This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] I have a mess on my PC-Please Help

28 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

My PC is junk now. I was searching for a financial calculator and had just uninstalled my Virus protection, and had not installed my new trend micro

I have installed and ran trend micro PC- Cillin and here is my Hijack this log.

I cant edit my registry…My task manager was disabled also but I got that going again. I am constantly like every 2 minutes getting popups that are saying my PC is infected with Spyware. I am getting Porn sites opening up also. My desktop background is red and I have a red circle with an X in it on my taskbar that keeps poping up saying that I have a virus.

Please help me.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:11:14 PM, on 5/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\DOCUME~1\Ronnie\LOCALS~1\Temp\winlogan.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\WINDOWS\TEMP\124.tmp
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O1 - Hosts: 124.217.251.159 google.dk
O1 - Hosts: 124.217.251.159 google.se
O1 - Hosts: 124.217.251.159 google.co.nz
O1 - Hosts: 124.217.251.159 google.cn
O1 - Hosts: 124.217.251.159 google.com.pr
O1 - Hosts: 124.217.251.159 google.com.ca
O1 - Hosts: 124.217.251.159 google.com.ch
O1 - Hosts: 124.217.251.159 google.fi
O1 - Hosts: 124.217.251.159 google.co.in
O1 - Hosts: 124.217.251.159 google.co.uk
O1 - Hosts: 124.217.251.159 google.lv
O1 - Hosts: 124.217.251.159 google.co.hu
O1 - Hosts: 124.217.251.159 google.lk
O1 - Hosts: 124.217.251.159 google.com.au
O1 - Hosts: 124.217.251.159 google.ru
O1 - Hosts: 124.217.251.159 google.nl
O1 - Hosts: 124.217.251.159 google.be
O1 - Hosts: 124.217.251.159 google.de
O1 - Hosts: 124.217.251.159 gogle.de
O1 - Hosts: 124.217.251.159 googel.de
O1 - Hosts: 124.217.251.159 google.ro
O1 - Hosts: 124.217.251.159 google.kz
O1 - Hosts: 124.217.251.159 google.by
O1 - Hosts: 124.217.251.159 google.no
O1 - Hosts: 124.217.251.159 google.pl
O1 - Hosts: 124.217.251.159 google.com.pl
O1 - Hosts: 124.217.251.159 google.es
O1 - Hosts: 124.217.251.159 google.pt
O1 - Hosts: 124.217.251.159 google.com.br
O1 - Hosts: 124.217.251.159 google.vc
O1 - Hosts: 124.217.251.159 google.co.za
O1 - Hosts: 124.217.251.159 google.tm
O1 - Hosts: 124.217.251.159 google.com.my
O1 - Hosts: 124.217.251.159 google.bg
O1 - Hosts: 124.217.251.159 google.co.jp
O1 - Hosts: 124.217.251.159 google.ie
O1 - Hosts: 124.217.251.159 google.co.ck
O1 - Hosts: 124.217.251.159 google.com.mx
O1 - Hosts: 124.217.251.159 google.com.om
O1 - Hosts: 124.217.251.159 google.fr
O1 - Hosts: 124.217.251.159 google.mu
O1 - Hosts: 124.217.251.159 google.com.ph
O1 - Hosts: 124.217.251.159 google.com.jm
O1 - Hosts: 124.217.251.159 google.com
O1 - Hosts: 124.217.251.159 google.us
O1 - Hosts: 124.217.251.159 google.ro
O1 - Hosts: 124.217.251.159 www.google.dk
O1 - Hosts: 124.217.251.159 www.google.se
O1 - Hosts: 124.217.251.159 www.google.co.nz
O1 - Hosts: 124.217.251.159 www.google.cn
O1 - Hosts: 124.217.251.159 www.google.com.pr
O1 - Hosts: 124.217.251.159 www.google.com.ca
O1 - Hosts: 124.217.251.159 www.google.com.ch
O1 - Hosts: 124.217.251.159 www.google.fi
O1 - Hosts: 124.217.251.159 www.google.co.in
O1 - Hosts: 124.217.251.159 www.google.co.uk
O1 - Hosts: 124.217.251.159 www.google.lv
O1 - Hosts: 124.217.251.159 www.google.co.hu
O1 - Hosts: 124.217.251.159 www.google.lk
O1 - Hosts: 124.217.251.159 www.google.com.au
O1 - Hosts: 124.217.251.159 www.google.ru
O1 - Hosts: 124.217.251.159 www.google.nl
O1 - Hosts: 124.217.251.159 www.google.be
O1 - Hosts: 124.217.251.159 www.google.de
O1 - Hosts: 124.217.251.159 www.gogle.de
O1 - Hosts: 124.217.251.159 www.googel.de
O1 - Hosts: 124.217.251.159 www.google.ro
O1 - Hosts: 124.217.251.159 www.google.kz
O1 - Hosts: 124.217.251.159 www.google.by
O1 - Hosts: 124.217.251.159 www.google.no
O1 - Hosts: 124.217.251.159 www.google.pl
O1 - Hosts: 124.217.251.159 www.google.com.pl
O1 - Hosts: 124.217.251.159 www.google.es
O1 - Hosts: 124.217.251.159 www.google.pt
O1 - Hosts: 124.217.251.159 www.google.com.br
O1 - Hosts: 124.217.251.159 www.google.vc
O1 - Hosts: 124.217.251.159 www.google.co.za
O1 - Hosts: 124.217.251.159 www.google.tm
O1 - Hosts: 124.217.251.159 www.google.com.my
O1 - Hosts: 124.217.251.159 www.google.bg
O1 - Hosts: 124.217.251.159 www.google.co.jp
O1 - Hosts: 124.217.251.159 www.google.ie
O1 - Hosts: 124.217.251.159 www.google.co.ck
O1 - Hosts: 124.217.251.159 www.google.com.mx
O1 - Hosts: 124.217.251.159 www.google.com.om
O1 - Hosts: 124.217.251.159 www.google.fr
O1 - Hosts: 124.217.251.159 www.google.mu
O1 - Hosts: 124.217.251.159 www.google.com.ph
O1 - Hosts: 124.217.251.159 www.google.com.jm
O1 - Hosts: 124.217.251.159 www.google.com
O1 - Hosts: 124.217.251.159 www.google.us
O1 - Hosts: 124.217.251.159 www.google.ro
O1 - Hosts: 124.217.251.159 www.video.google.com
O1 - Hosts: 124.217.251.159 www.maps.google.com
O1 - Hosts: 124.217.251.159 www.groups.google.com
O1 - Hosts: 124.217.251.159 www.news.google.com
O1 - Hosts: 124.217.251.159 www.images.google.com
O1 - Hosts: 124.217.251.159 www.earth.google.com
O1 - Hosts: 124.217.251.159 www.code.google.com
O1 - Hosts: 124.217.251.159 www.directory.google.com
O1 - Hosts: 124.217.251.159 www.labs.google.com
O3 - Toolbar: pvnsmfor - {2B99C85C-1A51-4117-B481-BEA6F99D2BBF} - C:\WINDOWS\pvnsmfor.dll
O4 - HKLM\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\Ronnie\LOCALS~1\Temp\winlogan.exe
O4 - HKLM\..\Run: [7c5f8983] rundll32.exe "C:\WINDOWS\system32\ulrdgxqy.dll",b
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\RunOnce: [TSC] "C:\PROGRA~1\TRENDM~1\INTERN~1\tsc.exe" /HD
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\Ronnie\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\Ronnie\LOCALS~1\Temp\winlogan.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [7c5f8983] rundll32.exe "C:\WINDOWS\system32\uddxcdsx.dll",b
O4 - HKLM\..\Policies\Explorer\Run: [1] C:\WINDOWS\system32\mrcmgr.exe
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user')
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1160686380109
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://camera.clemson.edu/sikes/AxisCamControl.ocx
O16 - DPF: {AB294EC6-7ADA-11D4-9D5F-00B0D04BBD07} (msichat50 Client Control) - http://media.rivals.com/msichat.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O21 - SSODL: mpfanvqg - {C7D926B5-578B-4B04-B8E1-04EC450DDAD4} - C:\WINDOWS\mpfanvqg.dll
O21 - SSODL: vbksrofa - {59F9DBBF-8366-4339-A463-A2BC7C1EE8A2} - C:\WINDOWS\vbksrofa.dll
O22 - SharedTaskScheduler: jhsf8d984jief8dsfus98jkefn - {C5AF49A2-94F3-42BD-F434-2604812C897D} - C:\WINDOWS\system32\jfiehayd.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\SYSTEM32\acs.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (pcctlcom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (pcscnsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Trend Micro Real-time Service (tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (tmpfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

–
End of file - 13904 bytes
Hi there,

Welcome to WhatTheTech. My name is RatHat, and I will help you get through the process of cleaning the malware from your computer.


OK firstly, I need you to print out each post I make so that you can refer to it while we fix your computer. This is because there will be times when you are unable to be online to read my instructions, and I will want you to do everything very carefully. I also need you to follow my instructions in the order that they are given. If however, you cannot carry out one of them, please continue on with the next and let me know what you were unsuccessful with. Please ensure you turn off word wrap in Notepad. To do this, open Notepad, choose Format, then Un-check Word Wrap. (Word Wrap makes reading your log difficult).

Next, I would like to make sure that you can view hidden files and folders;
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading SELECT Show hidden files and folders.
  • UNCHECK the Hide protected operating system files (recommended) option.
  • UNCHECK the Hide extensions for known file types option.
  • Click Yes to confirm.
  • Click OK.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Download the HostsXpert 4.2 - Hosts File Manager.
  • Unzip HostsXpert 4.2 - Hosts File Manager to a convenient folder such as C:\HostsXpert 4.2 - Hosts File Manager
  • Run HostsXpert 4.2 - Hosts File Manager from its new home
  • Click on "File Handling".
  • Click on "Restore MS Hosts File".
  • Click OK on the Confirmation box.
  • Now lets import a custom hosts file to block unwanted sites:
    • Right click Here and save hosts.txt to your Desktop
    • In HostsXpert 4.2 click Import Options
    • Click Replace Hosts File
    • In the Select File dialog, navigate to your Desktop and choose hosts.txt
    • Click the Open button
    • Click OK to Replace Your Hosts File
  • Click on "Make Read Only?"
  • Click the X to exit the program.
  • Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • When it has finished, DSS will open two Notepad files: main.txt and extra.txt
  • Use Save As to save both Notepad files to your Desktop and post them in your next reply.
Note: A copy of these files can be found in you root drive, usually C:\Deckard\System Scanner\

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


So in your next reply, please include the following logs:
  • The contents of the SDFic Report.txt
  • The contents of the MBAM log
  • The contents of DSS main.txt and extra.txt
Note that you will probably need to make two or three posts to ensure all the logs are posted in full.

Regards,
RatHat
Here is the report from SDfix…I will run the Host experts file manager next. Thanks


SDFix: Version 1.182
Run by [removed] on Mon 05/12/2008 at 07:07 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
QANDR
SXI40

Path :
\??\C:\WINDOWS\system32\drivers\qandr.sys
System32\Drivers\Sxi40.sys

QANDR - Deleted
SXI40 - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value

Rebooting

Service SXI40 - Deleted

Checking Files :

Trojan Files Found:

C:\208663~1 - Deleted
C:\WINDOWS\privacy_danger\index.htm - Deleted
C:\WINDOWS\privacy_danger\images\capt.gif - Deleted
C:\WINDOWS\privacy_danger\images\danger.jpg - Deleted
C:\WINDOWS\privacy_danger\images\down.gif - Deleted
C:\WINDOWS\privacy_danger\images\spacer.gif - Deleted
C:\WINDOWS\fvowketqeoq.dll - Deleted
C:\WINDOWS\mpfanvqg.dll - Deleted
C:\WINDOWS\oadkxrts.exe - Deleted
C:\WINDOWS\pvnsmfor.dll - Deleted
C:\WINDOWS\rs.txt - Deleted
C:\WINDOWS\system32\crypts.dll - Deleted
C:\WINDOWS\vbksrofa.dll - Deleted
C:\WINDOWS\system32\drivers\qandr.sys - Deleted
C:\WINDOWS\system32\pjsapdg.sys - Deleted
C:\WINDOWS\system32\drivers\SXI40.sys - Deleted



Folder C:\WINDOWS\privacy_danger - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 19:30:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272c12777]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000272c12777]

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A390CF2E-4B4A-E6D5-2412-77162A79DF95}]
"iakdeeioplfopgoldo"=hex:6a,61,68,67,62,6c,67,63,67,67,62,6b,6e,65,6f,64,61,61,65,6d,00,..
"haeggpjgkaffhgkl"=hex:6a,61,68,67,62,6c,67,63,67,67,62,6b,6e,65,6f,64,61,61,65,6d,00,..

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Abacast\\Abaclient.exe"="C:\\Program Files\\Abacast\\Abaclient.exe:*:Enabled:Abaclient"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\utorrent\\utorrent.exe"="C:\\Program Files\\utorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"="C:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe:*:Enabled:Roxio Upnp Service"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"="C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"%windir%\\explorer.exe"="%windir%\\explorer.exe:*:Enabled:Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 30 Nov 2004 253,952 A..HR — "C:\A.O.SmithBackup-1\PocketCache Trial Version\BackupRestoreBus.dll"
Thu 23 Dec 2004 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 13 Jan 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Mon 13 Nov 2006 319,456 A..H. — "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
Sat 26 Mar 2005 1,206 A..HR — "C:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg.reg"
Sat 26 Mar 2005 12,368 A..HR — "C:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient.reg"
Sat 10 May 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\b04031f0b83ee952189dd8beb4ee929a\BIT11.tmp"
Thu 5 Oct 2006 3,702 A.SH. — "C:\Documents and Settings\Ronnie\Application Data\Roxio\Dragon\3.x\DiscInfoCache\HL-DT-ST_DVDRAM_GSA-E10L_LE05_700_DICV018_DRGV300005B.TMP"
Thu 12 Apr 2007 8 A..H. — "C:\Documents and Settings\Ronnie\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Thu 12 Apr 2007 8 A..H. — "C:\Documents and Settings\Ronnie\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Thu 12 Apr 2007 8 A..H. — "C:\Documents and Settings\Ronnie\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Thu 12 Apr 2007 8 A..H. — "C:\Documents and Settings\Ronnie\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"

Finished!
When you have completed HostXpert, please uninstall the following programs:

BitTorrent
LimeWire
uTorrent

  • Go to Start then Settings, then Control Panel
  • Choose Add or Remove Programs
  • Remove all of the above
These programs act as conduits for malware to download additional malware, and are probably the source of your infection. If you choose to reinsatall them later, you are very likely to become infected again.

