10:50 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-01-07 10:57 32 —-a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-12-12 00:40 705,711 ——w C:\WINDOWS\LOTR_Legolas.exe
2007-12-12 00:40 386,848 ——w C:\WINDOWS\LOTR_Legolas.scr
2007-12-12 00:40 30,208 ——w C:\WINDOWS\mickey32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-02-27 20:34 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-02-27 20:34 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMSnap3"="-C:\WINDOWS\VMSnap3.EXE" [ ]
"Domino"="-C:\WINDOWS\Domino.EXE" [ ]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" [2005-10-25 12:56 61440]
"ATICCC"="-C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [ ]
"00saskda"="-C:\Program Files\1st Security Agent\newlock.exe" [ ]
"QuickTime Task"="-C:\Program Files\QuickTime\qttask.exe" [ ]
"SunJavaUpdateSched"="-C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-26 22:16 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-26 22:16 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
"HideShutdownScripts"= 0 (0x0)
"RunLogonScriptSync"= 0 (0x0)
"RunStartupScriptSync"= 0 (0x0)
"HideStartupScripts"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"HideLogonScripts"= 0 (0x0)
"HideLogoffScripts"= 0 (0x0)
"HideLegacyLogonScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"NoViewOnDrive"= 0 (0x0)
"NoRecycleFiles"= 0 (0x0)
"ForceRecycleBinSize"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoCustomizeThisFolder"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoOnlinePrintsWizard"= 0 (0x0)
"NoPublishingWizard"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuMorePrograms"= 0 (0x0)
"NoStartMenuEjectPC"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
"NoSMBalloonTips"= 0 (0x0)
"LockTaskbar"= 0 (0x0)
"NoTaskGrouping"= 0 (0x0)
"NoWebServices"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoRunasInstallPrompt"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoThumbnailCache"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoThemesTab"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"NoViewOnDrive"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"DisallowRun"= 0 (0x0)
"NoRecycleFiles"= 0 (0x0)
"ForceRecycleBinSize"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoViewContextMenu"= 0 (0x0)
"NoWinKeys"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoCustomizeThisFolder"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoOnlinePrintsWizard"= 0 (0x0)
"NoPublishingWizard"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuMorePrograms"= 0 (0x0)
"NoStartMenuEjectPC"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
"StartMenuLogoff"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
"NoSMBalloonTips"= 0 (0x0)
"NoTrayContextMenu"= 0 (0x0)
"LockTaskbar"= 0 (0x0)
"HideClock"= 0 (0x0)
"NoTaskGrouping"= 0 (0x0)
"NoActiveDesktopChanges"= 0 (0x0)
"NoWebServices"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoLogOff"= 0 (0x0)
"NoRunasInstallPrompt"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoThumbnailCache"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATITool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ATITool.lnk
backup=C:\WINDOWS\pss\ATITool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-r——- 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"=
"C:\\Documents and Settings\\~Aubrey\\My Documents\\my programs\\Soulseek\\slsk.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 vmfilter303;vmfilter303;C:\WINDOWS\system32\drivers\vmfilter303.sys [2006-04-25 10:57]
R3 ZSMC303;A4 TECH PC Camera H;C:\WINDOWS\system32\Drivers\usbVM303.sys [2006-12-01 14:23]
S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);C:\WINDOWS\system32\drivers\ctlsb16.sys [2001-08-17 12:19]
S3 DIGIRPS;Digi PortServer Driver;C:\WINDOWS\system32\DRIVERS\digirlpt.sys [2001-08-17 12:17]
S3 W700bus;Sony Ericsson W700 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\W700bus.sys [2007-12-02 00:10]
S3 W700mdfl;Sony Ericsson W700 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\W700mdfl.sys [2007-12-02 00:10]
S3 W700mdm;Sony Ericsson W700 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\W700mdm.sys [2007-12-02 00:10]
S3 W700mgmt;Sony Ericsson W700 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\W700mgmt.sys [2007-12-02 00:10]
S3 W700obex;Sony Ericsson W700 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\W700obex.sys [2007-12-02 00:10]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 12:00:01 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (OLIQUIAN-E3D9A7-Administrator).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-09 21:00:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-03-09 21:06:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-09 13:05:54
ComboFix2.txt 2008-03-06 12:26:12
ComboFix3.txt 2008-03-03 13:36:28
.
2008-02-14 07:46:04 — E O F —


NEw HijackThis log

Logfile of HijackThis v1.99.1
Scan saved at 9:45:18 PM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\VM303_STI.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Hijackthis\iseeu.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.0.0.0:5050
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [VMSnap3] -C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] -C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ATICCC] -"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [00saskda] -"C:\Program Files\1st Security Agent\newlock.exe" saskda
O4 - HKLM\..\Run: [QuickTime Task] -"C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\~Aubrey\Application Data\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - -"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #20
Hi

Congratulations, you appear to be malware free.



Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the x and the /u, it needs to be there.

    [external image: Posted Image]


Delete the SDFix icon if it is still on your Desktop


You may wish to keep hold of the Kaspersky Online Scan as an extra on-demand virus-scanner.
If not you can uninstall it through Start>Control Panel>Add/Remove Programs


Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.
  • Close any programmes you may have running, ESPECIALLY your web browser
  • Click Start > Control Panel.
  • Click Add/Remove Programs.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove all versions of Java.
  • Reboot your computer once all Java components are removed.
Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u5, and click Yes at the page warning. Under "Platform" select Windows, then check the box to accept the Licence Agreement. Click Yes at the second page warning before downloading the Offline file.


Here are two free programs I recommend.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here


Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Here is some great information from experts in this field that will help you stay clean and safe online.
http://forum.malwareremoval.com/viewtopic.php?t=14

Follow this list and your potential for being infected again will reduce dramatically.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.
Post #21
Hello It's nice to hear that my computer is already a malware free. Without your help and guidance, surely, I will reformat and install the programs all over again. THANK You very much. Also, Can I keep the following programs: Flash Disinfector ATF-Cleaner Malwarebytes Anti-Malware HijackThis Log or delete it? Thanks, Sanzo :woot:
Post #22
Yes you can keep them. Tools like Combofix have the power to wreck a system that's why we prefer to remove them and dont like untrained people using them.
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI