Spyware / Malware / Virus Removal

[Resolved] Antivirus XP 08 Hijack & Malware

19 min read

Looking for the outcome? Ask AI

Rich08 Topic Starter

Post #1June 27, 2008, 1:47 AM UTC

Hello everybody,

I booted up my machine a day ago and found that the desktop had a little box that said, "Warning! Spyware detected on your computer. Install an antivirus or spyware remover to clean your computer." The program represented itself as "Antivirus XP 08." It hijacked my browser, di and continued running scans until I located the executable file and deleted it. It also caused numerous restarts and BSOD's. The executable file was something along the lines of "lphcvsrj0e3rr.exe". I deleted anything with that name including some ".pf" files that a file search located. I have since run Spybot which found a bunch of things to clean up.

From looking at the log I see that "BraviaX" is back and I previously deleted that, so I know there are still pieces of this malware on my machine. Also, Norton has popped up and said it has blocked (but not removed) "hacktool.rootkit." Norton also removed "Trojan.Gpcoder.E"

Any help would be greatly appreciated!

Here is the HiJack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:58:37 PM, on 6/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\aspimgr.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [lphcvsrj0e3rr] C:\WINDOWS\system32\lphcvsrj0e3rr.exe
O4 - HKLM\..\Run: [SMrhcrsrj0e3rr] C:\Program Files\rhcrsrj0e3rr\rhcrsrj0e3rr.exe
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Post to Wordpress - {9add1977-efbb-473e-846a-eb3d13f662e2} - C:\Program Files\vodpod\wpbutton\wpbutton_ie.html (HKCU)
O9 - Extra 'Tools' menuitem: Post to Wordpress - {9add1977-efbb-473e-846a-eb3d13f662e2} - C:\Program Files\vodpod\wpbutton\wpbutton_ie.html (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 14108 bytes

Gary R

Post #2June 27, 2008, 3:14 PM UTC

Looking over your log, back ASAP.

Gary R

Post #3June 27, 2008, 3:25 PM UTC

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.

Hi Rich08

I'm Gary R, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Perform all actions in the order given.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with it till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.

If you can do these things, everything should go smoothly.

If you're using XP, you'll need Administrator privileges to perform the fixes. (XP accounts are Administrator by default)

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Before we start I need you to disable Spybot S&D Teatimer as it will interfere with what we're trying to do.

To disable Spybot S&D TeaTimer

First step:

Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.

Second step:

Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Next

There are some new infections that damage your ability to boot if they are removed. So before we go any further, I need you to install Recovery Console to your computer. This is purely a precautionary measure, I don't see signs of them on your computer, but it's better to be a little cautious now than regretful later.

Recovery Console gives us the ability to recover your computer if things go wrong.

Download combofix.exe by sUBs to your Desktop (it must be in this location).
Alternate Download
If you already have a previous version, delete it and download a new version.
Go to Microsoft's website
Select the download that's appropriate for your Operating System (if you have XP Media Centre, use download for XP Pro)

[external image: Posted Image]

Download the file & save it as it's originally named, to your Desktop.

Next
Disconnect from the Internet.
Important! Temporarily disable your anti-virus, and anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its files which may cause unpredictable results.
Click here to see a list of programs that should be disabled (ignore the firewalls). The list is not all inclusive. If yours are not listed and you don't know how to disable them, please ask.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix.
When prompted, agree to the End-User License Agreement to install Microsoft Recovery Console.
When complete a mesage will pop up asking if you want to continue scanning for Malware.
- Click Yes
- Combofix will now run a scan. (Usually takes 15-20 mins, but could be slightly longer)
- When finished, it will
- Produce a log for you. (it can also be found at C:\Combofix.txt)
Post the log in your next reply please.
Now run a new HJT scan and send me the log from that as well please.

[*]Don't forget to re-enable your anti-virus and anti-malware protection before re-connecting to the Internet.

IMPORTANT

Do not use your computer while Combofix is running.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
If you've lost your Internet connection when Combofix has completely finished, re-start your computer to restore it.

If you have any problems with these instructions, a detailed Tutorial for how to use Combofix is available here.

Rich08

Post #4June 28, 2008, 2:43 AM UTC

Hi Gary,

Thanks for all your help!

Here is the ComboFix log:

ComboFix 08-06-20.4 - Rich 2008-06-27 23:42:27.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.158 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Rich\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Application Data\wsnpoem
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll
C:\Documents and Settings\Rich\Application Data\inst.exe
C:\Documents and Settings\NetworkService\Application Data\wsnpoem
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll
C:\WINDOWS\g32.txt
C:\WINDOWS\s32.txt
C:\WINDOWS\system32\5.tmp
C:\WINDOWS\system32\aspimgr.exe
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\sysrest32.exe
C:\WINDOWS\system32\winivstr.exe
C:\WINDOWS\ws386.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASPIMGR
——-\Service_aspimgr
——-\Service_sysrest.sys

((((((((((((((((((((((((( Files Created from 2008-05-27 to 2008-06-27 )))))))))))))))))))))))))))))))
.

2008-06-25 22:47 . 2008-06-25 22:47 d——– C:\Program Files\Trend Micro
2008-06-25 22:34 . 2008-06-25 22:34 d——– C:\Documents and Settings\Rich\Application Data\Uniblue
2008-06-25 21:21 . 2008-06-25 21:21 d——– C:\Program Files\Panda Security
2008-06-24 13:40 . 2008-06-24 13:40 96 –a—— C:\WINDOWS\wininit.ini
2008-06-24 11:28 . 2008-06-24 11:25 691,545 –a—— C:\WINDOWS\unins000.exe
2008-06-24 11:28 . 2008-06-24 11:28 2,555 –a—— C:\WINDOWS\unins000.dat
2008-06-24 10:52 . 2008-06-24 10:52 d——– C:\Documents and Settings\Rich\Application Data\rhcrsrj0e3rr
2008-06-23 22:20 . 2008-06-23 22:20 94,208 –a—— C:\WINDOWS\system32\16.tmp
2008-06-23 22:17 . 2008-06-26 10:32 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-06-23 22:17 . 2008-06-23 22:17 1,409 –a—— C:\WINDOWS\QTFont.for
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-31 20:37 . 2008-05-31 20:51 d——– C:\Program Files\Winamp
2008-05-31 20:37 . 2008-05-31 20:40 d——– C:\Documents and Settings\Rich\Application Data\Winamp
2008-05-30 22:23 . 2008-05-30 22:24 d——– C:\WINDOWS\system32\Adobe
2008-05-29 21:22 . 2008-05-29 21:22 d——– C:\Documents and Settings\Rich\Application Data\Moyea

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-27 03:44 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-06-27 01:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-26 14:37 ——— d—–w C:\Documents and Settings\Rich\Application Data\ComcastToolbar
2008-06-24 15:31 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-06-11 17:17 62,600 -c–a-w C:\Documents and Settings\Rich\Application Data\GDIPFONTCACHEV1.DAT
2008-06-03 03:38 ——— d—–w C:\Documents and Settings\Rich\Application Data\Azureus
2008-05-31 01:53 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 01:53 123,952 -c–a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 01:53 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-31 01:53 ——— d—–w C:\Program Files\Symantec
2008-05-25 00:50 47,360 —-a-w C:\Documents and Settings\Rich\Application Data\pcouffin.sys
2008-05-25 00:50 ——— d—–w C:\Program Files\DVDFab Platinum 4
2008-05-25 00:50 ——— d—–w C:\Documents and Settings\Rich\Application Data\Vso
2008-05-24 22:34 ——— d—–w C:\Program Files\Common Files\Adobe
2008-05-24 17:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-05-21 02:59 ——— d—–w C:\Program Files\Azureus
2008-05-19 16:29 ——— d—–w C:\Program Files\support.com
2008-05-19 15:27 ——— d—–w C:\Program Files\Common Files\SupportSoft
2008-05-09 14:26 ——— d—–w C:\Documents and Settings\Other\Application Data\vlc
2008-05-09 14:25 ——— d—–w C:\Documents and Settings\Other\Application Data\DivX
2008-05-09 14:18 ——— d—–w C:\Documents and Settings\Other\Application Data\COMCASTTOOLBAR
2008-05-09 14:17 ——— d—–w C:\Documents and Settings\Other\Application Data\Gtek
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-01 16:00 ——— d—–w C:\Program Files\Morpheus
2005-10-18 22:27 0 -c–a-w C:\Documents and Settings\Rich\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 22:26 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 19:16 454784]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 00:05 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 18:21 794624]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 02:11 49152]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 08:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 08:11 692316]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 19:04 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-12 00:07 98304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 16:24 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 16:54 253952]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 17:01 233534]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2005-04-27 18:23 788992]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"HostManager"="C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe" [2006-09-25 20:52 50736]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2007-03-07 10:58 1773568]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 03:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 14:49 36352]
"lphcvsrj0e3rr"="C:\WINDOWS\system32\lphcvsrj0e3rr.exe" [ ]
"SMrhcrsrj0e3rr"="C:\Program Files\rhcrsrj0e3rr\rhcrsrj0e3rr.exe" [ ]
"sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe" [ ]

C:\Documents and Settings\Rich\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-12-23 11:07:30 569405]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-10-26 04:09:52 811008]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2006-02-12 12:42]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-03-22 10:39]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 14:48:35 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Rich.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-27 23:51:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???????????????|?????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-06-27 23:58:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-27 03:58:22

Pre-Run: 3,022,516,224 bytes free
Post-Run: 2,950,979,584 bytes free

183 — E O F — 2008-06-20 03:37:45

This is the post-comboFix HiJack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:32:34 PM, on 6/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Post to Wordpress - {9add1977-efbb-473e-846a-eb3d13f662e2} - C:\Program Files\vodpod\wpbutton\wpbutton_ie.html (HKCU)
O9 - Extra 'Tools' menuitem: Post to Wordpress - {9add1977-efbb-473e-846a-eb3d13f662e2} - C:\Program Files\vodpod\wpbutton\wpbutton_ie.html (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 12655 bytes

Gary R

Post #5June 28, 2008, 7:18 AM UTC

OK, looking better, but still some work to do.

Click Start > Run type Notepad click OK.
This will open an empty Notepad file.
Copy/Paste the contents of the box below into Notepad.

Folder::
C:\Documents and Settings\Rich\Application Data\rhcrsrj0e3rr
C:\Program Files\rhcrsrj0e3rr

File::
C:\WINDOWS\system32\lphcvsrj0e3rr.exe
C:\Program Files\rhcrsrj0e3rr\rhcrsrj0e3rr.exe
C:\WINDOWS\system32\sysrest32.exe
C:\WINDOWS\system32\16.tmp
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lphcvsrj0e3rr"=-
"SMrhcrsrj0e3rr"=-
"sysrest32.exe"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=-

Click Format and ensure Wordwrap is unchecked.
Save as CFScript.txt to your Desktop.

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Combofix will now process that file.

When finished, it will produce a log for you. Post that log in your next reply please. (it can also be found at C:\Combofix.txt)

Next

Run a scan with HJT and when finished check the following items (if found).

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

Now close all open windows and click Fix Checked to remove them.

Next

Please download Malwarebytes' Anti-Malware to your Desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.

Click on the Malwarebytes' Anti-Malware icon to launch the programme.
- Click the Updates tab.
- Click Check for Updates and allow the programme to download the latest definitions.
Click the Scanner tab.
- Check Perform Full Scan.
- Click Scan and wait for the scan to complete.
- When the scan is complete, click OK, then Show Results.
- Ensure all items are checked then click Remove Selected.
- A box will pop-up telling you that files have been quarantined.
- A log will pop-up.
Post the log in your next reply please.

You can also access the log by doing the following

Click on the Logs tab.
Click on the log at the bottom of those listed to highlight it.
Click Open

Next

Run a new scan with HJT and post me the log please.

Summary of the logs I need from you in your next post:
Latest Combofix log
MBAM log
New HJT log

Please post each log separately to prevent them being cut off by the forum post size limiter.

Rich08

Post #6June 28, 2008, 6:47 PM UTC

Hi Gary,

Here is the new Combofix log.

ComboFix 08-06-20.4 - Rich 2008-06-28 14:30:12.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.167 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Rich\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\rhcrsrj0e3rr\rhcrsrj0e3rr.exe
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\system32\16.tmp
C:\WINDOWS\system32\lphcvsrj0e3rr.exe
C:\WINDOWS\system32\sysrest32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\16.tmp

.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-28 )))))))))))))))))))))))))))))))
.

2008-06-25 22:47 . 2008-06-25 22:47 d——– C:\Program Files\Trend Micro
2008-06-25 22:34 . 2008-06-25 22:34 d——– C:\Documents and Settings\Rich\Application Data\Uniblue
2008-06-25 21:21 . 2008-06-25 21:21 d——– C:\Program Files\Panda Security
2008-06-24 13:40 . 2008-06-24 13:40 96 –a—— C:\WINDOWS\wininit.ini
2008-06-24 11:28 . 2008-06-24 11:25 691,545 –a—— C:\WINDOWS\unins000.exe
2008-06-24 11:28 . 2008-06-24 11:28 2,555 –a—— C:\WINDOWS\unins000.dat
2008-06-24 10:52 . 2008-06-24 10:52 d——– C:\Documents and Settings\Rich\Application Data\rhcrsrj0e3rr
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-31 20:37 . 2008-05-31 20:51 d——– C:\Program Files\Winamp
2008-05-31 20:37 . 2008-05-31 20:40 d——– C:\Documents and Settings\Rich\Application Data\Winamp
2008-05-30 22:23 . 2008-05-30 22:24 d——– C:\WINDOWS\system32\Adobe
2008-05-29 21:22 . 2008-05-29 21:22 d——– C:\Documents and Settings\Rich\Application Data\Moyea

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-28 01:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-27 04:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-27 03:44 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-06-26 14:37 ——— d—–w C:\Documents and Settings\Rich\Application Data\ComcastToolbar
2008-06-24 15:31 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-06-11 17:17 62,600 -c–a-w C:\Documents and Settings\Rich\Application Data\GDIPFONTCACHEV1.DAT
2008-06-03 03:38 ——— d—–w C:\Documents and Settings\Rich\Application Data\Azureus
2008-05-31 01:53 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 01:53 60,800 -c–a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-31 01:53 123,952 -c–a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 01:53 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-31 01:53 ——— d—–w C:\Program Files\Symantec
2008-05-25 00:50 47,360 —-a-w C:\Documents and Settings\Rich\Application Data\pcouffin.sys
2008-05-25 00:50 ——— d—–w C:\Program Files\DVDFab Platinum 4
2008-05-25 00:50 ——— d—–w C:\Documents and Settings\Rich\Application Data\Vso
2008-05-24 22:34 ——— d—–w C:\Program Files\Common Files\Adobe
2008-05-24 17:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-05-21 02:59 ——— d—–w C:\Program Files\Azureus
2008-05-19 16:29 ——— d—–w C:\Program Files\support.com
2008-05-19 15:27 ——— d—–w C:\Program Files\Common Files\SupportSoft
2008-05-09 14:26 ——— d—–w C:\Documents and Settings\Other\Application Data\vlc
2008-05-09 14:25 ——— d—–w C:\Documents and Settings\Other\Application Data\DivX
2008-05-09 14:18 ——— d—–w C:\Documents and Settings\Other\Application Data\COMCASTTOOLBAR
2008-05-09 14:17 ——— d—–w C:\Documents and Settings\Other\Application Data\Gtek
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ——w C:\WINDOWS\system32\dllcache\quartz.dll
2008-05-01 16:00 ——— d—–w C:\Program Files\Morpheus
2008-04-24 02:16 3,591,680 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 —-a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2005-10-18 22:27 0 -c–a-w C:\Documents and Settings\Rich\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-26_23.58.00.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-27 03:48:08 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-28 18:06:18 2,048 –s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 22:26 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 19:16 454784]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 00:05 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 18:21 794624]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 02:11 49152]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 08:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 08:11 692316]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 19:04 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-12 00:07 98304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 16:24 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 16:54 253952]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 17:01 233534]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2005-04-27 18:23 788992]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"HostManager"="C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe" [2006-09-25 20:52 50736]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2007-03-07 10:58 1773568]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 03:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 14:49 36352]

C:\Documents and Settings\Rich\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-12-23 11:07:30 569405]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-10-26 04:09:52 811008]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2006-02-12 12:42]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-03-22 10:39]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 14:48:35 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Rich.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-28 14:32:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????6?3?9?3??????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-28 14:33:35
ComboFix-quarantined-files.txt 2008-06-28 18:33:17
ComboFix2.txt 2008-06-28 02:21:03
ComboFix3.txt 2008-06-27 03:58:38

Pre-Run: 2,820,009,984 bytes free
Post-Run: 2,809,421,824 bytes free

158 — E O F — 2008-06-20 03:37:45

Ran HJT and fixed the following:

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

MalwareByte log to follow…

Rich08

Post #7June 28, 2008, 8:55 PM UTC

MBAM log…

Malwarebytes' Anti-Malware 1.18
Database version: 898

3:36:22 PM 6/28/2008
mbam-log-6-28-2008 (15-36-22).txt

Scan type: Full Scan (C:\|)
Objects scanned: 111973
Time elapsed: 41 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\setup.player (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\setup.player.2k2 (Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b7e48b-9d81-4c6c-9578-5fd4f620d886} (Spyware.MarketScore) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Files Infected:
C:\QooBox\Quarantine\C\WINDOWS\system32\16.tmp.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\5.tmp.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP481\A0064304.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP481\A0064305.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Latest Hijack This log…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:45:46 PM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Post to Wordpress - {9add1977-efbb-473e-846a-eb3d13f662e2} - C:\Program Files\vodpod\wpbutton\wpbutton_ie.html (HKCU)
O9 - Extra 'Tools' menuitem: Post to Wordpress - {9add1977-efbb-473e-846a-eb3d13f662e2} - C:\Program Files\vodpod\wpbutton\wpbutton_ie.html (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 12590 bytes

It still seems to be taking longer than normal to boot up…but everything else has returned to normal…

Thanks again for all your help…

- Rich

Gary R

Post #8June 28, 2008, 9:34 PM UTC

OK, latest logs look good.

Seeing that your Boot time is not as you'd expect it to be I'd like to run a further scan to make sure we haven't missed anything.

First

Lets clean out your Temp files.

Click Start > Run and type cleanmgr then click OK.
This will bring up the Disk Cleanup window.
Check the following entries.
- Temporary Internet Files.
- Recycle Bin.
- Temporary Files.
Click OK.
When a prompt pops up click Yes.

Next

Please do an online scan with Kaspersky Online Scanner

Note: You must be using Internet Explorer as your browser as it will be necessary to install an Active X component to your computer.

Important If you have previously used Kaspersky Online Scanner (before 8th Aug 2006), you will have to uninstall the old version using Add/Remove Programs in Control Panel before you can use the new version.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings.
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  - Extended (If available otherwise Standard)
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK.
Now under select a target to scan select My Computer.
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Click the Save Report As… button (see red arrow below)

[external image: Posted Image]
In the Save as… prompt, select Desktop
In the File name box, name the file KAVScan
In the Save as type prompt, select Text file (see below)

[external image: Posted Image]
Copy and paste that information in your next post please.

Note: The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

Rich08

Post #9June 29, 2008, 1:46 AM UTC

Hi Gary,

According to Kaspersky, there were 5 viruses found and 10 infected objects. The problem is the log consists of hundreds and hundreds of entries that are "locked" files and not labeled as a virus by the scan. I have omitted the scanned files that were locked because it would exceed the limits of this post. I have posted the portion of the log containing the 10 objects that have the skull and crossbones next to them. If required I can post the rest of the log, or if you have instructions on unlocking the files I can try that.

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Saturday, June 28, 2008 9:23:38 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/06/2008
Kaspersky Anti-Virus database records: 896006
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 79684
Number of viruses found: 5
Number of infected objects: 10
Number of suspicious objects: 0
Duration of the scan process: 01:38:30

Infected Object Name / Virus Name / Last Action

C:\Program Files\Morpheus\morpheustoolbar.exe/stream/data0009 Infected: not-a-virus:AdWare.Win32.Mostofate.t skipped
C:\Program Files\Morpheus\morpheustoolbar.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.t skipped
C:\Program Files\Morpheus\morpheustoolbar.exe NSIS: infected - 2 skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\aspimgr.exe.vir Infected: Backdoor.Win32.Agent.ktm skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sysrest32.exe.vir Infected: Trojan.Win32.Pakes.czg skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\winivstr.exe.vir Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.c skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP479\A0064223.exe Infected: Trojan-Spy.Win32.Zbot.cqh skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP483\A0064317.exe Infected: Backdoor.Win32.Agent.ktm skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP483\A0064318.exe Infected:notavirus:FraudTool.Win32.XPSecurityCenter.c skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP483\A0064319.exe Infected: Trojan.Win32.Pakes.czg skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP485\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

Thanks,

Rich

Gary R

Post #10June 29, 2008, 6:22 AM UTC

OK, first of all your Kaspersky log is not quite as bad as it may seem.

Files are usually "locked" because they are being used by another "parent" process. It's normal to see quite a few in a Kaspersky log, it would have been better though if you'd sent the whole log.

If there are a very large number of them, it's probably because you had something running when you ran the scan. It's important that you shut down all active processes during the running of any AV scan, and you shouldn't use your computer at all whilst the scan is running also.

Now to the "infected" files.

Several of them are the encrypted backups that Combofix made when it removed things, they cannot re-infect you and we will remove them in due course. Also your System Restore files are infected. Your computer made a restore point when you were infected, and the infected files as well as your legit files were incorporated into it. You can't be re-infected from them unless you do a restore. We'll clear those out shortly as well.

Now down to the stuff we want to get rid of.

Click Start > Run type Notepad click OK.
This will open an empty Notepad file.
Copy/Paste the contents of the box below into Notepad.

Folder:
C:\Program Files\Morpheus

Click Format and ensure Wordwrap is unchecked.
Save as CFScript.txt to your Desktop.

Rich08

Post #11June 29, 2008, 3:01 PM UTC

Hi Gary,

Here is the most recent ComboFix log after running that script:

ComboFix 08-06-20.4 - Rich 2008-06-29 10:41:23.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.174 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Rich\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-29 )))))))))))))))))))))))))))))))
.

2008-06-28 18:44 . 2008-06-28 18:44 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-06-28 18:44 . 2008-06-28 18:44 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-28 14:49 . 2008-06-28 14:49 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-28 14:49 . 2008-06-28 14:49 d——– C:\Documents and Settings\Rich\Application Data\Malwarebytes
2008-06-28 14:49 . 2008-06-28 14:49 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-28 14:49 . 2008-06-19 17:48 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-28 14:49 . 2008-06-19 17:47 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-25 22:47 . 2008-06-25 22:47 d——– C:\Program Files\Trend Micro
2008-06-25 22:34 . 2008-06-25 22:34 d——– C:\Documents and Settings\Rich\Application Data\Uniblue
2008-06-25 21:21 . 2008-06-25 21:21 d——– C:\Program Files\Panda Security
2008-06-24 13:40 . 2008-06-24 13:40 96 –a—— C:\WINDOWS\wininit.ini
2008-06-24 11:28 . 2008-06-24 11:25 691,545 –a—— C:\WINDOWS\unins000.exe
2008-06-24 11:28 . 2008-06-24 11:28 2,555 –a—— C:\WINDOWS\unins000.dat
2008-06-24 10:52 . 2008-06-24 10:52 d——– C:\Documents and Settings\Rich\Application Data\rhcrsrj0e3rr
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-31 20:37 . 2008-05-31 20:51 d——– C:\Program Files\Winamp
2008-05-31 20:37 . 2008-05-31 20:40 d——– C:\Documents and Settings\Rich\Application Data\Winamp
2008-05-30 22:23 . 2008-05-30 22:24 d——– C:\WINDOWS\system32\Adobe
2008-05-29 21:22 . 2008-05-29 21:22 d——– C:\Documents and Settings\Rich\Application Data\Moyea

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-29 01:42 ——— d—–w C:\Documents and Settings\Rich\Application Data\ComcastToolbar
2008-06-28 22:18 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-06-28 01:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-27 04:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-24 15:31 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-06-11 17:17 62,600 -c–a-w C:\Documents and Settings\Rich\Application Data\GDIPFONTCACHEV1.DAT
2008-06-03 03:38 ——— d—–w C:\Documents and Settings\Rich\Application Data\Azureus
2008-05-31 01:53 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 01:53 60,800 -c–a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-31 01:53 123,952 -c–a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 01:53 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-31 01:53 ——— d—–w C:\Program Files\Symantec
2008-05-25 00:50 47,360 —-a-w C:\Documents and Settings\Rich\Application Data\pcouffin.sys
2008-05-25 00:50 ——— d—–w C:\Program Files\DVDFab Platinum 4
2008-05-25 00:50 ——— d—–w C:\Documents and Settings\Rich\Application Data\Vso
2008-05-24 22:34 ——— d—–w C:\Program Files\Common Files\Adobe
2008-05-24 17:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-05-21 02:59 ——— d—–w C:\Program Files\Azureus
2008-05-19 16:29 ——— d—–w C:\Program Files\support.com
2008-05-19 15:27 ——— d—–w C:\Program Files\Common Files\SupportSoft
2008-05-09 14:26 ——— d—–w C:\Documents and Settings\Other\Application Data\vlc
2008-05-09 14:25 ——— d—–w C:\Documents and Settings\Other\Application Data\DivX
2008-05-09 14:18 ——— d—–w C:\Documents and Settings\Other\Application Data\COMCASTTOOLBAR
2008-05-09 14:17 ——— d—–w C:\Documents and Settings\Other\Application Data\Gtek
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ——w C:\WINDOWS\system32\dllcache\quartz.dll
2008-05-01 16:00 ——— d—–w C:\Program Files\Morpheus
2008-04-24 02:16 3,591,680 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 —-a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2005-10-18 22:27 0 -c–a-w C:\Documents and Settings\Rich\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-26_23.58.00.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-27 03:48:08 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-29 14:24:46 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2005-05-24 16:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 19:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 22:26 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 19:16 454784]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 00:05 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 18:21 794624]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 02:11 49152]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 08:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 08:11 692316]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 19:04 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-12 00:07 98304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 16:24 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 16:54 253952]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 17:01 233534]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2005-04-27 18:23 788992]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"HostManager"="C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe" [2006-09-25 20:52 50736]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2007-03-07 10:58 1773568]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 03:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 14:49 36352]

C:\Documents and Settings\Rich\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-12-23 11:07:30 569405]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-10-26 04:09:52 811008]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2006-02-12 12:42]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-03-22 10:39]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 14:48:35 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Rich.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-29 10:44:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????6?3?9?3??????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-29 10:45:29
ComboFix-quarantined-files.txt 2008-06-29 14:45:07
ComboFix2.txt 2008-06-28 18:33:36
ComboFix3.txt 2008-06-28 02:21:03
ComboFix4.txt 2008-06-27 03:58:38

Pre-Run: 2,786,689,024 bytes free
Post-Run: 2,775,453,696 bytes free

158 — E O F — 2008-06-20 03:37:45

It doesn't appear that Morpheus is gone from my machine. It does have an uninstall feature. Should I use that to uninstall the program? I will try the CFScript.txt one more time to make sure I didn't mistype anything the first time. In the meantime I will re-run Kaspersky and post the log.

Also, the boot time seems back to normal today.

Thanks,

Rich

Rich08

Post #12June 29, 2008, 3:22 PM UTC

I re-ran ComboFix and this time I watched the screen carefully. It said, "The specified file cannot be found." The path is correct C:\Program Files\Morpheus, so I'm not sure why it's not removing it. In any event, I will re-run Kaspersky…

Rich08

Post #13June 29, 2008, 7:58 PM UTC last edited June 29, 2008, 8:01 PM UTC

Latest Kaspersky log attached…

Most of the locked / skipped items are from my wife's Windows login name. Her username wasn't logged in at the time of the scan, so I'm not sure why it's picking all that up. Nonetheless, here is the scan in its entirety.

Thanks!

Rich

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, June 29, 2008 3:48:24 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 29/06/2008
Kaspersky Anti-Virus database records: 897224
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 75463
Number of viruses found: 5
Number of infected objects: 10
Number of suspicious objects: 0
Duration of the scan process: 01:30:33

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\ph Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\variable Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0102\0310\values Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-06-29_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\337E9B97.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp(2)\BE56C1A1.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Rich\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped
C:\Documents and Settings\Rich\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped
C:\Documents and Settings\Rich\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped
C:\Documents and Settings\Rich\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped
C:\Documents and Settings\Rich\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\History\History.IE5\MSHist012008062920080630\index.dat Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Rich\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Rich\ntuser.dat Object is locked skipped
C:\Documents and Settings\Rich\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\AdobeCMapFnt07.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\AdobeSysFnt07.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\Collab\RSS Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\JavaScripts\glob.settings.js Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\KW.err Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\favorites.frm Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\favorites.MYD Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\favorites.MYI Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\files.frm Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\files.MYD Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\files.MYI Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\folders.frm Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\folders.MYD Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\organizer70\folders.MYI Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\Preferences\AcrobatColorSettings.csf Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\Preferences\WebCaptr.prefs Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\7.0\UserCache.bin Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt01.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt02.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt03.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt04.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt05.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt08.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFnt10.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\AdobeFntSys.lst Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\Cache\PSHFList1 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Adobe\Acrobat\Distiller 7\messages.log Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\AOL\ACS\1.0\Credentials.db Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\0.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\1.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\10.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\11.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\12.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\13.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\14.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\15.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\16.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\17.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\18.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\19.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\2.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\20.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\21.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\22.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\23.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\24.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\25.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\26.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\27.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\28.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\29.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\3.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\30.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\31.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\32.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\33.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\34.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\35.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\36.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\37.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\38.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\39.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\4.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\40.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\41.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\42.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\43.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\44.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\45.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\46.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\47.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\5.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\6.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\7.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\8.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\9.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\Add a city__weather.txt Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\autos.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\channels.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\COMBOSEARCH.acs Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\comcast.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\comcast0.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\comcast1.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\comcasttoolbartb0500.cfg Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\comcast_rhapsody.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\date_time.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\desktop_weather.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\doc.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\email.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\entertainment.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\fan.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\fan3.0.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn001.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn002.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn003.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn004.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn005.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn006.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn007.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn008.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn009.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn010.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn011.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\favbtn012.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\finance.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\findit.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\games.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\help.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\hilite_off.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\hilite_on.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\hostscore.cfg Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\kids.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\mcaffee_pf.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\mcaffee_ps.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\mcaffee_ss.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\mcaffee_su.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\movies.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\music.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\my_account.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\news.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\photoshow_deluxe.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\photo_center.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\pop_ups_allowed.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\pop_ups_blocked.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\pop_ups_occuring.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\radio_plus.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\ratingdetails-notverified-user.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\ratingdetails-notverified.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\ratingdetails-verified-user.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\ratingdetails-verified.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\ratingdetails-warning.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\ratingdetails-working.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\relationships.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\search.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\security.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\shopping.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\sign_in.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\sign_off.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\slider.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\sports.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\spyware.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\spyware2.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\spyware_scan.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\travel.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\tv.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\update.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\COMCASTTOOLBAR\videomail.bmp Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Google\Local Search History\google%2Eweb.w Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Macromedia\Flash Player\#SharedObjects\84H7AFMD\glaceau.com\energy_mn_v3.swf\TestMovie_Config_Info.sol Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#glaceau.com\settings.sol Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Address Book\Ms_ michelle.wab Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Address Book\Ms_ michelle.wab~ Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\CLR Security Config\v1.1.4322\security.config.cch Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Crypto\RSA\S-1-5-21-909751258-2510663935-746347170-1007\a077ead69703e3bf1fd373a3c9376faa_09ee3a64-ad8d-438f-9e28-43e5edf47098 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\brndlog.bak Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\Desktop.htt Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\MSO1033.acl Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\Birthday_party_registration_form.LNK Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\Buddy registration form.LNK Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\Desktop.LNK Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\index.dat Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\Kingston (E).LNK Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\PdM2B.tmp.LNK Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Recent\Temp.LNK Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Office\Word10.pip Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Protect\CREDHIST Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Protect\S-1-5-21-2738528725-3377773627-2742169642-1003\02bdd4e0-122c-4850-af15-3cab06d526e4 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Protect\S-1-5-21-2738528725-3377773627-2742169642-1003\Preferred Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Protect\S-1-5-21-909751258-2510663935-746347170-1007\0412ffab-ff99-474c-85db-95f9233ead0c Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Protect\S-1-5-21-909751258-2510663935-746347170-1007\de223a0b-e9e5-4bf8-91ba-a3afd1ebfbb8 Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Protect\S-1-5-21-909751258-2510663935-746347170-1007\Preferred Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Microsoft\Windows\Themes\Custom.theme Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\AudioRecent.m3u Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\ChatServers.ini Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\chc0.cfg Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\log000.txt Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\MorphBlocked.net Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\MorphCache.net Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\MorphConfig.ini Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\MorphProxy.net Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\settings0.cfg Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\SharedFiles.dat Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\VideoRecent.m3u Object is locked skipped
C:\Documents and Settings\Michelle\Application Data\Morpheus\WebCache.net Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@adknowledge[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@admarketplace[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@answers[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@aol[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@burstnet[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@eloqua[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@google[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@homestore[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@imdb[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@indiatimes[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@megaessays[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@nbc10[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@netscape[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@newsday[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@nextag[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@partner2profit[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@prudential[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@prunewjersey[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@realtor[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@sageanalyst[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@theknot[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@trb[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@tripadvisor[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\Michelle@www.nbc10[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\ms._michelle@atwola[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\ms._michelle@shutterfly[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\[removed][1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\ms[1].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\ms[2].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\ms[3].txt Object is locked skipped
C:\Documents and Settings\Michelle\Cookies\ms[4].txt Object is locked skipped
C:\Documents and Settings\Michelle\Desktop\Birthday_party_registration_form.rtf Object is locked skipped
C:\Documents and Settings\Michelle\Desktop\Buddy registration form.pdf Object is locked skipped
C:\Documents and Settings\Michelle\Desktop\Downloads.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Desktop\STOL0111.mp3 Object is locked skipped
C:\Documents and Settings\Michelle\Desktop\Windows Media Player.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Accessories.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Create & Print.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Home.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\HP Music.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Links\Customize Links.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Links\Free Hotmail.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Links\Windows Marketplace.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Links\Windows Media.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Links\Windows.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Microsoft Websites\IE Add-on site.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Microsoft Websites\IE site on Microsoft.com.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Microsoft Websites\Marketplace.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Microsoft Websites\Microsoft At Home.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Microsoft Websites\Microsoft At Work.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Microsoft Websites\Welcome to IE7.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\MSN.com.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Radio Station Guide.url Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Search.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Shop.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Spyware Protection.URL Object is locked skipped
C:\Documents and Settings\Michelle\Favorites\Symantec Security.URL Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache\AcroFnt07.lst Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Adobe\Color\ACECache4.lst Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Adobe\TypeSpt\AdobeFnt09.lst Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\1153771506\ms.michelle\metrics\cmls_cs.tlv Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\1153771506\ms.michelle\metrics\cmls_ms.tlv Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\1153771506\ms.michelle\profile.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\clsFolder.000\cls00001 Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\clsFolder.000\cls00002 Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\clsFolder.000\cls00003 Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\AOL\UserProfiles\All Users\profile.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\ApplicationHistory\SL10D.tmp.f4790ff6.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\ApplicationHistory\SL1E.tmp.879d8d75.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\GDIPFONTCACHEV1.DAT Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\IconCache.db Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\LightScribe\log\log6080.txt Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\4HIQLUXY\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\4HIQLUXY\fwlink[1] Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\CHSNLXLR\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\CHSNLXLR\fwlink[1] Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\FVUVAHZ6\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Feeds Cache\K3UX46G6\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Internet Explorer\brndlog.txt Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_219.wmdb Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Media Player\wmdbexport.xml Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNS.DTD Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNS.XML Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\Microsoft\Works\Portfolio\wsbsamp.wsb Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}\1033.MST Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}\J2SE Runtime Environment 5.0 Update 2.msi Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\History\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\History\History.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\History\History.IE5\MSHist012007071020070711\index.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temp\Adobelm_Cleanup.0001 Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temp\jupdate1.5.0.xml Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temp\jusched.log Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temp\LSBurnWatcher.log Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temp\osCheck Vista Migration 2008-06-29 11h38m24s.log Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\3Z6DS1CC\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\3Z6DS1CC\upload_plugin[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\C10OXM1B\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\F1MNJLGN\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\F1MNJLGN\upload_plugin[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\F37BVQPL\01[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\F37BVQPL\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\KDM7G1QB\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\KDM7G1QB\upload_plugin[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\KDM7G1QB\upload_plugin[2].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\KMVYNLJR\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\WHQZW1A3\01[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\WHQZW1A3\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\WHQZW1A3\upload_plugin[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\YH3HX82O\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\Content.IE5\YH3HX82O\upload_plugin[1].htm Object is locked skipped
C:\Documents and Settings\Michelle\Local Settings\Temporary Internet Files\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\Morpheus Shared\Downloads\Partials\(eBook.Business.Marketing) Marketing Strategy Results Vol 1 by Jay Abraham.pdf.info Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\Morpheus Shared\Downloads\Partials\Ask Great Questions.mp3.info Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Music\Desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Music\Sample Music.lnk Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Music\Samples.lnk Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Pictures\Desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Pictures\Sample Pictures.lnk Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Pictures\Samples.lnk Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Videos\Desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\My Documents\My Videos\Samples.lnk Object is locked skipped
C:\Documents and Settings\Michelle\ntuser.dat Object is locked skipped
C:\Documents and Settings\Michelle\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Michelle\ntuser.ini Object is locked skipped
C:\Documents and Settings\Michelle\Recent\0111.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Recent\Birthday_party_registration_form.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Recent\Buddy registration form (2).lnk Object is locked skipped
C:\Documents and Settings\Michelle\Recent\Buddy registration form.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Recent\Desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Recent\Kingston (E).lnk Object is locked skipped
C:\Documents and Settings\Michelle\Recent\STOL0111.lnk Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\Bluetooth\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\Bluetooth\Other….lnk Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\Compressed (zipped) Folder.ZFSendToTarget Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\Desktop (create shortcut).DeskLink Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\Mail Recipient.MAPIMail Object is locked skipped
C:\Documents and Settings\Michelle\SendTo\My Documents.mydocs Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Accessibility\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Address Book.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Command Prompt.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Entertainment\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Notepad.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Synchronize.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Tour Windows XP.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Accessories\Windows Explorer.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Internet Explorer.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Online Services\Easy Internet Sign-up.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Outlook Express.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Remote Assistance.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Software Setup.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Startup\desktop.ini Object is locked skipped
C:\Documents and Settings\Michelle\Start Menu\Programs\Windows Media Player.lnk Object is locked skipped
C:\Documents and Settings\Michelle\Templates\amipro.sam Object is locked skipped
C:\Documents and Settings\Michelle\Templates\excel.xls Object is locked skipped
C:\Documents and Settings\Michelle\Templates\excel4.xls Object is locked skipped
C:\Documents and Settings\Michelle\Templates\lotus.wk4 Object is locked skipped
C:\Documents and Settings\Michelle\Templates\powerpnt.ppt Object is locked skipped
C:\Documents and Settings\Michelle\Templates\presenta.shw Object is locked skipped
C:\Documents and Settings\Michelle\Templates\quattro.wb2 Object is locked skipped
C:\Documents and Settings\Michelle\Templates\sndrec.wav Object is locked skipped
C:\Documents and Settings\Michelle\Templates\winword.doc Object is locked skipped
C:\Documents and Settings\Michelle\Templates\winword2.doc Object is locked skipped
C:\Documents and Settings\Michelle\Templates\wordpfct.wpd Object is locked skipped
C:\Documents and Settings\Michelle\Templates\wordpfct.wpg Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Morpheus\morpheustoolbar.exe/stream/data0009 Infected: not-a-virus:AdWare.Win32.Mostofate.t skipped
C:\Program Files\Morpheus\morpheustoolbar.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.t skipped
C:\Program Files\Morpheus\morpheustoolbar.exe NSIS: infected - 2 skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\aspimgr.exe.vir Infected: Backdoor.Win32.Agent.ktm skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\sysrest32.exe.vir Infected: Trojan.Win32.Pakes.czg skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\winivstr.exe.vir Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.c skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP479\A0064223.exe Infected: Trojan-Spy.Win32.Zbot.cqh skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP483\A0064317.exe Infected: Backdoor.Win32.Agent.ktm skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP483\A0064318.exe Infected: not-a-virus:FraudTool.Win32.XPSecurityCenter.c skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP483\A0064319.exe Infected: Trojan.Win32.Pakes.czg skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP487\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{9B0C2B1A-7981-4781-A4A7-514E0E3B0EAB}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Gary R

Post #14June 30, 2008, 6:17 AM UTC last edited June 30, 2008, 6:19 AM UTC

OK, still just the Morpheus Toolbar to get rid of.

If you can try Uninstalling it with Control Panel > Add/Remove Programs

Sorry, the reason Combofix didn't remove it is because I gave it the wrong instruction (Folder: instead of Folder::) the missing : is all important.

If Morpheus Toolbar refuses to uninstall, do the following (you'll notice I've added the extra : this time ).

Click Start > Run type Notepad click OK.
This will open an empty Notepad file.
Copy/Paste the contents of the box below into Notepad.

Folder::
C:\Program Files\Morpheus

Click Format and ensure Wordwrap is unchecked.
Save as CFScript.txt to your Desktop.

Rich08

Post #15July 1, 2008, 1:29 AM UTC

Hi Gary,

I couldn't get Morpheus to unistall, so I ran the new ComboFix script. It looks like it operated correctly. Morpheus still appears on my program menu, but when I click on it, it says, "Windows cannot open the file Morpheus.exe.vir" So I'm assuming it's been quarantined so it can't do anymore damage.

Here is the log:

ComboFix 08-06-20.4 - Rich 2008-06-30 21:01:27.6 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Rich\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Morpheus
C:\Program Files\Morpheus\_socket.pyd
C:\Program Files\Morpheus\_sre.pyd
C:\Program Files\Morpheus\Ace.ico
C:\Program Files\Morpheus\AceJack.ico
C:\Program Files\Morpheus\Audio.ico
C:\Program Files\Morpheus\bitTorrent_LICENSE.txt
C:\Program Files\Morpheus\chc0.cfg
C:\Program Files\Morpheus\Folder_Morpheus.ico
C:\Program Files\Morpheus\M5Shell.dll
C:\Program Files\Morpheus\MorphCache.net
C:\Program Files\Morpheus\MorphConfig.ini
C:\Program Files\Morpheus\MorphConfigEx.ini
C:\Program Files\Morpheus\Morpheus.exe
C:\Program Files\Morpheus\morpheustoolbar.exe
C:\Program Files\Morpheus\MorphHelper.dll
C:\Program Files\Morpheus\MorphUltraCache.net
C:\Program Files\Morpheus\NeoWebCache.net
C:\Program Files\Morpheus\once.tmp
C:\Program Files\Morpheus\podcast_icon.ico
C:\Program Files\Morpheus\Proto.dll
C:\Program Files\Morpheus\python_LICENSE.txt
C:\Program Files\Morpheus\python23.dll
C:\Program Files\Morpheus\python23.zip
C:\Program Files\Morpheus\Schemas\application.xml
C:\Program Files\Morpheus\Schemas\application.xsd
C:\Program Files\Morpheus\Schemas\audio.xml
C:\Program Files\Morpheus\Schemas\audio.xsd
C:\Program Files\Morpheus\Schemas\document.xml
C:\Program Files\Morpheus\Schemas\document.xsd
C:\Program Files\Morpheus\Schemas\image.xml
C:\Program Files\Morpheus\Schemas\image.xsd
C:\Program Files\Morpheus\Schemas\morph.xml
C:\Program Files\Morpheus\Schemas\morph.xsd
C:\Program Files\Morpheus\Schemas\podcast.xml
C:\Program Files\Morpheus\Schemas\podcast.xsd
C:\Program Files\Morpheus\Schemas\rom.xml
C:\Program Files\Morpheus\Schemas\rom.xsd
C:\Program Files\Morpheus\Schemas\video.xml
C:\Program Files\Morpheus\Schemas\video.xsd
C:\Program Files\Morpheus\select.pyd
C:\Program Files\Morpheus\SkinData\default\About.htm
C:\Program Files\Morpheus\SkinData\default\all_16X.ico
C:\Program Files\Morpheus\SkinData\default\amazon.bmp
C:\Program Files\Morpheus\SkinData\default\application_16X.ico
C:\Program Files\Morpheus\SkinData\default\Audio.ico
C:\Program Files\Morpheus\SkinData\default\audio_16X.ico
C:\Program Files\Morpheus\SkinData\default\Background.BMP
C:\Program Files\Morpheus\SkinData\default\bitzi-pattern.gif
C:\Program Files\Morpheus\SkinData\default\bitzi-tear.gif
C:\Program Files\Morpheus\SkinData\default\bitzi_perforation.gif
C:\Program Files\Morpheus\SkinData\default\bluebar.gif
C:\Program Files\Morpheus\SkinData\default\browser-divider.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-back.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-blank-32x17.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-blank-33x17.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-forward.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-home.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-refresh.bmp
C:\Program Files\Morpheus\SkinData\default\browser-dpr-stop.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-back.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-blank-32x17.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-blank-33x17.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-forward.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-home.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-refresh.bmp
C:\Program Files\Morpheus\SkinData\default\browser-na-stop.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-back.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-blank-32x17.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-blank-33x17.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-forward.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-home.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-refresh.bmp
C:\Program Files\Morpheus\SkinData\default\browser-normal-stop.bmp
C:\Program Files\Morpheus\SkinData\default\browser-over-back.bmp
C:\Program Files\Morpheus\SkinData\default\browser-over-forward.bmp
C:\Program Files\Morpheus\SkinData\default\browser-over-home.bmp
C:\Program Files\Morpheus\SkinData\default\browser-over-refresh.bmp
C:\Program Files\Morpheus\SkinData\default\browser-over-stop.bmp
C:\Program Files\Morpheus\SkinData\default\Button-Dark.bmp
C:\Program Files\Morpheus\SkinData\default\Button.bmp
C:\Program Files\Morpheus\SkinData\default\ButtonDown-dark.bmp
C:\Program Files\Morpheus\SkinData\default\ButtonDown.bmp
C:\Program Files\Morpheus\SkinData\default\ButtonDownMask.bmp
C:\Program Files\Morpheus\SkinData\default\ButtonMask.bmp
C:\Program Files\Morpheus\SkinData\default\chat.css
C:\Program Files\Morpheus\SkinData\default\chatcombo.bmp
C:\Program Files\Morpheus\SkinData\default\chatcombomask.bmp
C:\Program Files\Morpheus\SkinData\default\ChatHeader.bmp
C:\Program Files\Morpheus\SkinData\default\ChatSplitter.bmp
C:\Program Files\Morpheus\SkinData\default\checkbox_blank.bmp
C:\Program Files\Morpheus\SkinData\default\checkbox_blank_disabled.bmp
C:\Program Files\Morpheus\SkinData\default\checkbox_checked.bmp
C:\Program Files\Morpheus\SkinData\default\checkbox_checked_disabled.bmp
C:\Program Files\Morpheus\SkinData\default\Connecting.bmp
C:\Program Files\Morpheus\SkinData\default\Connecting_selected.bmp
C:\Program Files\Morpheus\SkinData\default\CurrentMediaStatic.bmp
C:\Program Files\Morpheus\SkinData\default\doc-morpheus.ico
C:\Program Files\Morpheus\SkinData\default\document_16X.ico
C:\Program Files\Morpheus\SkinData\default\Downloads.bmp
C:\Program Files\Morpheus\SkinData\default\DownloadsPressed.bmp
C:\Program Files\Morpheus\SkinData\default\DragDropFiles.bmp
C:\Program Files\Morpheus\SkinData\default\eBay.bmp
C:\Program Files\Morpheus\SkinData\default\file.gif
C:\Program Files\Morpheus\SkinData\default\file_info_bg.gif
C:\Program Files\Morpheus\SkinData\default\fileavailability.html
C:\Program Files\Morpheus\SkinData\default\fileavailabilitytorrent.html
C:\Program Files\Morpheus\SkinData\default\filebitzi.html
C:\Program Files\Morpheus\SkinData\default\FileBitziWaiting.html
C:\Program Files\Morpheus\SkinData\default\filedetails.html
C:\Program Files\Morpheus\SkinData\default\filedetails.jpg
C:\Program Files\Morpheus\SkinData\default\filetipdetail.html
C:\Program Files\Morpheus\SkinData\default\flyoutnull.html
C:\Program Files\Morpheus\SkinData\default\Header.bmp
C:\Program Files\Morpheus\SkinData\default\header_chat.bmp
C:\Program Files\Morpheus\SkinData\default\header_chat_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_close.bmp
C:\Program Files\Morpheus\SkinData\default\header_close_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_help.bmp
C:\Program Files\Morpheus\SkinData\default\header_help_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_maximize.bmp
C:\Program Files\Morpheus\SkinData\default\header_maximize_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_minimize.bmp
C:\Program Files\Morpheus\SkinData\default\header_minimize_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_morpheusultra.bmp
C:\Program Files\Morpheus\SkinData\default\header_morpheusultra_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_preferences.bmp
C:\Program Files\Morpheus\SkinData\default\header_preferences_dp.bmp
C:\Program Files\Morpheus\SkinData\default\header_restore.bmp
C:\Program Files\Morpheus\SkinData\default\header_restore_dp.bmp
C:\Program Files\Morpheus\SkinData\default\HeaderBlock.bmp
C:\Program Files\Morpheus\SkinData\default\HeaderBlock.gif
C:\Program Files\Morpheus\SkinData\default\HeaderDowned.bmp
C:\Program Files\Morpheus\SkinData\default\HScrollBar.bmp
C:\Program Files\Morpheus\SkinData\default\HSplitter.bmp
C:\Program Files\Morpheus\SkinData\default\HThumb.bmp
C:\Program Files\Morpheus\SkinData\default\image-morpheus.ico
C:\Program Files\Morpheus\SkinData\default\image_16X.ico
C:\Program Files\Morpheus\SkinData\default\images\arrow.gif
C:\Program Files\Morpheus\SkinData\default\images\getmorpheusultra.gif
C:\Program Files\Morpheus\SkinData\default\images\monochrome_morpheus.gif
C:\Program Files\Morpheus\SkinData\default\images\monochrome_morpheus.jpg
C:\Program Files\Morpheus\SkinData\default\images\monochrome_morpheus_ultra.gif
C:\Program Files\Morpheus\SkinData\default\images\monochrome_morpheus_ultra.jpg
C:\Program Files\Morpheus\SkinData\default\images\welcome.gif
C:\Program Files\Morpheus\SkinData\default\Left.bmp
C:\Program Files\Morpheus\SkinData\default\LeftDown.bmp
C:\Program Files\Morpheus\SkinData\default\lightblue.gif
C:\Program Files\Morpheus\SkinData\default\ListSel.bmp
C:\Program Files\Morpheus\SkinData\default\logoUltra.html
C:\Program Files\Morpheus\SkinData\default\MainFrame.bmp
C:\Program Files\Morpheus\SkinData\default\MainFrameMask.bmp
C:\Program Files\Morpheus\SkinData\default\MenuHighlight.bmp
C:\Program Files\Morpheus\SkinData\default\MenuNormal.bmp
C:\Program Files\Morpheus\SkinData\default\Mini.bmp
C:\Program Files\Morpheus\SkinData\default\MiniDown.bmp
C:\Program Files\Morpheus\SkinData\default\mobile\images\bouncing_arrow.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_application.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_audio.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_document.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_image.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_podcast.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_premium content.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_rom.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\icon_video.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\logo_p2p.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\morpheus_logo.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\searchtype_local.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\searchtype_p2p.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\searchtype_shopping.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\searchtype_web.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\spacer.gif
C:\Program Files\Morpheus\SkinData\default\mobile\images\Style_xhtml.css
C:\Program Files\Morpheus\SkinData\default\mobile\public\access_restrict.html
C:\Program Files\Morpheus\SkinData\default\mobile\public\file_not_found.html
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\bg.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\bg5.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\bitzi-pattern.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\bluebar.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\gnut_17.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\greenbar.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\HeaderBlock.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\lightblue.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\logo32x32.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\logo32x32.jpg
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_01.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_01.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_03-b.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_03-b.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_04.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_04.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_08.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_08.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_09.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_09.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_11-a3.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_11-a3.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_11-c3.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_11-c3.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_11_b2.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\mid_content_11_b2.png
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\morph_sm.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\neo_17.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\pspbrwse.jbf
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\Search_Power.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\Search_Power.jpg
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\Style_xhtml.css
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\tinym.gif
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\tinym.jpg
C:\Program Files\Morpheus\SkinData\default\mobile\xhtml\images\tinym.png
C:\Program Files\Morpheus\SkinData\default\MorphDlg.bmp
C:\Program Files\Morpheus\SkinData\default\MorphDlgMask.bmp
C:\Program Files\Morpheus\SkinData\default\player_mute.bmp
C:\Program Files\Morpheus\SkinData\default\player_mute_dp.bmp
C:\Program Files\Morpheus\SkinData\default\player_next.bmp
C:\Program Files\Morpheus\SkinData\default\player_next_dp.bmp
C:\Program Files\Morpheus\SkinData\default\player_next_mask.bmp
C:\Program Files\Morpheus\SkinData\default\player_pause.bmp
C:\Program Files\Morpheus\SkinData\default\player_pause_dp.bmp
C:\Program Files\Morpheus\SkinData\default\player_play.bmp
C:\Program Files\Morpheus\SkinData\default\player_play_dp.bmp
C:\Program Files\Morpheus\SkinData\default\player_prev.bmp
C:\Program Files\Morpheus\SkinData\default\player_prev_dp.bmp
C:\Program Files\Morpheus\SkinData\default\player_prev_mask.bmp
C:\Program Files\Morpheus\SkinData\default\player_sound.bmp
C:\Program Files\Morpheus\SkinData\default\player_sound_dp.bmp
C:\Program Files\Morpheus\SkinData\default\player_stop.bmp
C:\Program Files\Morpheus\SkinData\default\player_stop_dp.bmp
C:\Program Files\Morpheus\SkinData\default\PlayerDisplay.bmp
C:\Program Files\Morpheus\SkinData\default\playlist_add.bmp
C:\Program Files\Morpheus\SkinData\default\playlist_add_dp.bmp
C:\Program Files\Morpheus\SkinData\default\playlist_repeat.BMP
C:\Program Files\Morpheus\SkinData\default\playlist_repeat_dp.BMP
C:\Program Files\Morpheus\SkinData\default\playlist_shuffle.BMP
C:\Program Files\Morpheus\SkinData\default\playlist_shuffle_dp.BMP
C:\Program Files\Morpheus\SkinData\default\playlist_subtract.BMP
C:\Program Files\Morpheus\SkinData\default\playlist_subtract_dp.BMP
C:\Program Files\Morpheus\SkinData\default\PlayListComboBox.bmp
C:\Program Files\Morpheus\SkinData\default\PlayListItem.bmp
C:\Program Files\Morpheus\SkinData\default\PlayListSelectedItem.bmp
C:\Program Files\Morpheus\SkinData\default\PlayListTop.bmp
C:\Program Files\Morpheus\SkinData\default\PlayListViewBk.bmp
C:\Program Files\Morpheus\SkinData\default\podcast_icon.ico
C:\Program Files\Morpheus\SkinData\default\PriceDownArrow.bmp
C:\Program Files\Morpheus\SkinData\default\PriceMask.bmp
C:\Program Files\Morpheus\SkinData\default\PriceRightArrow.bmp
C:\Program Files\Morpheus\SkinData\default\ProgressBackground.bmp
C:\Program Files\Morpheus\SkinData\default\ProgressComplete.bmp
C:\Program Files\Morpheus\SkinData\default\ProgressScale.bmp
C:\Program Files\Morpheus\SkinData\default\radio_blank.bmp
C:\Program Files\Morpheus\SkinData\default\radio_blank_disabled.bmp
C:\Program Files\Morpheus\SkinData\default\radio_checked.bmp
C:\Program Files\Morpheus\SkinData\default\radio_checked_disabled.bmp
C:\Program Files\Morpheus\SkinData\default\RectangleButton.bmp
C:\Program Files\Morpheus\SkinData\default\Research.bmp
C:\Program Files\Morpheus\SkinData\default\rom-morpheus.ico
C:\Program Files\Morpheus\SkinData\default\rom_16X.ico
C:\Program Files\Morpheus\SkinData\default\SchemeMenu.bmp
C:\Program Files\Morpheus\SkinData\default\SchemeMenuHL.bmp
C:\Program Files\Morpheus\SkinData\default\search_extendsearch.bmp
C:\Program Files\Morpheus\SkinData\default\search_extendsearch_dp.bmp
C:\Program Files\Morpheus\SkinData\default\search_filetype.bmp
C:\Program Files\Morpheus\SkinData\default\search_filetype_dp.bmp
C:\Program Files\Morpheus\SkinData\default\search_searchbutton.bmp
C:\Program Files\Morpheus\SkinData\default\search_searchbutton_dp.bmp
C:\Program Files\Morpheus\SkinData\default\search2start.html
C:\Program Files\Morpheus\SkinData\default\SearchClose.bmp
C:\Program Files\Morpheus\SkinData\default\SearchClosePressed.bmp
C:\Program Files\Morpheus\SkinData\default\SearchConnecting.bmp
C:\Program Files\Morpheus\SkinData\default\SearchDetailToolTip.html
C:\Program Files\Morpheus\SkinData\default\SearchesListBottom.bmp
C:\Program Files\Morpheus\SkinData\default\SearchesListMiddle.bmp
C:\Program Files\Morpheus\SkinData\default\SearchesListSelected.bmp
C:\Program Files\Morpheus\SkinData\default\SearchesListSingle.bmp
C:\Program Files\Morpheus\SkinData\default\SearchesListTop.bmp
C:\Program Files\Morpheus\SkinData\default\SearchesSplitter.bmp
C:\Program Files\Morpheus\SkinData\default\Skin.xml
C:\Program Files\Morpheus\SkinData\default\skincombo.bmp
C:\Program Files\Morpheus\SkinData\default\skincombomask.bmp
C:\Program Files\Morpheus\SkinData\default\Slider.bmp
C:\Program Files\Morpheus\SkinData\default\SmallClose.bmp
C:\Program Files\Morpheus\SkinData\default\SmallClosePressed.bmp
C:\Program Files\Morpheus\SkinData\default\spacer.gif
C:\Program Files\Morpheus\SkinData\default\SplitterButtonDown.bmp
C:\Program Files\Morpheus\SkinData\default\SplitterButtonDownPressed.bmp
C:\Program Files\Morpheus\SkinData\default\SplitterButtonUp.bmp
C:\Program Files\Morpheus\SkinData\default\SplitterButtonUpPressed.bmp
C:\Program Files\Morpheus\SkinData\default\standard.css
C:\Program Files\Morpheus\SkinData\default\StatusBar.bmp
C:\Program Files\Morpheus\SkinData\default\stopwatch.gif
C:\Program Files\Morpheus\SkinData\default\TabActive.bmp
C:\Program Files\Morpheus\SkinData\default\TabActiveMask.bmp
C:\Program Files\Morpheus\SkinData\default\TabInactive.bmp
C:\Program Files\Morpheus\SkinData\default\TabInactiveMask.bmp
C:\Program Files\Morpheus\SkinData\default\TabLedge.bmp
C:\Program Files\Morpheus\SkinData\default\TabLedgeInactive.bmp
C:\Program Files\Morpheus\SkinData\default\TabLedgeMask.bmp
C:\Program Files\Morpheus\SkinData\default\Tile.bmp
C:\Program Files\Morpheus\SkinData\default\tooltip.css
C:\Program Files\Morpheus\SkinData\default\tooltip.jpg
C:\Program Files\Morpheus\SkinData\default\tooltipApp.jpg
C:\Program Files\Morpheus\SkinData\default\tooltipAud.jpg
C:\Program Files\Morpheus\SkinData\default\tooltipDoc.jpg
C:\Program Files\Morpheus\SkinData\default\tooltipImg.jpg
C:\Program Files\Morpheus\SkinData\default\tooltipRom.jpg
C:\Program Files\Morpheus\SkinData\default\tooltipVid.jpg
C:\Program Files\Morpheus\SkinData\default\Tray.bmp
C:\Program Files\Morpheus\SkinData\default\TrayBottomPanel.bmp
C:\Program Files\Morpheus\SkinData\default\ui.xml
C:\Program Files\Morpheus\SkinData\default\Video.ico
C:\Program Files\Morpheus\SkinData\default\video_16X.ico
C:\Program Files\Morpheus\SkinData\default\video_fullscreen.bmp
C:\Program Files\Morpheus\SkinData\default\video_fullscreen_dp.bmp
C:\Program Files\Morpheus\SkinData\default\video_undock_dp.bmp
C:\Program Files\Morpheus\SkinData\default\VideoDisplayButtonsArea.bmp
C:\Program Files\Morpheus\SkinData\default\VScrollBar.bmp
C:\Program Files\Morpheus\SkinData\default\VSplitter.bmp
C:\Program Files\Morpheus\SkinData\default\VTabActive.bmp
C:\Program Files\Morpheus\SkinData\default\VTabInactive.bmp
C:\Program Files\Morpheus\SkinData\default\VTabMask.bmp
C:\Program Files\Morpheus\SkinData\default\VThumb.bmp
C:\Program Files\Morpheus\SkinData\default\welcome.html
C:\Program Files\Morpheus\SkinData\default\welcomenull.html
C:\Program Files\Morpheus\SkinData\default\WideStatic.bmp
C:\Program Files\Morpheus\SkinData\default\xml\canvas_configlistbottomitem.xml
C:\Program Files\Morpheus\SkinData\default\xml\canvas_configlistmiddleitem.xml
C:\Program Files\Morpheus\SkinData\default\xml\canvas_configlistselecteditem.xml
C:\Program Files\Morpheus\SkinData\default\xml\canvas_configlisttopitem.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_aboutdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_askdlg_onsearchresultdelete.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_askdlg_ontransfercancel.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_askdlg_saveplaylists.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_askonexitdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_chat.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_childdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_configdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_connectingsearchdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_custombrowser.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_fileavailability.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_fileinformation.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_filterempty.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_getpasswddlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_install_sharedfolder.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_itunes_prompt.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_magnetcheckdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_magnethandledlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_mainframe.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_mainframebackground.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_morphdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_myfilespane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_myrsspane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_notconnectedsearchdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_playlistpane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_podcastcheckdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefantivirus.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefblock.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefchat.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_preffiletransfer.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_preffolders.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefgeneral.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefinternetconnection.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefmediaweb.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefmobile.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefp2pnetwork.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefparentalcontrol.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefproxy.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefrss.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_prefskinsetup.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_refreshsharelistdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_searchespane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_searchresultpane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_setdefaultfilter.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_setpasswddlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_skinchange.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_skinmessagebox.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_toolbardlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_torrentcheckdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_transferspane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_traybottompanel.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_traywindow.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_videopane.xml
C:\Program Files\Morpheus\SkinData\default\xml\screen_xpfirewallcheckdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\Skin.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_background.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_chatheader.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_configlistview.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_currentmediastatic.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_downloadsbutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_header.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_hscrollbar.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_hthumb.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_mainframe.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_menu.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_morphdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_morpheusstdbutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_morpheusstdbuttondown.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_playerdisplay.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_playlistcombobox.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_playlisttop.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_playlistviewbackground.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_playlistviewitem.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_price.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_progressbarbackground.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_progressbarscale.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_rectanglebutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_searcheslistschema.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_searchessplitter.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_slider.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_statusbar.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_stretch.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_tabactive.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_tabinactive.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_tabledge.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_tile.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_tray.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_traybottompanel.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_vscrollbar.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_vsplitter.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_vtab.xml
C:\Program Files\Morpheus\SkinData\default\xml\skinlayout_vthumb.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_button_checkbox.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_button_darkbutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_button_radiobutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_button_rectanglebutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_button_usualbutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_checkbox_checkbox.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_checkbox_radiobutton.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_editcontrol_editbox.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_editcontrol_multilineeditbox.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_groupbox_roundrect.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_header_defaultheader.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_chatmenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_chatprefmenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_headermenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_helpmenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_playlistmenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_popupmenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_schememenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_searchescontextmenu.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_menu_tray.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_overlappedwindow_childdialog.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_overlappedwindow_morphdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_playlistview_default.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_progressbar_default.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_screen_morphdlg.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_scrollbar_defaultscrollbar.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_slider_default.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_splitter_horzsplitter4myfilespane.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_splitter_horzsplitter4searchresultpane.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_splitter_horzsplitter4transferspane.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_tabs_default.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_tabs_fileinformation.xml
C:\Program Files\Morpheus\SkinData\default\xml\style_vtabs_default.xml
C:\Program Files\Morpheus\SkinData\happy\About.htm
C:\Program Files\Morpheus\SkinData\happy\amazon.bmp
C:\Program Files\Morpheus\SkinData\happy\Background.BMP
C:\Program Files\Morpheus\SkinData\happy\bitzi-pattern.gif
C:\Program Files\Morpheus\SkinData\happy\bitzi-tear.gif
C:\Program Files\Morpheus\SkinData\happy\bitzi_perforation.gif
C:\Program Files\Morpheus\SkinData\happy\bluebar.gif
C:\Program Files\Morpheus\SkinData\happy\browser-divider.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-back.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-blank-32x17.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-blank-33x17.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-forward.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-home.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-refresh.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-dpr-stop.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-back.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-blank-32x17.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-blank-33x17.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-forward.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-home.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-refresh.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-na-stop.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-back.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-blank-32x17.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-blank-33x17.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-forward.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-home.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-refresh.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-normal-stop.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-over-back.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-over-forward.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-over-home.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-over-refresh.bmp
C:\Program Files\Morpheus\SkinData\happy\browser-over-stop.bmp
C:\Program Files\Morpheus\SkinData\happy\Button-Dark.bmp
C:\Program Files\Morpheus\SkinData\happy\Button.bmp
C:\Program Files\Morpheus\SkinData\happy\ButtonDown-dark.bmp
C:\Program Files\Morpheus\SkinData\happy\ButtonDown.bmp
C:\Program Files\Morpheus\SkinData\happy\ButtonDownMask.bmp
C:\Program Files\Morpheus\SkinData\happy\ButtonMask.bmp
C:\Program Files\Morpheus\SkinData\happy\chat.css
C:\Program Files\Morpheus\SkinData\happy\chatcombo.bmp
C:\Program Files\Morpheus\SkinData\happy\chatcombomask.bmp
C:\Program Files\Morpheus\SkinData\happy\ChatHeader.bmp
C:\Program Files\Morpheus\SkinData\happy\ChatSplitter.bmp
C:\Program Files\Morpheus\SkinData\happy\checkbox_blank.bmp
C:\Program Files\Morpheus\SkinData\happy\checkbox_blank_disabled.bmp
C:\Program Files\Morpheus\SkinData\happy\checkbox_checked.bmp
C:\Program Files\Morpheus\SkinData\happy\checkbox_checked_disabled.bmp
C:\Program Files\Morpheus\SkinData\happy\clock.swf
C:\Program Files\Morpheus\SkinData\happy\Connecting.bmp
C:\Program Files\Morpheus\SkinData\happy\Connecting_selected.bmp
C:\Program Files\Morpheus\SkinData\happy\CurrentMediaStatic.bmp
C:\Program Files\Morpheus\SkinData\happy\doc-morpheus.ico
C:\Program Files\Morpheus\SkinData\happy\Downloads.bmp
C:\Program Files\Morpheus\SkinData\happy\DownloadsPressed.bmp
C:\Program Files\Morpheus\SkinData\happy\eBay.bmp
C:\Program Files\Morpheus\SkinData\happy\file.gif
C:\Program Files\Morpheus\SkinData\happy\file_info_bg.gif
C:\Program Files\Morpheus\SkinData\happy\fileavailability.html
C:\Program Files\Morpheus\SkinData\happy\fileavailabilitytorrent.html
C:\Program Files\Morpheus\SkinData\happy\filebitzi.html
C:\Program Files\Morpheus\SkinData\happy\FileBitziWaiting.html
C:\Program Files\Morpheus\SkinData\happy\filedetails.html
C:\Program Files\Morpheus\SkinData\happy\filedetails.jpg
C:\Program Files\Morpheus\SkinData\happy\filetipdetail.html
C:\Program Files\Morpheus\SkinData\happy\Header.bmp
C:\Program Files\Morpheus\SkinData\happy\header_chat.bmp
C:\Program Files\Morpheus\SkinData\happy\header_chat_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_close.bmp
C:\Program Files\Morpheus\SkinData\happy\header_close_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_help.bmp
C:\Program Files\Morpheus\SkinData\happy\header_help_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_maximize.bmp
C:\Program Files\Morpheus\SkinData\happy\header_maximize_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_minimize.bmp
C:\Program Files\Morpheus\SkinData\happy\header_minimize_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_morpheusultra.bmp
C:\Program Files\Morpheus\SkinData\happy\header_morpheusultra_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_preferences.bmp
C:\Program Files\Morpheus\SkinData\happy\header_preferences_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\header_restore.bmp
C:\Program Files\Morpheus\SkinData\happy\header_restore_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\HeaderBlock.bmp
C:\Program Files\Morpheus\SkinData\happy\HeaderBlock.gif
C:\Program Files\Morpheus\SkinData\happy\HeaderDowned.bmp
C:\Program Files\Morpheus\SkinData\happy\HScrollBar.bmp
C:\Program Files\Morpheus\SkinData\happy\HThumb.bmp
C:\Program Files\Morpheus\SkinData\happy\image-morpheus.ico
C:\Program Files\Morpheus\SkinData\happy\images\getmorpheusultra.gif
C:\Program Files\Morpheus\SkinData\happy\images\monochrome_morpheus.gif
C:\Program Files\Morpheus\SkinData\happy\images\monochrome_morpheus_ultra.gif
C:\Program Files\Morpheus\SkinData\happy\Left.bmp
C:\Program Files\Morpheus\SkinData\happy\LeftDown.bmp
C:\Program Files\Morpheus\SkinData\happy\lightblue.gif
C:\Program Files\Morpheus\SkinData\happy\ListSel.bmp
C:\Program Files\Morpheus\SkinData\happy\logoUltra.html
C:\Program Files\Morpheus\SkinData\happy\MainFrame.bmp
C:\Program Files\Morpheus\SkinData\happy\MainFrameMask.bmp
C:\Program Files\Morpheus\SkinData\happy\MenuHighlight.bmp
C:\Program Files\Morpheus\SkinData\happy\MenuNormal.bmp
C:\Program Files\Morpheus\SkinData\happy\Mini.bmp
C:\Program Files\Morpheus\SkinData\happy\MiniDown.bmp
C:\Program Files\Morpheus\SkinData\happy\MorphDlg.bmp
C:\Program Files\Morpheus\SkinData\happy\MorphDlgMask.bmp
C:\Program Files\Morpheus\SkinData\happy\player_mute.bmp
C:\Program Files\Morpheus\SkinData\happy\player_mute_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_next.bmp
C:\Program Files\Morpheus\SkinData\happy\player_next_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_next_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\player_pause.bmp
C:\Program Files\Morpheus\SkinData\happy\player_pause_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_play.bmp
C:\Program Files\Morpheus\SkinData\happy\player_play_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_play_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\player_prev.bmp
C:\Program Files\Morpheus\SkinData\happy\player_prev_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_prev_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\player_sound.bmp
C:\Program Files\Morpheus\SkinData\happy\player_sound_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_sound_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\player_stop.bmp
C:\Program Files\Morpheus\SkinData\happy\player_stop_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\player_stop_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\PlayerDisplay.bmp
C:\Program Files\Morpheus\SkinData\happy\playlist_add.bmp
C:\Program Files\Morpheus\SkinData\happy\playlist_add_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\playlist_repeat.BMP
C:\Program Files\Morpheus\SkinData\happy\playlist_repeat_dp.BMP
C:\Program Files\Morpheus\SkinData\happy\playlist_shuffle.BMP
C:\Program Files\Morpheus\SkinData\happy\playlist_shuffle_dp.BMP
C:\Program Files\Morpheus\SkinData\happy\playlist_subtract.BMP
C:\Program Files\Morpheus\SkinData\happy\playlist_subtract_dp.BMP
C:\Program Files\Morpheus\SkinData\happy\PlayListComboBox.bmp
C:\Program Files\Morpheus\SkinData\happy\PlayListItem.bmp
C:\Program Files\Morpheus\SkinData\happy\PlayListSelectedItem.bmp
C:\Program Files\Morpheus\SkinData\happy\PlayListTop.bmp
C:\Program Files\Morpheus\SkinData\happy\PlayListViewBk.bmp
C:\Program Files\Morpheus\SkinData\happy\PriceDownArrow.bmp
C:\Program Files\Morpheus\SkinData\happy\PriceMask.bmp
C:\Program Files\Morpheus\SkinData\happy\PriceRightArrow.bmp
C:\Program Files\Morpheus\SkinData\happy\ProgressBackground.bmp
C:\Program Files\Morpheus\SkinData\happy\ProgressComplete.bmp
C:\Program Files\Morpheus\SkinData\happy\ProgressScale.bmp
C:\Program Files\Morpheus\SkinData\happy\radio_blank.bmp
C:\Program Files\Morpheus\SkinData\happy\radio_blank_disabled.bmp
C:\Program Files\Morpheus\SkinData\happy\radio_checked.bmp
C:\Program Files\Morpheus\SkinData\happy\radio_checked_disabled.bmp
C:\Program Files\Morpheus\SkinData\happy\RectangleButton.bmp
C:\Program Files\Morpheus\SkinData\happy\Research.bmp
C:\Program Files\Morpheus\SkinData\happy\rom-morpheus.ico
C:\Program Files\Morpheus\SkinData\happy\SchemeMenu.bmp
C:\Program Files\Morpheus\SkinData\happy\SchemeMenuHL.bmp
C:\Program Files\Morpheus\SkinData\happy\screen_askdlg_ontransfercancel.xml
C:\Program Files\Morpheus\SkinData\happy\search_extendsearch.bmp
C:\Program Files\Morpheus\SkinData\happy\search_extendsearch_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\search_filetype.bmp
C:\Program Files\Morpheus\SkinData\happy\search_filetype_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\search_searchbutton.bmp
C:\Program Files\Morpheus\SkinData\happy\search_searchbutton_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\search2start.html
C:\Program Files\Morpheus\SkinData\happy\SearchClose.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchClosePressed.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchConnecting.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchDetailToolTip.html
C:\Program Files\Morpheus\SkinData\happy\SearchesListBottom.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchesListMiddle.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchesListSelected.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchesListSingle.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchesListTop.bmp
C:\Program Files\Morpheus\SkinData\happy\SearchesSplitter.bmp
C:\Program Files\Morpheus\SkinData\happy\Skin.xml
C:\Program Files\Morpheus\SkinData\happy\skincombo.bmp
C:\Program Files\Morpheus\SkinData\happy\skincombomask.bmp
C:\Program Files\Morpheus\SkinData\happy\Slider.bmp
C:\Program Files\Morpheus\SkinData\happy\Slider_02.bmp
C:\Program Files\Morpheus\SkinData\happy\Slider_02_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\Slider_mask.bmp
C:\Program Files\Morpheus\SkinData\happy\SmallClose.bmp
C:\Program Files\Morpheus\SkinData\happy\SmallClosePressed.bmp
C:\Program Files\Morpheus\SkinData\happy\spacer.gif
C:\Program Files\Morpheus\SkinData\happy\SplitterButtonDown.bmp
C:\Program Files\Morpheus\SkinData\happy\SplitterButtonDownPressed.bmp
C:\Program Files\Morpheus\SkinData\happy\SplitterButtonUp.bmp
C:\Program Files\Morpheus\SkinData\happy\SplitterButtonUpPressed.bmp
C:\Program Files\Morpheus\SkinData\happy\standard.css
C:\Program Files\Morpheus\SkinData\happy\StatusBar.bmp
C:\Program Files\Morpheus\SkinData\happy\stopwatch.gif
C:\Program Files\Morpheus\SkinData\happy\TabActive.bmp
C:\Program Files\Morpheus\SkinData\happy\TabActiveMask.bmp
C:\Program Files\Morpheus\SkinData\happy\TabInactive.bmp
C:\Program Files\Morpheus\SkinData\happy\TabInactiveMask.bmp
C:\Program Files\Morpheus\SkinData\happy\TabLedge.bmp
C:\Program Files\Morpheus\SkinData\happy\TabLedgeInactive.bmp
C:\Program Files\Morpheus\SkinData\happy\TabLedgeMask.bmp
C:\Program Files\Morpheus\SkinData\happy\Tile.bmp
C:\Program Files\Morpheus\SkinData\happy\tooltip.css
C:\Program Files\Morpheus\SkinData\happy\tooltip.jpg
C:\Program Files\Morpheus\SkinData\happy\tooltipApp.jpg
C:\Program Files\Morpheus\SkinData\happy\tooltipAud.jpg
C:\Program Files\Morpheus\SkinData\happy\tooltipDoc.jpg
C:\Program Files\Morpheus\SkinData\happy\tooltipImg.jpg
C:\Program Files\Morpheus\SkinData\happy\tooltipRom.jpg
C:\Program Files\Morpheus\SkinData\happy\tooltipVid.jpg
C:\Program Files\Morpheus\SkinData\happy\Tray.bmp
C:\Program Files\Morpheus\SkinData\happy\TrayBottomPanel.bmp
C:\Program Files\Morpheus\SkinData\happy\ui.xml
C:\Program Files\Morpheus\SkinData\happy\video_fullscreen.bmp
C:\Program Files\Morpheus\SkinData\happy\video_fullscreen_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\video_undock_dp.bmp
C:\Program Files\Morpheus\SkinData\happy\VideoDisplayButtonsArea.bmp
C:\Program Files\Morpheus\SkinData\happy\VScrollBar.bmp
C:\Program Files\Morpheus\SkinData\happy\VSplitter.bmp
C:\Program Files\Morpheus\SkinData\happy\VTabActive.bmp
C:\Program Files\Morpheus\SkinData\happy\VTabInactive.bmp
C:\Program Files\Morpheus\SkinData\happy\VTabMask.bmp
C:\Program Files\Morpheus\SkinData\happy\VThumb.bmp
C:\Program Files\Morpheus\SkinData\happy\welcome.html
C:\Program Files\Morpheus\SkinData\happy\WideStatic.bmp
C:\Program Files\Morpheus\SkinData\happy\xml\canvas_configlistbottomitem.xml
C:\Program Files\Morpheus\SkinData\happy\xml\canvas_configlistmiddleitem.xml
C:\Program Files\Morpheus\SkinData\happy\xml\canvas_configlistselecteditem.xml
C:\Program Files\Morpheus\SkinData\happy\xml\canvas_configlisttopitem.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_aboutdlg.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_askdlg_onsearchresultdelete.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_askdlg_saveplaylists.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_askonexitdlg.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_chat.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_configdlg.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_fileinformation.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_getpasswddlg.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_install_sharedfolder.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_mainframe.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_myfilespane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_myrsspane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_playlistpane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefantivirus.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefblock.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefchat.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_preffolders.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefgeneral.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefparentalcontrol.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefproxy.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_prefskinsetup.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_searchespane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_searchresultpane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_setpasswddlg.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_skinmessagebox.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_transferspane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_traybottompanel.xml
C:\Program Files\Morpheus\SkinData\happy\xml\screen_videopane.xml
C:\Program Files\Morpheus\SkinData\happy\xml\Skin.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_configlistview.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_currentmediastatic.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_header.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_hscrollbar.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_mainframe.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_morphdlg.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_morpheusstdbutton.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_morpheusstdbuttondown.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_playerdisplay.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_playlistcombobox.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_playlisttop.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_searcheslistschema.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_slider.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_slider_02.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_tabactive.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_tabinactive.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_tabledge.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_vscrollbar.xml
C:\Program Files\Morpheus\SkinData\happy\xml\skinlayout_vtab.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_button_usualbutton.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_checkbox_checkbox.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_checkbox_radiobutton.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_editcontrol_editbox.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_editcontrol_multilineeditbox.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_groupbox_roundrect.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_header_defaultheader.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_playlistview_default.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_slider_default.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_slider_progress.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_tabs_default.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_tabs_fileinformation.xml
C:\Program Files\Morpheus\SkinData\happy\xml\style_vtabs_default.xml
C:\Program Files\Morpheus\Torrent.ico
C:\Program Files\Morpheus\UninstMorpheus.exe
C:\Program Files\Morpheus\version.tmp
C:\Program Files\Morpheus\Video.ico
C:\Program Files\Morpheus\WebCache.net
C:\Program Files\Morpheus\zlib.pyd

.
((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 )))))))))))))))))))))))))))))))
.

2008-06-28 18:44 . 2008-06-28 18:44 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-06-28 18:44 . 2008-06-28 18:44 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-28 14:49 . 2008-06-28 14:49 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-28 14:49 . 2008-06-28 14:49 d——– C:\Documents and Settings\Rich\Application Data\Malwarebytes
2008-06-28 14:49 . 2008-06-28 14:49 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-28 14:49 . 2008-06-19 17:48 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-28 14:49 . 2008-06-19 17:47 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-25 22:47 . 2008-06-25 22:47 d——– C:\Program Files\Trend Micro
2008-06-25 22:34 . 2008-06-25 22:34 d——– C:\Documents and Settings\Rich\Application Data\Uniblue
2008-06-25 21:21 . 2008-06-25 21:21 d——– C:\Program Files\Panda Security
2008-06-24 13:40 . 2008-06-24 13:40 96 –a—— C:\WINDOWS\wininit.ini
2008-06-24 11:28 . 2008-06-24 11:25 691,545 –a—— C:\WINDOWS\unins000.exe
2008-06-24 11:28 . 2008-06-24 11:28 2,555 –a—— C:\WINDOWS\unins000.dat
2008-06-24 10:52 . 2008-06-24 10:52 d——– C:\Documents and Settings\Rich\Application Data\rhcrsrj0e3rr
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 21:00 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 14:47 ——— d—–w C:\Documents and Settings\Rich\Application Data\ComcastToolbar
2008-06-29 15:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-28 22:18 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-06-27 04:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-24 15:31 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-06-11 17:17 62,600 -c–a-w C:\Documents and Settings\Rich\Application Data\GDIPFONTCACHEV1.DAT
2008-06-03 03:38 ——— d—–w C:\Documents and Settings\Rich\Application Data\Azureus
2008-06-01 00:51 ——— d—–w C:\Program Files\Winamp
2008-06-01 00:40 ——— d—–w C:\Documents and Settings\Rich\Application Data\Winamp
2008-05-31 01:53 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 01:53 123,952 -c–a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 01:53 10,671 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-31 01:53 ——— d—–w C:\Program Files\Symantec
2008-05-30 01:22 ——— d—–w C:\Documents and Settings\Rich\Application Data\Moyea
2008-05-25 00:50 47,360 —-a-w C:\Documents and Settings\Rich\Application Data\pcouffin.sys
2008-05-25 00:50 ——— d—–w C:\Program Files\DVDFab Platinum 4
2008-05-25 00:50 ——— d—–w C:\Documents and Settings\Rich\Application Data\Vso
2008-05-24 22:34 ——— d—–w C:\Program Files\Common Files\Adobe
2008-05-24 17:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-05-21 02:59 ——— d—–w C:\Program Files\Azureus
2008-05-19 16:29 ——— d—–w C:\Program Files\support.com
2008-05-19 15:27 ——— d—–w C:\Program Files\Common Files\SupportSoft
2008-05-09 14:26 ——— d—–w C:\Documents and Settings\Other\Application Data\vlc
2008-05-09 14:25 ——— d—–w C:\Documents and Settings\Other\Application Data\DivX
2008-05-09 14:18 ——— d—–w C:\Documents and Settings\Other\Application Data\COMCASTTOOLBAR
2008-05-09 14:17 ——— d—–w C:\Documents and Settings\Other\Application Data\Gtek
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2005-10-18 22:27 0 -c–a-w C:\Documents and Settings\Rich\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-26_23.58.00.71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-27 03:48:08 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-01 01:07:37 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2005-05-24 16:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 19:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 22:26 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 19:16 454784]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 00:05 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-11 18:21 794624]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 02:11 49152]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 08:12 102492]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 08:11 692316]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 19:04 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-12 00:07 98304]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 16:24 290816]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 16:54 253952]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2005-02-17 17:01 233534]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2005-04-27 18:23 788992]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"HostManager"="C:\Program Files\Common Files\AOL\1153771506\ee\AOLSoftware.exe" [2006-09-25 20:52 50736]
"tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [2007-03-07 10:58 1773568]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 03:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 14:49 36352]

C:\Documents and Settings\Rich\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-12-23 11:07:30 569405]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-10-26 04:09:52 811008]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2006-02-12 12:42]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-03-22 10:39]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 14:48:35 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Rich.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 21:09:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????6?3?9?3??????? ???B?????????????hLC? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
.
**************************************************************************
.
Completion time: 2008-06-30 21:19:15 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-01 01:19:01
ComboFix2.txt 2008-06-29 15:05:44
ComboFix3.txt 2008-06-29 14:45:30
ComboFix4.txt 2008-06-28 18:33:36
ComboFix5.txt 2008-06-28 02:21:03

Pre-Run: 2,781,597,696 bytes free
Post-Run: 2,762,891,264 bytes free

914 — E O F — 2008-06-20 03:37:45

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Antivirus XP 08 Hijack & Malware

✨ Ask AI

Ask AI