Regards,
RatHat
Everything is much better already. I have not did the uninstall yet I will this afternoon after work. Here is the log from MBAM: Malwarebytes' Anti-Malware 1.12 Database version: 744 Scan type: Quick Scan Objects scanned: 59277 Time elapsed: 3 hour(s), 4 minute(s), 40 second(s) Memory Processes Infected: 1 Memory Modules Infected: 3 Registry Keys Infected: 35 Registry Values Infected: 7 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 30 Memory Processes Infected: c:\Documents and Settings\Ronnie\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> Unloaded process successfully. Memory Modules Infected: C:\WINDOWS\SYSTEM32\aeqiqtdc.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\SYSTEM32\urqNDVoN.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\SYSTEM32\geBsqoPG.dll (Trojan.Vundo) -> Unloaded module successfully. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf1213a6-2336-4ffd-84dc-56ce30f970e4} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{bf1213a6-2336-4ffd-84dc-56ce30f970e4} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\logicfunctions.logicfunctions (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\logicfunctions.logicfunctions.1 (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{18cb1a7b-94cd-4582-8022-ada16851e44b} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{8b8df25f-2c47-4473-8e1c-7f54ac7ef481} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\msapp.bhoapp (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{aad1c6ad-10ab-4cae-97fb-0aaddec8a14b} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\msapp.bhoapp.1 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{5ccf3b40-253e-4d22-a790-c2a25de3f25b} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f3619035-750e-4a0a-8fb2-31d5c4bdc2d4} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{dc8305b3-1ee7-4d58-83ef-2c5bc6c6566c} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gebsqopg (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7c5f8983 (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> Delete on reboot. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\Source (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TacOnlyOne\MalWarrior (Rogue.MalWarrior) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\urqndvon -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\urqndvon -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: c:\Documents and Settings\Ronnie\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\aeqiqtdc.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\SYSTEM32\cdtqiqea.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\gbebdflg.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\glfdbebg.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\pafpjhvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\tvhjpfap.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\ssqRKbYO.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\OYbKRqss.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\OYbKRqss.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\urqNDVoN.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\SYSTEM32\NoVDNqru.ini (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\SYSTEM32\NoVDNqru.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\hmlphl.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\geBsqoPG.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\SYSTEM32\nvrsma.dll (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\scerpt.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\yayaYqND.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\d1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\ddrjjhqh.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\ftklhae.exe (Backdoor.Rustock) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temp\964E.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temp\setup_526_1_.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\2UC8RAOB\hctp[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\A70ZV9PQ\hctp[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\A70ZV9PQ\vsjjxbs[1].htm (Backdoor.Rustock) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\C4NDCGH7\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\C4NDCGH7\css4[2] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\ZC3HP5DP\szqdeizan[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Ronnie\Local Settings\Temp\nyps4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
After you have done the uninstall's, could you run DSS and post me the two logs it produces please, then we can start to clean up the remnants. Regards, RatHat
DSS - Main

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-05-13 11:14:33
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
94: 2008-05-13 15:14:47 UTC - RP505 - Deckard's System Scanner Restore Point
93: 2008-05-11 18:58:42 UTC - RP504 - Installed Trend Micro PC-cillin Internet Security 2007.
92: 2008-05-11 03:56:12 UTC - RP503 - Restore Operation
91: 2008-05-11 03:47:23 UTC - RP502 - Removed Lizardtech DjVu Control
90: 2008-05-10 23:23:46 UTC - RP501 - Last known good configuration


– First Restore Point –
1: 2008-05-10 23:23:15 UTC - RP412 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as Ronnie.exe) ———————————————-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:17 AM, on 5/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Documents and Settings\Ronnie\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Ronnie.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1160686380109
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://camera.clemson.edu/sikes/AxisCamControl.ocx
O16 - DPF: {AB294EC6-7ADA-11D4-9D5F-00B0D04BBD07} (msichat50 Client Control) - http://media.rivals.com/msichat.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\SYSTEM32\acs.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (pcctlcom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (pcscnsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Trend Micro Real-time Service (tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (tmpfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

–
End of file - 7979 bytes

– HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ———–

backup-20080511-001855-405 O4 - HKCU\..\Run: [MalWarrior] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe" /autorun
backup-20080511-001855-811 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
backup-20080511-194611-865 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
backup-20080511-194655-244 O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
backup-20080511-194655-848 O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
backup-20080511-200109-296 O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
backup-20080511-200109-307 O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
backup-20080511-200109-482 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
backup-20080511-200109-547 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2

– File Associations ———————————————————–

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys
Make sure that you uninstall the P2P programs.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Regards,
RatHat
ComboFix 08-05-12.1 - Ronnie 2008-05-13 15:06:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.582 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Ronnie\Application Data\inst.exe
C:\Documents and Settings\Ronnie\Application Data\macromedia\Flash Player\#SharedObjects\X6RVS8CH\www.broadcaster.com
C:\Documents and Settings\Ronnie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Ronnie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\SYSTEM32\NoVDNqru.ini
C:\WINDOWS\SYSTEM32\NoVDNqru.ini2
C:\WINDOWS\system32\xsdcxddu.ini
C:\WINDOWS\system32\yqxgdrlu.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_pjsapdg


((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 )))))))))))))))))))))))))))))))
.

2008-05-13 11:14 . 2008-05-13 11:14 d—-c— C:\Deckard
2008-05-12 22:28 . 2008-05-12 22:28 d—-c— C:\Documents and Settings\Ronnie\Application Data\Malwarebytes
2008-05-12 22:27 . 2008-05-12 22:27 d—-c— C:\Program Files\Malwarebytes' Anti-Malware
2008-05-12 22:27 . 2008-05-12 22:27 d—-c— C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-12 22:27 . 2008-05-05 20:46 27,048 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\mbamcatchme.sys
2008-05-12 22:27 . 2008-05-05 20:46 15,864 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-05-12 18:57 . 2008-05-12 18:57 d—-c— C:\WINDOWS\ERUNT
2008-05-12 18:50 . 2008-05-12 19:58 d—-c— C:\SDFix
2008-05-12 16:43 . 2008-05-13 05:32 91,264 —–c— C:\WINDOWS\SYSTEM32\aeqiqtdc.dll
2008-05-11 22:21 . 2008-05-11 22:21 d—-c— C:\Program Files\CCleaner
2008-05-11 20:21 . 2007-09-06 00:22 289,144 –a–c— C:\WINDOWS\SYSTEM32\VCCLSID.exe
2008-05-11 20:21 . 2006-04-27 17:49 288,417 –a–c— C:\WINDOWS\SYSTEM32\SrchSTS.exe
2008-05-11 20:21 . 2008-04-24 08:10 86,528 –a–c— C:\WINDOWS\SYSTEM32\VACFix.exe
2008-05-11 20:21 . 2008-04-28 08:03 82,944 –a–c— C:\WINDOWS\SYSTEM32\IEDFix.exe
2008-05-11 20:21 . 2008-04-28 08:03 82,944 –a–c— C:\WINDOWS\SYSTEM32\404Fix.exe
2008-05-11 20:21 . 2003-06-05 21:13 53,248 –a–c— C:\WINDOWS\SYSTEM32\Process.exe
2008-05-11 20:21 . 2007-10-04 00:36 25,600 –a–c— C:\WINDOWS\SYSTEM32\WS2Fix.exe
2008-05-11 18:27 . 2008-05-12 18:43 10,752 –a–c— C:\WINDOWS\DCEBoot.exe
2008-05-11 15:00 . 2008-05-11 15:00 d—-c— C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-05-11 15:00 . 2008-03-30 18:50 1,169,240 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\vsapint.sys
2008-05-11 15:00 . 2007-04-12 18:58 300,816 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\TM_CFW.sys
2008-05-11 15:00 . 2008-03-30 19:07 204,816 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tmxpflt.sys
2008-05-11 15:00 . 2007-04-12 18:58 112,400 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tm_mbd_c.sys
2008-05-11 15:00 . 2007-04-12 18:58 75,792 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tmtdi.sys
2008-05-11 15:00 . 2008-03-30 19:07 36,368 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tmpreflt.sys
2008-05-11 10:11 . 2008-05-13 05:32 320,640 —–c— C:\WINDOWS\SYSTEM32\urqNDVoN.dll
2008-05-11 00:19 . 2008-05-11 00:19 29 –a–c— C:\WINDOWS\SYSTEM32\rwudpsdu.tmp
2008-05-11 00:16 . 2008-05-11 14:59 d—-c— C:\Program Files\Trend Micro
2008-05-11 00:05 . 2008-05-12 05:33 d—-c— C:\Documents and Settings\Ronnie\Application Data\TmpRecentIcons
2008-05-10 23:43 . 2008-05-11 18:00 d—-c— C:\Program Files\LogicFunctions
2008-05-10 23:42 . 2008-05-10 23:42 78,476 –a–c— C:\WINDOWS\SYSTEM32\spywarewarning2.mht
2008-05-10 19:18 . 2008-05-10 19:18 54,784 –a–c— C:\WINDOWS\SYSTEM32\gh.l
2008-05-10 19:18 . 2008-05-10 19:18 32,768 –a–c— C:\WINDOWS\SYSTEM32\yl.po
2008-05-10 19:18 . 2008-05-10 19:18 28,672 –a–c— C:\WINDOWS\SYSTEM32\mn.n
2008-05-10 19:18 . 2008-05-10 19:18 28,672 –a–c— C:\WINDOWS\SYSTEM32\ccs.so
2008-05-10 19:18 . 2008-05-10 19:18 28,672 –a–c— C:\WINDOWS\SYSTEM32\bmf.cs
2008-05-10 19:18 . 2008-05-10 19:18 1 –a–c— C:\WINDOWS\SYSTEM32\kr_done1de
2008-05-10 19:17 . 2008-05-13 05:32 29,312 —–c— C:\WINDOWS\SYSTEM32\geBsqoPG.dll
2008-05-08 16:35 . 2008-05-08 16:35 d—-c— C:\Program Files\MSECache
2008-05-01 21:52 . 2008-05-01 21:52 d—-c— C:\Program Files\Vertex Standard
2008-05-01 21:52 . 2007-01-10 14:55 929,844 –a–c— C:\WINDOWS\SYSTEM32\MFC42D.DLL
2008-05-01 21:52 . 2007-01-10 14:55 798,773 –a–c— C:\WINDOWS\SYSTEM32\MFCO42D.DLL
2008-05-01 21:52 . 2007-01-10 14:55 434,252 –a–c— C:\WINDOWS\SYSTEM32\MSVCRTD.DLL
2008-05-01 21:52 . 2007-01-10 14:55 244,416 –a–c— C:\WINDOWS\SYSTEM32\MSFLXGRD.OCX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-13 18:59 ——— dc—-w C:\Program Files\Symantec
2008-05-13 18:58 ——— dc—-w C:\Program Files\Common Files\Symantec Shared
2008-05-12 21:40 ——— dc—-w C:\Documents and Settings\Ronnie\Application Data\WeatherBug
2008-05-12 00:11 ——— dc—-w C:\Program Files\Spybot - Search & Destroy
2008-05-12 00:10 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-11 04:06 ——— dc—-w C:\Program Files\lg_fwupdate
2008-05-03 08:56 ——— dc—-w C:\Program Files\Safari
2008-05-03 08:50 ——— dc—-w C:\Program Files\Apple Software Update
2008-05-02 01:52 ——— dc-h–w C:\Program Files\InstallShield Installation Information
2008-04-14 01:57 ——— dc—-w C:\Documents and Settings\Ronnie\Application Data\Vso
2008-04-05 12:24 ——— dc—-w C:\Documents and Settings\Ronnie\Application Data\Apple Computer
2008-04-05 00:37 ——— dc—-w C:\Program Files\iTunes
2008-04-05 00:37 ——— dc—-w C:\Program Files\iPod
2008-04-05 00:35 ——— dc—-w C:\Program Files\QuickTime
2008-04-02 02:18 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-04-02 02:07 ——— dc—-w C:\Documents and Settings\All Users\Application Data\avg8
2008-04-02 01:46 ——— dc—-w C:\Program Files\Java
2008-04-01 19:07 ——— dc—-w C:\Program Files\AVG
2008-04-01 15:43 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-29 15:13 118,712 -c–a-w C:\Documents and Settings\Ronnie\Application Data\GDIPFONTCACHEV1.DAT
2008-03-18 20:50 ——— dc—-w C:\Program Files\Viewpoint
2008-03-18 20:50 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-13 00:56 ——— dc—-w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-13 00:48 ——— dc—-w C:\Program Files\Common Files\Macrovision Shared
2008-03-13 00:41 9,464 -c–a-w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-03-13 00:41 9,336 -c–a-w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-03-13 00:41 43,528 -c–a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-16 13:58 47,360 -c–a-w C:\Documents and Settings\Ronnie\Application Data\pcouffin.sys
2007-11-20 18:34 92,064 -c–a-w C:\Documents and Settings\Ronnie\mqdmmdm.sys
2007-11-20 18:34 9,232 -c–a-w C:\Documents and Settings\Ronnie\mqdmmdfl.sys
2007-11-20 18:34 79,328 -c–a-w C:\Documents and Settings\Ronnie\mqdmserd.sys
2007-11-20 18:34 66,656 -c–a-w C:\Documents and Settings\Ronnie\mqdmbus.sys
2007-11-20 18:34 6,208 -c–a-w C:\Documents and Settings\Ronnie\mqdmcmnt.sys
2007-11-20 18:34 5,936 -c–a-w C:\Documents and Settings\Ronnie\mqdmwhnt.sys
2007-11-20 18:34 4,048 -c–a-w C:\Documents and Settings\Ronnie\mqdmcr.sys
2007-11-20 18:34 25,600 -c–a-w C:\Documents and Settings\Ronnie\usbsermptxp.sys
2007-11-20 18:34 22,768 -c–a-w C:\Documents and Settings\Ronnie\usbsermpt.sys
2004-10-01 19:00 40,960 -c–a-w C:\Program Files\Uninstall_CDS.exe
.
C:\WINDOWS\system32\user32.dll … is infected !! (additional data below)
577,024 2005-03-02 18:19:56 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
578,048 2007-03-08 15:48:36 C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
577,024 2004-08-04 11:00:00 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
577,024 2005-03-02 18:09:30 C:\WINDOWS\$NtUninstallKB925902$\user32.dll
577,536 2008-05-10 23:18:20 C:\WINDOWS\SYSTEM32\user32.dll
577,536 2008-05-10 23:18:20 C:\WINDOWS\SYSTEM32\DLLCACHE\user32.dll


——- Sigcheck ——-

2005-03-02 14:19 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 11:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
2004-08-04 07:00 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
2005-03-02 14:09 577024 de2db164bbb35db061af0997e4499054 C:\WINDOWS\$NtUninstallKB925902$\user32.dll
2008-05-10 19:18 577536 e682216cfd5e2977a5cba3bff0a52a36 C:\WINDOWS\SYSTEM32\user32.dll
2008-05-10 19:18 577536 e682216cfd5e2977a5cba3bff0a52a36 C:\WINDOWS\SYSTEM32\DLLCACHE\user32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [2006-04-07 16:02 1343488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-04-12 18:58 3429904]

C:\Documents and Settings\Ronnie\Start Menu\Programs\Startup\
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-05-04 15:39:42 2913840]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Belkin Wireless Utility.lnk - C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe [2005-08-18 17:09:58 1388544]
Device Detector 2.lnk - C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe [2005-08-19 16:14:41 94208]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.HFYU"= huffyuv.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sxi40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Abacast\\Abaclient.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\explorer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"30018:TCP"= 30018:TCP:port
"17210:TCP"= 17210:TCP:port

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
R3 BLKWGD;Belkin Wireless G Desktop Card Service;C:\WINDOWS\system32\DRIVERS\BLKWGD.sys [2005-06-01 23:37]
R3 wlanndi5;wlanndi5 NDIS Protocol Driver;C:\WINDOWS\system32\wlanndi5.SYS [2004-04-21 17:51]
S3 lgatbus;LG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\lgatbus.sys [2002-10-15 19:03]
S3 lgatmdm;LG CDMA USB Modem Drivers;C:\WINDOWS\system32\DRIVERS\lgatmdm.sys [2002-10-15 19:05]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);C:\WINDOWS\system32\DRIVERS\lgatserd.sys [2002-10-15 19:07]
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2004-08-11 22:18]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-09 16:04:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-09 22:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (TUMBLEWEED-Chrissie).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-05-10 23:24:23 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44ADBD19-9174-4151-BEF2-BE91A566B651}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 15:19:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pjsapdg]
"ImagePath"="\??\C:\WINDOWS\system32\pjsapdg.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Schedule]
"ImagePath"=""
.
———————— Other Running Processes ————————
.
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\pccguide.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.EXE
.
**************************************************************************
.
Completion time: 2008-05-13 15:35:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-13 19:35:07

Pre-Run: 11,304,185,856 bytes free
Post-Run: 11,339,247,616 bytes free

219 — E O F — 2008-05-09 19:01:45
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:38:45 PM, on 5/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://photos.walmart.com/WalmartOutlookImport.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1160686380109
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://camera.clemson.edu/sikes/AxisCamControl.ocx
O16 - DPF: {AB294EC6-7ADA-11D4-9D5F-00B0D04BBD07} (msichat50 Client Control) - http://media.rivals.com/msichat.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\SYSTEM32\acs.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (pcctlcom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (pcscnsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Trend Micro Real-time Service (tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (tmpfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

–
End of file - 7350 bytes
Please delete the version of Combofix that you have. Download a new version from Here, Here or Here and save it to your Desktop.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Regards,
RatHat
Latest Combo Fix Log

ComboFix 08-05-12.1 - Ronnie 2008-05-13 22:36:38.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.398 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Spyware Fixes\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ronnie\Desktop\Spyware Fixes\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-04-14 to 2008-05-14 )))))))))))))))))))))))))))))))
.

2008-05-13 11:14 . 2008-05-13 11:14 d—-c— C:\Deckard
2008-05-12 22:28 . 2008-05-12 22:28 d—-c— C:\Documents and Settings\Ronnie\Application Data\Malwarebytes
2008-05-12 22:27 . 2008-05-12 22:27 d—-c— C:\Program Files\Malwarebytes' Anti-Malware
2008-05-12 22:27 . 2008-05-12 22:27 d—-c— C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-12 22:27 . 2008-05-05 20:46 27,048 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\mbamcatchme.sys
2008-05-12 22:27 . 2008-05-05 20:46 15,864 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-05-12 18:57 . 2008-05-12 18:57 d—-c— C:\WINDOWS\ERUNT
2008-05-12 18:50 . 2008-05-12 19:58 d—-c— C:\SDFix
2008-05-12 16:43 . 2008-05-13 05:32 91,264 —–c— C:\WINDOWS\SYSTEM32\aeqiqtdc.dll
2008-05-11 22:21 . 2008-05-11 22:21 d—-c— C:\Program Files\CCleaner
2008-05-11 20:21 . 2007-09-06 00:22 289,144 –a–c— C:\WINDOWS\SYSTEM32\VCCLSID.exe
2008-05-11 20:21 . 2006-04-27 17:49 288,417 –a–c— C:\WINDOWS\SYSTEM32\SrchSTS.exe
2008-05-11 20:21 . 2008-04-24 08:10 86,528 –a–c— C:\WINDOWS\SYSTEM32\VACFix.exe
2008-05-11 20:21 . 2008-04-28 08:03 82,944 –a–c— C:\WINDOWS\SYSTEM32\IEDFix.exe
2008-05-11 20:21 . 2008-04-28 08:03 82,944 –a–c— C:\WINDOWS\SYSTEM32\404Fix.exe
2008-05-11 20:21 . 2003-06-05 21:13 53,248 –a–c— C:\WINDOWS\SYSTEM32\Process.exe
2008-05-11 20:21 . 2007-10-04 00:36 25,600 –a–c— C:\WINDOWS\SYSTEM32\WS2Fix.exe
2008-05-11 18:27 . 2008-05-12 18:43 10,752 –a–c— C:\WINDOWS\DCEBoot.exe
2008-05-11 15:00 . 2008-05-11 15:00 d—-c— C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-05-11 15:00 . 2008-03-30 18:50 1,169,240 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\vsapint.sys
2008-05-11 15:00 . 2007-04-12 18:58 300,816 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\TM_CFW.sys
2008-05-11 15:00 . 2008-03-30 19:07 204,816 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tmxpflt.sys
2008-05-11 15:00 . 2007-04-12 18:58 112,400 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tm_mbd_c.sys
2008-05-11 15:00 . 2007-04-12 18:58 75,792 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tmtdi.sys
2008-05-11 15:00 . 2008-03-30 19:07 36,368 –a–c— C:\WINDOWS\SYSTEM32\DRIVERS\tmpreflt.sys
2008-05-11 10:11 . 2008-05-13 05:32 320,640 —–c— C:\WINDOWS\SYSTEM32\urqNDVoN.dll
2008-05-11 00:19 . 2008-05-11 00:19 29 –a–c— C:\WINDOWS\SYSTEM32\rwudpsdu.tmp
2008-05-11 00:16 . 2008-05-11 14:59 d—-c— C:\Program Files\Trend Micro
2008-05-11 00:05 . 2008-05-12 05:33 d—-c— C:\Documents and Settings\Ronnie\Application Data\TmpRecentIcons
2008-05-10 23:43 . 2008-05-11 18:00 d—-c— C:\Program Files\LogicFunctions
2008-05-10 23:42 . 2008-05-10 23:42 78,476 –a–c— C:\WINDOWS\SYSTEM32\spywarewarning2.mht
2008-05-10 19:18 . 2008-05-10 19:18 54,784 –a–c— C:\WINDOWS\SYSTEM32\gh.l
2008-05-10 19:18 . 2008-05-10 19:18 32,768 –a–c— C:\WINDOWS\SYSTEM32\yl.po
2008-05-10 19:18 . 2008-05-10 19:18 28,672 –a–c— C:\WINDOWS\SYSTEM32\mn.n
2008-05-10 19:18 . 2008-05-10 19:18 28,672 –a–c— C:\WINDOWS\SYSTEM32\ccs.so
2008-05-10 19:18 . 2008-05-10 19:18 28,672 –a–c— C:\WINDOWS\SYSTEM32\bmf.cs
2008-05-10 19:18 . 2008-05-10 19:18 1 –a–c— C:\WINDOWS\SYSTEM32\kr_done1de
2008-05-10 19:17 . 2008-05-13 05:32 29,312 —–c— C:\WINDOWS\SYSTEM32\geBsqoPG.dll
2008-05-08 16:35 . 2008-05-08 16:35 d—-c— C:\Program Files\MSECache
2008-05-01 21:52 . 2008-05-01 21:52 d—-c— C:\Program Files\Vertex Standard
2008-05-01 21:52 . 2007-01-10 14:55 929,844 –a–c— C:\WINDOWS\SYSTEM32\MFC42D.DLL
2008-05-01 21:52 . 2007-01-10 14:55 798,773 –a–c— C:\WINDOWS\SYSTEM32\MFCO42D.DLL
2008-05-01 21:52 . 2007-01-10 14:55 434,252 –a–c— C:\WINDOWS\SYSTEM32\MSVCRTD.DLL
2008-05-01 21:52 . 2007-01-10 14:55 244,416 –a–c— C:\WINDOWS\SYSTEM32\MSFLXGRD.OCX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-13 18:59 ——— dc—-w C:\Program Files\Symantec
2008-05-13 18:58 ——— dc—-w C:\Program Files\Common Files\Symantec Shared
2008-05-12 21:40 ——— dc—-w C:\Documents and Settings\Ronnie\Application Data\WeatherBug
2008-05-12 00:11 ——— dc—-w C:\Program Files\Spybot - Search & Destroy
2008-05-12 00:10 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-11 04:06 ——— dc—-w C:\Program Files\lg_fwupdate
2008-05-03 08:56 ——— dc—-w C:\Program Files\Safari
2008-05-03 08:50 ——— dc—-w C:\Program Files\Apple Software Update
2008-05-02 01:52 ——— dc-h–w C:\Program Files\InstallShield Installation Information
2008-04-14 01:57 ——— dc—-w C:\Documents and Settings\Ronnie\Application Data\Vso
2008-04-05 12:24 ——— dc—-w C:\Documents and Settings\Ronnie\Application Data\Apple Computer
2008-04-05 00:37 ——— dc—-w C:\Program Files\iTunes
2008-04-05 00:37 ——— dc—-w C:\Program Files\iPod
2008-04-05 00:35 ——— dc—-w C:\Program Files\QuickTime
2008-04-02 02:18 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-04-02 02:07 ——— dc—-w C:\Documents and Settings\All Users\Application Data\avg8
2008-04-02 01:46 ——— dc—-w C:\Program Files\Java
2008-04-01 19:07 ——— dc—-w C:\Program Files\AVG
2008-04-01 15:43 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-29 15:13 118,712 -c–a-w C:\Documents and Settings\Ronnie\Application Data\GDIPFONTCACHEV1.DAT
2008-03-18 20:50 ——— dc—-w C:\Program Files\Viewpoint
2008-03-18 20:50 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-16 13:58 47,360 -c–a-w C:\Documents and Settings\Ronnie\Application Data\pcouffin.sys
2007-11-20 18:34 92,064 -c–a-w C:\Documents and Settings\Ronnie\mqdmmdm.sys
2007-11-20 18:34 9,232 -c–a-w C:\Documents and Settings\Ronnie\mqdmmdfl.sys
2007-11-20 18:34 79,328 -c–a-w C:\Documents and Settings\Ronnie\mqdmserd.sys
2007-11-20 18:34 66,656 -c–a-w C:\Documents and Settings\Ronnie\mqdmbus.sys
2007-11-20 18:34 6,208 -c–a-w C:\Documents and Settings\Ronnie\mqdmcmnt.sys
2007-11-20 18:34 5,936 -c–a-w C:\Documents and Settings\Ronnie\mqdmwhnt.sys
2007-11-20 18:34 4,048 -c–a-w C:\Documents and Settings\Ronnie\mqdmcr.sys
2007-11-20 18:34 25,600 -c–a-w C:\Documents and Settings\Ronnie\usbsermptxp.sys
2007-11-20 18:34 22,768 -c–a-w C:\Documents and Settings\Ronnie\usbsermpt.sys
2004-10-01 19:00 40,960 -c–a-w C:\Program Files\Uninstall_CDS.exe
.
Infected C:\WINDOWS\system32\user32.dll hex repaired


((((((((((((((((((((((((((((( snapshot@2008-05-13_15.34.41.95 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-13 19:16:01 2,048 –s-a-w C:\WINDOWS\BOOTSTAT.DAT
+ 2008-05-14 02:44:44 2,048 –s-a-w C:\WINDOWS\BOOTSTAT.DAT
- 2008-05-10 23:18:20 577,536 -c–a-w C:\WINDOWS\SYSTEM32\DLLCACHE\user32.dll
+ 2004-08-04 11:00:00 577,024 -c–a-w C:\WINDOWS\SYSTEM32\DLLCACHE\user32.dll
- 2008-05-10 23:18:20 577,536 -c–a-w C:\WINDOWS\SYSTEM32\user32.dll
+ 2004-08-04 11:00:00 577,024 -c–a-w C:\WINDOWS\SYSTEM32\user32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [2006-04-07 16:02 1343488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-04-12 18:58 3429904]

C:\Documents and Settings\Ronnie\Start Menu\Programs\Startup\
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-05-04 15:39:42 2913840]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Belkin Wireless Utility.lnk - C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe [2005-08-18 17:09:58 1388544]
Device Detector 2.lnk - C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe [2005-08-19 16:14:41 94208]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.HFYU"= huffyuv.dll
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sxi40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Abacast\\Abaclient.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\explorer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"30018:TCP"= 30018:TCP:port
"17210:TCP"= 17210:TCP:port

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
R3 BLKWGD;Belkin Wireless G Desktop Card Service;C:\WINDOWS\system32\DRIVERS\BLKWGD.sys [2005-06-01 23:37]
R3 wlanndi5;wlanndi5 NDIS Protocol Driver;C:\WINDOWS\system32\wlanndi5.SYS [2004-04-21 17:51]
S3 lgatbus;LG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\lgatbus.sys [2002-10-15 19:03]
S3 lgatmdm;LG CDMA USB Modem Drivers;C:\WINDOWS\system32\DRIVERS\lgatmdm.sys [2002-10-15 19:05]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);C:\WINDOWS\system32\DRIVERS\lgatserd.sys [2002-10-15 19:07]
S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2004-08-11 22:18]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-09 16:04:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-09 22:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (TUMBLEWEED-Chrissie).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-05-10 23:24:23 C:\WINDOWS\Tasks\User_Feed_Synchronization-{44ADBD19-9174-4151-BEF2-BE91A566B651}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-13 22:46:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\SYSTEM32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\pccguide.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.EXE
.
**************************************************************************
.
Completion time: 2008-05-13 23:05:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-14 03:05:19
ComboFix2.txt 2008-05-13 19:35:17

Pre-Run: 11,221,512,192 bytes free
Post-Run: 11,178,020,864 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

194 — E O F — 2008-05-09 19:01:45
Good!

Could you run an online scan with Kaspersky WebScanner to see if there is anything left over. Note: You must use Internet Explorer to run this scan.

Click the Accept button.

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display the results if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop as Kaspersky.txt.
  • Copy and paste that information in your next post.
The file is very large…It is is 5000k. It has a lot of files that are locked under my daughters user name. Here is part of it…I tried to break it down into 3 posts but that said too large also. I have a new version on Trend micro PC-cillin on my PC. Do you want me to run a scan with it? THere are still viruses on the PC according to Kaspersky. KASPERSKY ONLINE SCANNER REPORT Wednesday, May 14, 2008 6:43:05 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 14/05/2008 Kaspersky Anti-Virus database records: 773418 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 139838 Number of viruses found: 27 Number of infected objects: 93 Number of suspicious objects: 0 Duration of the scan process: 02:21:15 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\DOCUME~1\Ronnie\LOCALS~1\Temp\3F0B.tmp Infected: Trojan-Downloader.Win32.Injecter.qh skipped C:\Deckard\System Scanner\backup\DOCUME~1\Ronnie\LOCALS~1\Temp\7582.tmp Infected: Trojan-Downloader.Win32.Mutant.sp skipped C:\Deckard\System Scanner\backup\DOCUME~1\Ronnie\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O3FMWBFP\installer_abr[1].exe Infected: not-a-virus:FraudTool.Win32.SpywareIsolator.u skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\SYSTEM\state\logs\sprtcmd.log Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\AcroForm\MRUFormsList Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\AdobeComFnt06.lst Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\Collab\OfflineDocs Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\Collab\Reviews Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\Preferences\AutoFillDefaults.dat Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\Preferences\defaultHeuristics.dat Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\TMGrpPrm.sav Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Adobe\Acrobat\6.0\Updater\udstore.js Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D20472 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D205A1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D216F2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D21E02 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D21F3F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D22364 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D260AA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201D263BD Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E05F3A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E06201 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E06722 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E068C0 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E076D1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E076D4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0201E07BBC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\0202562A8A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00000139 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000002D2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00000319 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00000462 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00000576 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00000724 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000008C1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00000A60 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001131 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001380 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000013BA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000013C3 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000013CB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001684 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000018FE Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B0000190E Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001925 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001928 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001935 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B0000194C Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001986 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001995 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000019A8 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001D1B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001D25 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001D62 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001EA4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001F1F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001F23 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001F33 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00001FB4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B00002114 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\0\2B000025DE Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\00B767B412D26D7AE6F889C07E5C8EA7 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D20472 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D205A1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D216F2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D21E02 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D21F3F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D22364 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D25F66 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D260AA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201D263BD Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E052F1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E05F3A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E06201 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E06722 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E068C0 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E076D1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E076D4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0201E07BBC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0202562A8A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\02B07DE75F0B41CC11A9B6B18ABC8C57 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\035CC63F043DA703326FA0DC43BA5C50 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\04B66812CA6CA890FD9ED02827732EAC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\05356974616C79 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0535757361 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\05396275677369636F6E Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\072376A5DA645D838A66B8EA0159E8FB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\09299390BB0D7AD6D801C68666FDF25E Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0B211A4319841ACAC6270EAAB73E2E44 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0DB6C9AD2B6DAFA9F9C8E1B11B15AE37 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\0E1541E55323A7D1DADEF9584415FF5A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\16A0602D0A6C3A88B80D4CB6B0E5559F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\19ED7DC8D803549369AFCAB9213F3BB7 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\1C2A55D49614E78CDD61B12CD8B74FBE Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\1D01D6D4AEEDE3993FB4DED6A9E15164 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\1DA6F708C8D71862CD56F8496C9ADAB6 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\217F6D1377AC6A0AB8CF204755FF2637 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\257FE4235214D513F5742D2A89AB20E1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00000139 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000002D2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00000319 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00000462 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00000576 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00000724 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000008C1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00000A60 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001131 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001380 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000013C3 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000013CB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001684 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000018FE Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B0000190E Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001925 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001928 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001935 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B0000194C Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001969 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001986 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001995 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000019A8 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001D1B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001D25 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001D62 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001EA4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001F1F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001F23 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001F33 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00001FB4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B00002114 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2B000025DE Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2BA1E692A241EFA629F178A9C0519C60 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2DBF426719C5457936891EC1E8E6A9FF Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\2ED89E41357F06C67AD4FEF436570D62 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\30370054A81DC9071802964898B7BECB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\39028BA77E41ECC9705AC20EEDA687C1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\3B05D0E36FED8C0357F21CCB64794D59 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\3BFA702DDDEFBB47DC4EBADD1BBF73F5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\3F3EB3CB7DE089C8308E094FB19E04D5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\462BCD7CCFA417D54A3488752607CBA6 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\4B3B8CCDD27FC9A72469BA2606DD61E4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\4B85E016352E024782B4889E899CF2DC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\4CD87AE818D66CFFF3F5E5277E342D35 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\50FAAC04D9FF54BB5042A497A76F07A9 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\569601FD5D62ECD4D32CCDEF4929BFE5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\5B0A93E12A1D7CEF420EAFEF3650F5F7 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\5F81834CBA5FF1DA7689B2CB5AA311D7 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\60C59B9A212606CC991CF054E2742C9F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\6379EEE82B968F786B479D11FF7720AF Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\63F2E54FE231E2BB14F9B5605A5E2F5F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\69D91B30E478E81FDA9992526671B7D1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\70C33F40E1790DC5FE911843F9A00E7F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\71C2AFF52F9CC6D923604B4C895CBFC0 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\76989A4B9172590D50056F301082DA4F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\7B8B74D84CEAC6F52BF7E1FEC235159B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\7E7510D65CBBCB3FA14166A040792490 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\7FC50B124B16F59FC5D88B589E13E0D4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\806FC26F3EEBAC8256DE38432CB6370B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\81578E419DB5DEA6A85BB5FFCEB0F3ED Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\832353E45F1C981DFED9B12485573C84 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\83A11038E52F816F895FD82E321EDAF2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\848687C1EE649495D0123DC84948AE9B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\8A6919EA58A92FFD8C03F51A3D9527EC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\8A7AE38CB0401BCB0D70CB904BA40598 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\92DE1CF07A93CB1D54B1EF55C9414B1D Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\953F955F3BBDCF0FCF6491C744B2C133 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\9AF1A3A51FA4ED29643A4537D6768B8A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\9CAE3223037BBDED89C7112E19B6762B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\9FFCDA7643F783387DDDBBFEB0A17EE1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A08CBBFD0CE2604D43073C508E33FE7B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A2A0E152429D89E8A5C0EEF0778B3D72 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A786177D92AD0EE50138571F3AA5A792 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A7A7571D9C2BDF3FE86C517067F03941 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A835D3442653CECD7E06B7EFF2874710 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A923E437D9A23BB4FADB1566B7D32FA4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\A963E45841C426A963876DC79B7FD7DA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\B061603594AFF84FCF5BAED474EFA869 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\B71C2EA1649EF15748D799D270027FFE Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\B7E4CDF533B9FCFECD26445B1A6A4D25 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\B9889A2AD74B0E7C5B8ECB9CB7E50DBD Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\BDF7AFAB1261AD95CB6171ABE93459D3 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\C2355C6A4A16675AC5110103D1ABA98D Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\C253D219DBD6AE1F58F7555BAE47A2D4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\C55AFC4E5178C12C8FD216D6300C8462 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\C9667D2669B18186DDAD3EFE3F5B3F12 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\CE3F5BE1D00CF5D4DDA9EED0474CDDEC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\D298244A453E72CC764A3B198A81808F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\D480210507F3A3CC8B735E5245AA3825 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\D520E378FDFF67403FE1DC9FE06C9D72 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\D6D272C7D4922D0C52A939A3B5652105 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\DF88E69DCF907B6D931716CE8637E64F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\E345D9532860CC6489D847F8BB941A03 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\E484FA21D069739823B92D9BAB03C04E Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\E7877343B342DE5863B19788D1DAD7DF Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\E7F58C32337FF349A67F67370DC2DA0D Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\EA894C6019EDAD5DFD394E527684375C Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\EBC4710775594C13A07E939D1EBEC4C2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\ED5413C65049B6EC022CAEFC71957D46 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\EE92D96C3430EA3227A1CE357428FBBB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\EFC3F25B3D97CBCAC648CD1F83B81699 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\F230C5AA52354087329BE130B020BA9C Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\F4066BDEA325B50A877F7E088A156613 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\F850AC666B1EB9EAE8BC37E1F09B1E80 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1\FC28428B8348F00F773D8CE1160E6CE5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D201A5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D205C8 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D2071A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D21165 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D21391 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D243E3 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D244E5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D29563 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201D2956B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201E030A2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\0201E05FCF Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\2B000001B7 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\1024\2B000001E6 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D20380 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D21540 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D21655 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D21F85 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D22A96 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D22A99 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D22A9A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D24248 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D264A3 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201D264B9 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201E075CA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\0201E075CC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001204 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001221 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B000012F1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B0000144F Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B0000145A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001566 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001606 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001A25 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001B53 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001BCB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001BFA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001D10 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001D99 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001F57 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B00001F85 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\129\2B000020D5 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\136\2B00001BFA Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D20CF1 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D20D39 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D20DA2 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D219E8 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D21A32 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D22C0A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\0201D23F59 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\05696D73656E64 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00000713 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00000C2B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00000EFC Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00000F00 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B0000105D Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00001080 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B0000181B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00001B52 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\3\2B00001E8A Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\20736E6F7762616C6C Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\2B00001131 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\2B00001380 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\2B000013C3 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\2B000013CB Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\2B0000190E Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\2B00001EA4 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\5\678445B191EE66338706669A381E7D50 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\0201D219E8 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\0201D23F59 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\05696D73656E64 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\2B00000713 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\2B00000F00 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\2B00001080 Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\bartcache\96\2B0000181B Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\cert8.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\info.htm Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\key3.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\Resources\CurrentSettings.xml Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\secmod.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim10.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim11.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim12.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim13.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim14.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim15.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim16.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim17.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim18.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim19.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim1A.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim1B.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim1C.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim1D.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim1E.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim1F.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim20.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim21.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim22.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim23.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim24.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim25.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim26.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim27.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim28.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim29.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim2A.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim2B.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim2C.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim2D.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim2E.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim2F.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim30.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim31.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim34.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim35.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim36.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim367.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aim38.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aimA.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aimB.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aimC.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aimD.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aimE.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\aimF.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\cookie.dat Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\urlcache\urlcache.dat Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\chickedee1986\userinfo.bag Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter334\cert8.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter334\key3.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter334\secmod.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\cert8.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\key3.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\Resources\CurrentSettings.xml Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\secmod.db Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\urlcache\aim1F.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\urlcache\aim27.tmp Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\urlcache\cookie.dat Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\urlcache\urlcache.dat Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\foter344\userinfo.bag Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Aim\agdzuqlk\Resources\CurrentSettings.xml Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\bluterra.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\greenbrk.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\hatch.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\lace1.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\lace2.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\marble1.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\marble2.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\oil1.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\oil2.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\paper1.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\paper2.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\pine.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\poly.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\poplar.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\qw12EN.wpt Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\rock.gif Object is locked skipped C:\Documents and Settings\Chrissie\Application Data\Corel\PerfectExpert\12\Custom WP Templates\stucco1.gif Object
Could you zip the log, and then attach it into a reply?

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post
Regards,
RatHat

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI