What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] HELP Various viruses detected on comp.! User name

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I was going on a website and then my antivirus(I use antivir) encountered tons of viruses that it blocked.
My wallpaper changed into an ad warning me about a virus(I am not sure if this is adware of a real warning from windows).
I panicked and closed my comp. quickly and I turned it back on to find the wallpaper still there and one blocked virus pop-up from Antivir(I denied access).
I am currently scanning for anything else.
Please tell me if I still have anything malicious on my computer.
I checked on Task Manager and my username does not appear next to my proccesses! What should I do?

Here's my HiJack Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:43:43 PM, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphctkdj0e7ca.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\drivers\svchost.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avscan.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lphctkdj0e7ca] C:\WINDOWS\system32\lphctkdj0e7ca.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 7943 bytes






EDIT: DAY 2
Okay, just got on my computer about an hour ago, nothing seems to be wrong.
No pop-ups, no Antivir warning me about any viruses, virus alert wallpaper gone and replaced by a backround of dark blue.
BUT, I still don't see my pc username next to my processes on taskmanager.
I did a scan with Malwarebytes and got rid of 19 viruses but I'm sure I didn't get all of them.
Here's a new HiJack Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:21 PM, on 8/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 7623 bytes
Post #2
OmegaUltima,

We have noticed that most people seeking help from us are coming with infections contracted from the use of P2P programs.

Because of this, we felt we needed to change our policy on the use of P2P file sharing programs.

You have the following P-2-P program(s) installed
BitTorrent and BitComet

This is how you uninstall it/them:

  • Click Start
  • Go to Control Panel
  • Go to Add/Remove Programs
  • Find and click Remove for the following (if present):

BitTorrent
BitComet

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
Post #3
I did not contract my virus from Bitcomet nor BitTorrent and I am sure of that. Is there any way to uninstall and yet keep all my downloaded files, because there is no way I will throw those away.
Post #4
OmegaUltima, I'm sorry but I don't know alot about the programs because I've never had/used them. I would believe that you can uninstall the programs without deleting downloaded files. I would think that the files exist on your computer whether you downloaded them directly or through a P2P program.
Post #5
Alright, here you go:

Logfile of random's system information tool (written by random/random)
Run by [removed] at 2008-08-27 16:37:28
Microsoft Windows XP Professional Service Pack 2
System drive C: has 4 GB (4%) free of 114 GB
Total RAM: 503 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:37 PM, on 8/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Paul Chiu\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Paul Chiu.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 7023 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll [2004-09-29 292947]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-04-16 405504]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Companion - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll [2004-09-29 292947]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"!AVG Anti-Spyware"=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe [2007-06-11 6731312]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-10 289064]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Aim6"=C:\Program Files\AIM6\aim6.exe [2008-01-03 50528]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-10-18 204288]
"updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-05-31 289088]
"Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-02-20 356352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2wSysTray]
C:\Program Files\2Wire\2PortalMon.exe [2007-01-03 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe [2008-01-03 50528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autocleaner]
C:\Program Files\Auto Cleaner\cleaner.exe [2002-04-07 45880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-18 266497]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1134242000\ee\AOLSoftware.exe [2006-05-09 50760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINDOWS\system32\hkcmd.exe [2004-11-02 126976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2004-11-02 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-07-10 289064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]
C:\WINDOWS\LTMSG.exe [2003-07-14 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe [2006-11-16 183367]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSVR.EXE]
C:\WINDOWS\system32\PRISMSVR.EXE /APPLY []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-11-02 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [2007-05-30 79408]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispScrSavPage"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Disabled:AIM"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Common Files\AOL\1134242000\ee\aolsoftware.exe"="C:\Program Files\Common Files\AOL\1134242000\ee\aolsoftware.exe:*:Enabled:AOL Services"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\World of Warcraft\Repair.exe"="C:\Program Files\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\Wizet\MapleStory\MapleStory.exe"="C:\Program Files\Wizet\MapleStory\MapleStory.exe:*:Enabled:MapleStory"
"C:\Program Files\Sony Ericsson\Update Service\Update Service.exe"="C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\system32\drivers\svchost.exe"="C:\WINDOWS\system32\drivers\svchost.exe:*:Disabled:svchost"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

File associations

.reg - open - regedit.exe "%1" %*
.scr - open - "%1" %*

List of files/folders created in the last three months

2008-08-27 16:37:28 —-D—- C:\rsit
2008-08-15 00:48:35 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2008-08-15 00:48:26 —-HDC—- C:\WINDOWS\$NtUninstallKB946648$
2008-08-15 00:48:16 —-HDC—- C:\WINDOWS\$NtUninstallKB953839$
2008-08-15 00:48:06 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2008-08-15 00:47:56 —-HDC—- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-08-15 00:47:45 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2008-08-15 00:47:34 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2008-08-15 00:47:05 —-HDC—- C:\WINDOWS\$NtUninstallKB953838$
2008-08-10 20:33:47 —-A—- C:\WINDOWS\system32\xinput1_2.dll
2008-08-10 20:33:47 —-A—- C:\WINDOWS\system32\xactengine2_3.dll
2008-08-10 20:33:45 —-A—- C:\WINDOWS\system32\xinput1_1.dll
2008-08-10 20:33:45 —-A—- C:\WINDOWS\system32\xactengine2_2.dll
2008-08-10 20:33:44 —-A—- C:\WINDOWS\system32\xactengine2_1.dll
2008-08-10 20:33:24 —-A—- C:\WINDOWS\system32\d3dx9_30.dll
2008-08-10 20:33:23 —-A—- C:\WINDOWS\system32\xactengine2_0.dll
2008-08-10 20:33:23 —-A—- C:\WINDOWS\system32\x3daudio1_0.dll
2008-08-10 20:33:21 —-A—- C:\WINDOWS\system32\d3dx9_29.dll
2008-08-10 20:33:20 —-A—- C:\WINDOWS\system32\d3dx9_28.dll
2008-08-10 20:33:19 —-A—- C:\WINDOWS\system32\xinput9_1_0.dll
2008-08-10 20:33:18 —-A—- C:\WINDOWS\system32\d3dx9_27.dll
2008-08-10 20:33:17 —-A—- C:\WINDOWS\system32\d3dx9_26.dll
2008-08-10 20:33:16 —-A—- C:\WINDOWS\system32\d3dx9_25.dll
2008-08-10 20:33:14 —-A—- C:\WINDOWS\system32\d3dx9_24.dll
2008-08-10 20:21:03 —-D—- C:\Program Files\Orca
2008-08-10 19:53:39 —-D—- C:\Program Files\illusion
2008-08-02 23:13:10 —-A—- C:\WINDOWS\system32\javaws.exe
2008-08-02 23:13:10 —-A—- C:\WINDOWS\system32\javaw.exe
2008-08-02 23:13:10 —-A—- C:\WINDOWS\system32\java.exe
2008-07-09 00:43:44 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2008-07-03 16:04:43 —-D—- C:\Documents and Settings\Paul Chiu\Application Data\Malwarebytes
2008-07-03 16:04:39 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-03 16:04:37 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-30 23:56:06 —-D—- C:\Program Files\Combined Community Codec Pack
2008-06-24 21:42:45 —-D—- C:\Program Files\iTunes
2008-06-24 21:38:55 —-D—- C:\Program Files\QuickTime
2008-06-21 23:15:00 —-A—- C:\WINDOWS\ModemLog_Sony Ericsson Device 616 USB WMC Data Modem.txt
2008-06-21 23:04:14 —-D—- C:\Program Files\Avanquest update
2008-06-21 23:04:14 —-D—- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-06-21 23:01:39 —-D—- C:\Program Files\Sony Ericsson
2008-06-21 23:01:39 —-D—- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-06-21 23:01:08 —-D—- C:\Documents and Settings\Paul Chiu\Application Data\InstallShield
2008-06-21 00:01:30 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-06-18 10:52:28 —-A—- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-12 16:16:35 —-D—- C:\Program Files\Trend Micro
2008-06-10 23:14:29 —-HDC—- C:\WINDOWS\$NtUninstallKB951698$
2008-06-10 23:14:19 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2008-06-10 23:13:56 —-HDC—- C:\WINDOWS\$NtUninstallKB950759$
2008-06-10 23:13:40 —-HDC—- C:\WINDOWS\$NtUninstallKB950760$
2008-06-10 23:13:27 —-HDC—- C:\WINDOWS\$NtUninstallKB951376$
2008-06-10 17:07:24 —-A—- C:\WINDOWS\system32\DivXsm.exe
2008-06-10 17:07:20 —-A—- C:\WINDOWS\system32\qt-dx331.dll
2008-06-10 17:04:26 —-A—- C:\WINDOWS\system32\ssldivx.dll
2008-06-10 17:04:26 —-A—- C:\WINDOWS\system32\libdivx.dll
2008-06-10 17:03:26 —-A—- C:\WINDOWS\system32\dtu100.dll.manifest
2008-06-10 17:03:26 —-A—- C:\WINDOWS\system32\dtu100.dll
2008-06-10 17:03:26 —-A—- C:\WINDOWS\system32\dpl100.dll.manifest
2008-06-10 17:03:26 —-A—- C:\WINDOWS\system32\dpl100.dll
2008-06-10 17:03:22 —-A—- C:\WINDOWS\system32\dpv11.dll
2008-06-10 17:03:22 —-A—- C:\WINDOWS\system32\dpus11.dll
2008-06-10 17:03:22 —-A—- C:\WINDOWS\system32\dpuGUI11.dll
2008-06-10 17:03:22 —-A—- C:\WINDOWS\system32\dpuGUI10.dll
2008-06-10 17:03:22 —-A—- C:\WINDOWS\system32\dpu11.dll
2008-06-10 17:03:22 —-A—- C:\WINDOWS\system32\dpu10.dll
2008-06-10 17:03:20 —-A—- C:\WINDOWS\system32\divx_xx11.dll
2008-06-10 17:03:20 —-A—- C:\WINDOWS\system32\divx_xx0c.dll
2008-06-10 17:03:20 —-A—- C:\WINDOWS\system32\divx_xx0a.dll
2008-06-10 17:03:20 —-A—- C:\WINDOWS\system32\divx_xx07.dll
2008-06-10 17:03:18 —-A—- C:\WINDOWS\system32\DivX.dll
2008-06-04 16:42:12 —-D—- C:\Documents and Settings\Paul Chiu\Application Data\Nexon
2008-06-04 16:40:43 —-D—- C:\Program Files\Common Files\INCA Shared
2008-06-04 16:31:41 —-D—- C:\Nexon
2008-05-31 22:53:51 —-D—- C:\Program Files\DNA
2008-05-31 22:53:51 —-D—- C:\Documents and Settings\Paul Chiu\Application Data\DNA

List of drivers

R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver; \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys []
R1 AvgAsCln;AVG Anti-Spyware Clean Driver; C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys [2007-05-30 10872]
R1 avgntdd;avgntdd; C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys [2008-07-18 45376]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-03 36096]
R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.9; C:\WINDOWS\system32\DRIVERS\mdc8021x.sys [2004-04-13 15781]
R2 npkcrypt;npkcrypt; \??\C:\Program Files\Wizet\MapleStory\npkcrypt.sys []
R3 2WIREPCP;2Wire USB; C:\WINDOWS\system32\DRIVERS\2WirePCP.sys [2004-09-15 68672]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-11-02 773565]
R3 ltmodem5;Agere Modem Driver; C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys [2003-12-12 652689]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 rtl8139;Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver; C:\WINDOWS\system32\DRIVERS\R8139n51.SYS [2002-10-04 46976]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S1 tdssserv;tdssserv; C:\WINDOWS\system32\system32\drivers\tdssserv.sys []
S3 Aldebaran;Aldebaran - Storage Filter Drivers; \??\C:\WINDOWS\system32\Drivers\Aldebaran.sys []
S3 ASPI;Advanced SCSI Programming Interface Driver; \??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys []
S3 ATWPKT2;ATWPKT2; \??\C:\Program Files\America Online 8.0\ATWPKT2.SYS []
S3 catchme;catchme; \??\C:\DOCUME~1\PAULCH~1\LOCALS~1\Temp\catchme.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\WINDOWS\system32\DRIVERS\s616bus.sys [2007-04-03 83208]
S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112]
S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s616mdm.sys [2007-04-03 108680]
S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360]
S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\WINDOWS\system32\DRIVERS\s616nd5.sys [2007-04-03 23176]
S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s616obex.sys [2007-04-03 98568]
S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\WINDOWS\system32\DRIVERS\s616unic.sys [2007-04-03 99080]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 XTrapD12;XTrapD12; \??\C:\WINDOWS\system32\XTrapD12.sys []

List of services

R2 AntiVirScheduler;AntiVir Scheduler; C:\Program Files\AntiVir PersonalEdition Classic\sched.exe [2008-07-18 68865]
R2 AntiVirService;AntiVir PersonalEdition Classic Service; C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe [2008-08-14 149761]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-10 116040]
R2 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard; C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe [2007-05-30 312880]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-10 532264]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2007-07-23 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-03 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-03 14336]

—————–EOF—————–








info.txt logfile of random's system information tool 2008-08-27 16:37:43

Uninstall list

–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2Wire Wireless Client–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A3BC5D37-30F9-4CF7-BD5C-0DFF063E4B6D}\Setup.exe" -l0x9 -L0x9
Action Replay Code Manager–>"C:\Program Files\Datel\Action Replay Code Manager\unins000.exe"
Ad-Aware SE Personal–>C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Anchor Service CS3–>MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3–>MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3–>MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting–>MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0–>MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps–>MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific–>MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings–>MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings–>MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings–>MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings–>MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3–>MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3–>MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2–>MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 9 ActiveX–>C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All–>MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3–>MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3–>MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files–>MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3–>C:\Program Files\Common Files\Adobe\Installers\2ac78060bc5856b0c1cf873bb919b58\Setup.exe
Adobe Photoshop CS3–>MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05}
Adobe Reader 7.0.5 Language Support–>MsiExec.exe /I{AC76BA86-7AD7-5464-3428-7050000000A7}
Adobe Reader 7.0.9–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
Adobe Reader Japanese Fonts–>MsiExec.exe /I{AC76BA86-7AD7-5A76-5A64-7E8A45000001}
Adobe Setup–>MsiExec.exe /I{D1BB4446-AE9C-4256-9A7F-4D46604D2462}
Adobe Stock Photos CS3–>MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support–>MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3–>MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client–>MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin–>MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3–>MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Adobe® Photoshop® Album Starter Edition 3.0–>MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
AIM 6–>C:\Program Files\AIM6\uninst.exe
AIM Location Info–>C:\PROGRA~1\COMMON~1\AOL\113424~1\ee\services\LOCATI~1\UNINST~1\UNWISE.EXE C:\PROGRA~1\COMMON~1\AOL\113424~1\ee\services\LOCATI~1\UNINST~1\INSTALL.LOG
AOL Instant Messenger–>C:\PROGRA~1\AIM\uninstll.exe -LOG= C:\PROGRA~1\AIM\install.log -OEM=
Apple Mobile Device Support–>MsiExec.exe /I{35B91753-5789-4517-9CF1-2CCE3A8CF4F1}
Apple Software Update–>MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Auto Cleaner XP–>"C:\Program Files\Auto Cleaner\uninst.exe"
Avanquest update–>C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\setup.exe -runfromtemp -l0x0009 -removeonly
AVG Anti-Spyware 7.5–>C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Avira AntiVir Personal - Free Antivirus–>C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
AviSynth 2.5–>"C:\Program Files\AviSynth 2.5\Uninstall.exe"
Bonjour–>MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Canon PhotoRecord–>MsiExec.exe /X{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}
Canon PIXMA iP3000–>C:\WINDOWS\system32\CNMCP61.exe "-PRINTERNAMECanon PIXMA iP3000" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmi0409.dll"
Canon Utilities Easy-PhotoPrint–>C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe C:\Program Files\Canon\Easy-PhotoPrint\uninst.ini
Combined Community Codec Pack 2008-01-24–>"C:\Program Files\Combined Community Codec Pack\unins000.exe"
Costco Photo Organizer–>MsiExec.exe /X{17A7FDBC-FB38-4258-B623-BCBA212BC25D}
DivX Codec–>C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player–>C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player–>C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Easy-WebPrint–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
Frets On Fire–>"C:\Program Files\Frets on Fire\Uninstall.exe"
FrostWire 4.13.3–>C:\Program Files\FrostWire\Uninstall.exe
GameGuard–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E63241F0-B658-4B38-AF2F-CD14108B0467}\Setup.exe" -l0x9
Google Earth–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly
Google Video Player–>"C:\Program Files\Google\Google Video Player\Uninstall.exe"
Graph paper printer–>C:\GraphPap\Uninstal.exe
GTK+ 2.10.11 runtime environment–>"C:\Program Files\Common Files\GTK\2.0\setup\unins000.exe"
Hijackthis 1.99.1–>"C:\Program Files\Hijackthis\unins000.exe"
HijackThis 2.0.2–>"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)–>"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
ijji–>C:\ijji\ENGLISH\ijjiUninstall.exe
Intel® Extreme Graphics Driver–>RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV;_2562
InterActual Player–>C:\Program Files\InterActual\InterActual Player\inuninst.exe
iPod for Windows 2005-10-12–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A} /l1033
iPod for Windows 2006-01-10–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{3D047C15-C859-45F7-81CE-F2681778069B} /l1033
iTunes–>MsiExec.exe /I{EF6C4600-306D-4F6A-A119-C2A877D25B4A}
Java™ 6 Update 2–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Kaspersky Online Scanner–>C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
LimeWire 4.12.6–>"C:\Program Files\LimeWire\uninstall.exe"
Macromedia Shockwave Player–>C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Magic Starter 7th Edition–>C:\WINDOWS\uninst.exe -f"C:\Program Files\Wizards of the Coast\Magic Starter 7th Edition\DeIsL1.isu" -c"C:\Program Files\Wizards of the Coast\Magic Starter 7th Edition\_ISREG32.DLL"
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MapleStory–>MsiExec.exe /I{7A512A34-F4E8-43C4-BD80-43A022B31BF6}
MapleStory–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEC511B1-59CB-4F15-AD75-0543034572A5}\Setup.exe"
MediaMonkey 2.5–>"C:\Program Files\MediaMonkey\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft ActiveX Control Pad–>C:\Program Files\ActiveX Control Pad\Setup\Remove.exe
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office 2003 Web Components–>MsiExec.exe /I{90A40409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Access 2003 Runtime–>MsiExec.exe /I{901C0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003–>MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Word Viewer 2003–>MsiExec.exe /I{90850409-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Web Components–>MsiExec.exe /I{90260409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works 7.0–>MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
mIRC–>"C:\Program Files\mIRC\mirc.exe" -uninstall
MobMap 1.42–>"C:\Program Files\MobMapUpdater\unins000.exe"
Mozilla Firefox (2.0.0.16)–>C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)–>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK–>MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML4 Parser–>MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Netscape Browser (remove only)–>"C:\Program Files\Netscape\Netscape Browser\NSUninst.exe"
NJStar Japanese WP–>C:\Program Files\NJStar Japanese WP\uninst.exe
oggcodecs 0.71.0946–>C:\Program Files\illiminable\oggcodecs\uninst.exe
Opera 9.0–>MsiExec.exe /X{2E48A9E4-C531-4B71-ADF1-F80403413914}
Orca–>MsiExec.exe /I{85F4CBCB-9BBC-4B50-A7D8-E1106771498D}
PDF Settings–>MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Plaxo Toolbar for Outlook (with AIM Enhancements)–>C:\Program Files\Plaxo\2.12.1.1\uninstall.exe
Project64 1.6–>MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}
QuickTime–>MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
RealPlayer–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Safari–>MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}
SBC Yahoo! DSL Home Networking Installer–>C:\Program Files\2Wire\Uninstaller.exe
Search Assistant - My Search–>rundll32 C:\PROGRA~1\MySearch\SrchAstt\1.bin\mysrchas.dll,O
Security Update for Windows Media Player (KB911564)–>"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)–>"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)–>"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows XP (KB883939)–>"C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)–>"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)–>"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)–>"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896422)–>"C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)–>"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896424)–>"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)–>"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896688)–>"C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)–>"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899588)–>"C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899589)–>"C:\WINDOWS\$NtUninstallKB899589$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)–>"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)–>"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)–>"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)–>"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)–>"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB904706)–>"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)–>"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)–>"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905915)–>"C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)–>"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908531)–>"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911280)–>"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)–>"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911567)–>"C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)–>"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912812)–>"C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912919)–>"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913446)–>"C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)–>"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)–>"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)–>"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB916281)–>"C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917159)–>"C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917344)–>"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917422)–>"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)–>"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)–>"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918439)–>"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918899)–>"C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)–>"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)–>"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920214)–>"C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)–>"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)–>"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)–>"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921398)–>"C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)–>"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921883)–>"C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922616)–>"C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922760)–>"C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)–>"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)–>"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)–>"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)–>"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923694)–>"C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)–>"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924191)–>"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)–>"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)–>"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)–>"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925454)–>"C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925486)–>"C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)–>"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)–>"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)–>"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)–>"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)–>"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928090)–>"C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)–>"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)–>"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)–>"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929969)–>"C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)–>"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)–>"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931768)–>"C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)–>"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)–>"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933566)–>"C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)–>"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)–>"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)–>"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)–>"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937143)–>"C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937894)–>"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938127)–>"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)–>"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB939653)–>"C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)–>"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)–>"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)–>"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941693)–>"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Security Update for Windows XP (KB942615)–>"C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)–>"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)–>"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)–>"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944338)–>"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944533)–>"C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)–>"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB945553)–>"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)–>"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB947864)–>"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948590)–>"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948881)–>"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)–>"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950759)–>"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953838)–>"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sega Smash Pack II–>C:\WINDOWS\IsUninst.exe -f"C:\Sega\Smash Pack II\Uninst.isu"
SEGA Swirl–>C:\Program Files\SEGA\Swirl\Sw_105\sw_del.exe
Softnyx Launcher–>"C:\Program Files\Softnyx\Launcher\unins000.exe"
Sony Ericsson PC Suite 3.209.00–>C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\Setup.exe -runfromtemp -l0x0009 -removeonly
Spybot - Search & Destroy 1.3–>"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareBlaster v3.5.1–>"C:\Program Files\SpywareBlaster\unins000.exe"
StepMania (remove only)–>"C:\Program Files\StepMania\uninstall.exe"
System Requirements Lab–>C:\Program Files\SystemRequirementsLab\Uninstall.exe
The GIMP 2.2.17–>"C:\Program Files\GIMP-2.0\unins000.exe"
Ultimate Hack Pack–>C:\Program Files\Ultimate Hack Pack\Uninstal.exe
Update for Windows XP (KB894391)–>"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update for Windows XP (KB896727)–>"C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)–>"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)–>"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)–>"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)–>"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)–>"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)–>"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB929338)–>"C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)–>"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB931836)–>"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update for Windows XP (KB933360)–>"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)–>"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)–>"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)–>"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB942840)–>"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
Update for Windows XP (KB946627)–>"C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update Service–>C:\Program Files\Sony Ericsson\Update Service\uninst.exe
URGE–>MsiExec.exe /I{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}
VideoLAN VLC media player 0.8.6h–>C:\Program Files\VideoLAN\VLC\uninstall.exe
Videora iPod Converter 0.91–>C:\Program Files\VideoraiPodConverter\uninst.exe
War Rock Toolbar–>"C:\WINDOWS\War_Rock_Toolbar_Uninstaller_4734.exe" _?=C:\Program Files\War Rock Toolbar
Windows Installer 3.1 (KB893803)–>"C:\WINDOWS\$MSI31Uninstall_KB893803$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)–>"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Messenger–>MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Hotfix - KB873333–>C:\WINDOWS\$NtUninstallKB873333$\spuninst\spuninst.exe
Windows XP Hotfix - KB873339–>C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885250–>C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835–>C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836–>C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185–>C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB887472–>C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP Hotfix - KB887742–>C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe
Windows XP Hotfix - KB888113–>C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302–>C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890175–>C:\WINDOWS\$NtUninstallKB890175$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859–>"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Hotfix - KB890923–>"C:\WINDOWS\$NtUninstallKB890923$\spuninst\spuninst.exe"
Windows XP Hotfix - KB891781–>C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Windows XP Hotfix - KB893066–>"C:\WINDOWS\$NtUninstallKB893066$\spuninst\spuninst.exe"
Windows XP Hotfix - KB893086–>"C:\WINDOWS\$NtUninstallKB893086$\spuninst\spuninst.exe"
WinRAR archiver–>C:\Program Files\WinRAR\uninstall.exe
WOW2 ActiveX Control Sample–>"C:\Program Files\EzTools\WOWCTL2\unins000.exe"
WoWscape Server Browser–>"C:\WINDOWS\WoWscape Server Browser\uninstall.exe" "/U:C:\Program Files\World of Warcraft\\Uninstall\uninstall.xml"
X-Chat 2 (remove only)–>"C:\Program Files\xchat\uninstall.exe"
XviD MPEG-4 Video Codec–>"C:\Program Files\XviD\unins000.exe"
Yahoo! Install Manager–>C:\WINDOWS\system32\regsvr32 /u C:\WINDOWS\cache\YINSTH~1.DLL
Yahoo! Toolbar–>rundll32.exe C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YCOMP5~1.DLL,DllCommand ui

Hosts File

127.0.0.1 gameguard.mapleglobal.com

Security center information

AV: AntiVir PersonalEdition Classic Virus Protection
AV: Avira AntiVir PersonalEdition
AV: AntiVir PersonalEdition Classic Virus Protection
AV: AntiVir PersonalEdition Classic Virus Protection
AV: AntiVir PersonalEdition Classic Virus Protection
AV: AntiVir PersonalEdition Classic Virus Protection
FW: Outpost Firewall Pro (disabled)

Environment variables

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\AOL\1134242000\ee;C:\Program Files\Common Files\GTK\2.0\bin;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

—————–EOF—————–
Post #6
OmegaUltima,

You've got some serious infections going on there. :pullhair:

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response.

Did you uninstall the P2P programs as directed?
Post #8
OmegaUltima,

Yes, I deleted the programs as directed.

You logs appear to still show them but if you uninstalled them I guess the logs must be showing residuals.


A. Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

B. Now we must disable some of your security programs so that they do not interfere with the running of our tools:

AVIRA ANTIVIR
Please navigate to the system tray on the bottom right hand corner and look for an open white umbrella on red background (looks to this: [external image: Posted Image] )
  • right click it-> untick the option AntiVir Guard enable.
  • You should now see a closed, white umbrella on a red background (looks to this: [external image: Posted Image] )
You succesfully disabled the AntiVir Guard.

AVG ANTI-SPYWARE
  • Launch AVG Anti-Spyware.
  • From the "Status" menu, select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.
  • Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".

C.Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]
  • DO NOT USE your computer for any other purpose while ComboFix is running.
  • ComboFix may restart your computer, this is normal.
  • When finished, it will produce a log, ComboFix.txt.
  • Please post ComboFix.txt in your next reply along with a new HijackThis log.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #9
Here:

ComboFix 08-08-27.03 - Paul Chiu 2008-08-27 18:36:39.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.259 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\bin.clearspring.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\interclick.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\interclick.com\ud.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com\v1.0.0199\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com\v1.0.0275\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com\v1.0.0293\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com\v1.0.0304\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_tdssserv


((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 )))))))))))))))))))))))))))))))
.

2008-08-27 16:37 . 2008-08-27 16:37 d——– C:\rsit
2008-08-21 20:29 . 2008-08-27 18:45 d–hs—- C:\WINDOWS\system32\sysproc64
2008-08-21 20:29 . 2008-08-21 20:29 d–hs—- C:\Documents and Settings\NetworkService\Application Data\sysproc64
2008-08-21 20:29 . 2008-08-21 20:29 d–hs—- C:\Documents and Settings\LocalService\Application Data\sysproc64
2008-08-10 20:21 . 2008-08-10 20:21 d——– C:\Program Files\Orca
2008-08-10 19:53 . 2007-01-19 03:21 d——– C:\Program Files\illusion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 01:34 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\DNA
2008-08-27 23:34 ——— d—–w C:\Program Files\BitComet
2008-08-27 05:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
2008-08-03 06:13 ——— d—–w C:\Program Files\Java
2008-07-22 01:52 ——— d—–w C:\Program Files\SystemRequirementsLab
2008-07-22 01:52 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\SystemRequirementsLab
2008-07-19 07:20 ——— d—–w C:\Program Files\iTunes
2008-07-19 07:20 ——— d—–w C:\Program Files\iPod
2008-07-19 07:03 ——— d—–w C:\Program Files\Safari
2008-07-03 23:04 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-07-03 23:04 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\Malwarebytes
2008-07-03 23:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-01 06:56 ——— d—–w C:\Program Files\Combined Community Codec Pack
2008-07-01 06:16 ——— d—–w C:\Program Files\VideoLAN
2008-07-01 06:11 ——— d—–w C:\Program Files\DivX
2008-06-28 21:16 34,296 —-a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-28 21:16 17,144 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2007-09-14 05:45 5,632 –sha-w C:\Program Files\Thumbs.db
2006-03-26 06:57 59,904 -c–a-w C:\Program Files\Judge Miller.ppt
2005-09-26 23:11 21 -c–a-w C:\Program Files\AVPersonalAVWIN.INI
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 09:15 50528]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15:56 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-31 22:53 289088]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2wSysTray]
–a—— 2007-01-03 18:00 393216 C:\Program Files\2Wire\2PortalMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
–a—— 2008-01-03 09:15 50528 C:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autocleaner]
–a—— 2002-04-07 08:35 45880 C:\Program Files\Auto Cleaner\cleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
–a—— 2008-07-18 22:21 266497 C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-03 15:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
–a—— 2006-05-09 17:24 50760 C:\Program Files\Common Files\AOL\1134242000\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a—— 2004-11-02 08:59 126976 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a—— 2004-11-02 09:03 155648 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
–a—— 2006-11-16 13:42 183367 C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra—— 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
–a—— 2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]
–a—— 2003-07-14 10:52 40960 C:\WINDOWS\ltmsg.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1134242000\\ee\\aolsoftware.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Wizet\\MapleStory\\MapleStory.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1720:TCP"= 1720:TCP:BitComet 1720 TCP
"1720:UDP"= 1720:UDP:BitComet 1720 UDP
"56579:TCP"= 56579:TCP:BitComet 56579 TCP
"56579:UDP"= 56579:UDP:BitComet 56579 UDP

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2008-04-16 21:48]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2008-07-18 22:21]
S3 Aldebaran;Aldebaran - Storage Filter Drivers;C:\WINDOWS\system32\Drivers\Aldebaran.sys []
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]
.
Contents of the 'Scheduled Tasks' folder

2008-08-21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-PRISMSVR - C:\WINDOWS\system32\PRISMSVR.EXE
MSConfigStartUp-SunJavaUpdateSched - C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe


.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Paul Chiu\Application Data\Mozilla\Firefox\Profiles\42yxb7s1.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 18:46:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2008-08-27 18:59:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-28 01:59:25
ComboFix2.txt 2007-08-10 22:15:38

Pre-Run: 4,125,327,360 bytes free
Post-Run: 4,254,081,024 bytes free

176 — E O F — 2008-08-15 07:48:40













Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06, on 2008-08-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 6965 bytes
Post #10
OmegaUltima,

Disable your protection programs as we did before.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    KILLALL::

Driver::
Aldebaran

Folder::
C:\WINDOWS\system32\sysproc64
C:\Documents and Settings\NetworkService\Application Data\sysproc64
C:\Documents and Settings\LocalService\Application Data\sysproc64
C:\Documents and Settings\Paul Chiu\Application Data\DNA
C:\Program Files\BitComet


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe"

File::
C:\Program Files\DNA\btdna.exe
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.

In your next reply please provide:
  • ComboFix.txt
  • Kaspersky report
  • New HijackThis log taken after everything else completed
Post #13
Sorry for the long wait, that took me nearly 12 hours, LOL




ComboFix 08-08-27.03 - Paul Chiu 2008-08-27 19:32:17.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.286 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Paul Chiu\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\DNA\btdna.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Application Data\sysproc64
C:\Documents and Settings\LocalService\Application Data\sysproc64\sysproc32.sys
C:\Documents and Settings\NetworkService\Application Data\sysproc64
C:\Documents and Settings\NetworkService\Application Data\sysproc64\sysproc32.sys
C:\Documents and Settings\Paul Chiu\Application Data\DNA
C:\Documents and Settings\Paul Chiu\Application Data\DNA\dht.dat
C:\Documents and Settings\Paul Chiu\Application Data\DNA\resume.dat
C:\Documents and Settings\Paul Chiu\Application Data\DNA\resume.dat.old
C:\Documents and Settings\Paul Chiu\Application Data\DNA\settings.dat
C:\Documents and Settings\Paul Chiu\Application Data\DNA\settings.dat.old
C:\Program Files\BitComet
C:\Program Files\BitComet\0.67BitComet.zip
C:\Program Files\BitComet\0.67BitComet.zip.0001
C:\Program Files\BitComet\BitComet.xml
C:\Program Files\BitComet\codec\CodecCheck.exe
C:\Program Files\BitComet\codec\RealMediaSplitter.ax
C:\Program Files\BitComet\Downloads.xml
C:\Program Files\BitComet\ERRORLOG.TXT
C:\Program Files\BitComet\Favourite.xml
C:\Program Files\BitComet\rules\dhtnodes.dat
C:\Program Files\BitComet\rules\ipfilter.dat
C:\Program Files\BitComet\share\my_shares.xml
C:\Program Files\BitComet\Torrents\(+44) When Your Heart Stops Beating + Bouns Tracks (2006).torrent
C:\Program Files\BitComet\Torrents\(+44) When Your Heart Stops Beating + Bouns Tracks (2006).xml
C:\Program Files\BitComet\Torrents\(+44) When Your Heart Stops Beating + Bouns Tracks (2006)_chat.xml
C:\Program Files\BitComet\Torrents\(BIGB88) Jibbs- Chain Hang Low+Remix Version.torrent
C:\Program Files\BitComet\Torrents\(BIGB88) Jibbs- Chain Hang Low+Remix Version.xml
C:\Program Files\BitComet\Torrents\[#aznmp3] ASIAN KUNG-FU GENERATION - Feedback File [192kbps][2006.10.25].rar.torrent
C:\Program Files\BitComet\Torrents\[#aznmp3] ASIAN KUNG-FU GENERATION - Feedback File [192kbps][2006.10.25].rar.xml
C:\Program Files\BitComet\Torrents\[#aznmp3] ASIAN KUNG-FU GENERATION - Feedback File [192kbps][2006.10.25].rar_chat.xml
C:\Program Files\BitComet\Torrents\[a-o]Prince_of_Tennis_Movie_1[F56BD011].avi.torrent
C:\Program Files\BitComet\Torrents\[a-o]Prince_of_Tennis_Movie_1[F56BD011].avi.xml
C:\Program Files\BitComet\Torrents\[a-o]Prince_of_Tennis_Movie_1[F56BD011].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_100_[35B3EB33].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_100_[35B3EB33].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_100_[35B3EB33].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_101_[F8FAF346].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_101_[F8FAF346].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_101_[F8FAF346].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_111_[D53B91EC].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_111_[D53B91EC].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_111_[D53B91EC].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_82_[35722318].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_82_[35722318].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_83_[FFAE8386].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_83_[FFAE8386].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_84-85_[245070DC].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_84-85_[245070DC].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_84-85_[245070DC].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_86_[198F046B].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_86_[198F046B].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_86_[198F046B].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_87_[A71E475E].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_87_[A71E475E].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_87_[A71E475E].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_88_[E11178DC].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_88_[E11178DC].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_89_[13E7D5FC].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_89_[13E7D5FC].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_89_[13E7D5FC].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_90_[CD4E0950].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_90_[CD4E0950].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_90_[CD4E0950].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_91_[861B2055].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_91_[861B2055].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_91_[861B2055].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_92_[F8824A24].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_92_[F8824A24].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_92_[F8824A24].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_93_[C3CE749A].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_93_[C3CE749A].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_94_[FD1628C1].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_94_[FD1628C1].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_94_[FD1628C1].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_95_[4C5CD209].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_95_[4C5CD209].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_95_[4C5CD209].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_96_[14A97A58].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_96_[14A97A58].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_96_[14A97A58].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_97_[2B8B71B1].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_97_[2B8B71B1].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_97_[2B8B71B1].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_98_[8C71BD62].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_98_[8C71BD62].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_98_[8C71BD62].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_99_[CCDCF912].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Bleach_99_[CCDCF912].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Bleach_99_[CCDCF912].avi_chat.xml
C:\Program Files\BitComet\Torrents\[DB]_Naruto_208_[FE66CC19].avi.torrent
C:\Program Files\BitComet\Torrents\[DB]_Naruto_208_[FE66CC19].avi.xml
C:\Program Files\BitComet\Torrents\[DB]_Naruto_208_[FE66CC19].avi_chat.xml
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v32c284.rar.torrent
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v32c284.rar.xml
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v32c284.rar_chat.xml
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v32c285.rar.torrent
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v32c285.rar.xml
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v33c288.rar.torrent
C:\Program Files\BitComet\Torrents\[Evil_Genius]Berserk_v33c288.rar.xml
C:\Program Files\BitComet\Torrents\[KAA]_Fullmetal_Alchemist_the_Conqueror_of_Shamballa.DVD.torrent
C:\Program Files\BitComet\Torrents\[KAA]_Fullmetal_Alchemist_the_Conqueror_of_Shamballa.DVD.xml
C:\Program Files\BitComet\Torrents\[Single 2007] Hurricane_Chris-A_Bay_Bay.torrent
C:\Program Files\BitComet\Torrents\[Single 2007] Hurricane_Chris-A_Bay_Bay.xml
C:\Program Files\BitComet\Torrents\[YHBT_Triumph]_Bleach_95_[5A648EE6].avi.torrent
C:\Program Files\BitComet\Torrents\[YHBT_Triumph]_Bleach_95_[5A648EE6].avi.xml
C:\Program Files\BitComet\Torrents\[YHBT_Triumph]_Bleach_95_[5A648EE6].avi_chat.xml
C:\Program Files\BitComet\Torrents\10,000 BC.[2008].DVDRIP.XVID.[Eng]-DUQA.torrent
C:\Program Files\BitComet\Torrents\10,000 BC.[2008].DVDRIP.XVID.[Eng]-DUQA.xml
C:\Program Files\BitComet\Torrents\1982 - Walk Among Us.torrent
C:\Program Files\BitComet\Torrents\1982 - Walk Among Us.xml
C:\Program Files\BitComet\Torrents\2006 - Define the Great Line.torrent
C:\Program Files\BitComet\Torrents\2006 - Define the Great Line.xml
C:\Program Files\BitComet\Torrents\2006 - Define the Great Line_chat.xml
C:\Program Files\BitComet\Torrents\2006 - Iron Maiden - A Matter of Life and Death.torrent
C:\Program Files\BitComet\Torrents\2006 - Iron Maiden - A Matter of Life and Death.xml
C:\Program Files\BitComet\Torrents\30 Days Of Night.torrent
C:\Program Files\BitComet\Torrents\30 Days Of Night.xml
C:\Program Files\BitComet\Torrents\30SecondsToMars-ABeautifulLie-2005.torrent
C:\Program Files\BitComet\Torrents\30SecondsToMars-ABeautifulLie-2005.xml
C:\Program Files\BitComet\Torrents\30SecondsToMars-ABeautifulLie-2005_chat.xml
C:\Program Files\BitComet\Torrents\A_Static_Lullaby-A_Static_Lullaby-(Advance)-2006 XsXeX.torrent
C:\Program Files\BitComet\Torrents\A_Static_Lullaby-A_Static_Lullaby-(Advance)-2006 XsXeX.xml
C:\Program Files\BitComet\Torrents\A_Static_Lullaby-A_Static_Lullaby-(Advance)-2006 XsXeX_chat.xml
C:\Program Files\BitComet\Torrents\Adobe Photoshop CS3 + Crack.torrent
C:\Program Files\BitComet\Torrents\Adobe Photoshop CS3 + Crack.xml
C:\Program Files\BitComet\Torrents\AFI - DECEMBERUNDERGROUND [2006].torrent
C:\Program Files\BitComet\Torrents\AFI - DECEMBERUNDERGROUND [2006].xml
C:\Program Files\BitComet\Torrents\AFI - DECEMBERUNDERGROUND [2006]_chat.xml
C:\Program Files\BitComet\Torrents\After Dark EP.torrent
C:\Program Files\BitComet\Torrents\After Dark EP.xml
C:\Program Files\BitComet\Torrents\Aiden-Rain_In_Hell-(EP)-2006-MP3.torrent
C:\Program Files\BitComet\Torrents\Aiden-Rain_In_Hell-(EP)-2006-MP3.xml
C:\Program Files\BitComet\Torrents\Aiden - Nightmare Anatomy.torrent
C:\Program Files\BitComet\Torrents\Aiden - Nightmare Anatomy.xml
C:\Program Files\BitComet\Torrents\Akon - Konvicted.torrent
C:\Program Files\BitComet\Torrents\Akon - Konvicted.xml
C:\Program Files\BitComet\Torrents\Akon - Konvicted_chat.xml
C:\Program Files\BitComet\Torrents\Alesana-On_Frail_Wings_Of_Vanity_And_Wax-2006-RNS.torrent
C:\Program Files\BitComet\Torrents\Alesana-On_Frail_Wings_Of_Vanity_And_Wax-2006-RNS.xml
C:\Program Files\BitComet\Torrents\Alexisonfire & City and Colour Discography (2002-2006).torrent
C:\Program Files\BitComet\Torrents\Alexisonfire & City and Colour Discography (2002-2006).xml
C:\Program Files\BitComet\Torrents\Alexisonfire & City and Colour Discography (2002-2006)_chat.xml
C:\Program Files\BitComet\Torrents\All_Time_Low-So_Wrong_Its_Right-2007-FNT.torrent
C:\Program Files\BitComet\Torrents\All_Time_Low-So_Wrong_Its_Right-2007-FNT.xml
C:\Program Files\BitComet\Torrents\Amber Pacific.torrent
C:\Program Files\BitComet\Torrents\Amber Pacific.xml
C:\Program Files\BitComet\Torrents\Amber Pacific_chat.xml
C:\Program Files\BitComet\Torrents\Anberlin - Cities [Deluxe Edition].torrent
C:\Program Files\BitComet\Torrents\Anberlin - Cities [Deluxe Edition].xml
C:\Program Files\BitComet\Torrents\Anberlin - Cities [Deluxe Edition]_chat.xml
C:\Program Files\BitComet\Torrents\Angels And Airwaves-We Dont Need To Whisper(withcovers) a DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Angels And Airwaves-We Dont Need To Whisper(withcovers) a DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\Angels And Airwaves-We Dont Need To Whisper(withcovers) a DHZ.Inc Release_chat.xml
C:\Program Files\BitComet\Torrents\Armor For Sleep - Smile For Them.torrent
C:\Program Files\BitComet\Torrents\Armor For Sleep - Smile For Them.xml
C:\Program Files\BitComet\Torrents\Armor for Sleep - What To Do When You Are Dead.torrent
C:\Program Files\BitComet\Torrents\Armor for Sleep - What To Do When You Are Dead.xml
C:\Program Files\BitComet\Torrents\As Cities Burn.torrent
C:\Program Files\BitComet\Torrents\As Cities Burn.xml
C:\Program Files\BitComet\Torrents\As_I_Lay_Dying-A_Long_March_The_First_Recordings-2006-MTD.torrent
C:\Program Files\BitComet\Torrents\As_I_Lay_Dying-A_Long_March_The_First_Recordings-2006-MTD.xml
C:\Program Files\BitComet\Torrents\Asian Kung-Fu Generation.torrent
C:\Program Files\BitComet\Torrents\Asian Kung-Fu Generation.xml
C:\Program Files\BitComet\Torrents\Atreyu–A_Death-Grip_On_Yesterday-Promo-CD-2006-PiT.torrent
C:\Program Files\BitComet\Torrents\Atreyu–A_Death-Grip_On_Yesterday-Promo-CD-2006-PiT.xml
C:\Program Files\BitComet\Torrents\Atreyu-Lead Sails Paper Anchor.torrent
C:\Program Files\BitComet\Torrents\Atreyu-Lead Sails Paper Anchor.xml
C:\Program Files\BitComet\Torrents\Atreyu - Discography.torrent
C:\Program Files\BitComet\Torrents\Atreyu - Discography.xml
C:\Program Files\BitComet\Torrents\Atreyu - Discography_chat.xml
C:\Program Files\BitComet\Torrents\Avenged Sevenfold - [2007] - Avenged Sevenfold.torrent
C:\Program Files\BitComet\Torrents\Avenged Sevenfold - [2007] - Avenged Sevenfold.xml
C:\Program Files\BitComet\Torrents\Avenged Sevenfold.torrent
C:\Program Files\BitComet\Torrents\Avenged Sevenfold.xml
C:\Program Files\BitComet\Torrents\Avenged Sevenfold_chat.xml
C:\Program Files\BitComet\Torrents\Batman - Arkham Asylum.torrent
C:\Program Files\BitComet\Torrents\Batman - Arkham Asylum.xml
C:\Program Files\BitComet\Torrents\Batman - The Dark Knight Returns.torrent
C:\Program Files\BitComet\Torrents\Batman - The Dark Knight Returns.xml
C:\Program Files\BitComet\Torrents\Batman - The Killing Joke.cbr.torrent
C:\Program Files\BitComet\Torrents\Batman - The Killing Joke.cbr.xml
C:\Program Files\BitComet\Torrents\Batman - The Long Halloween.torrent
C:\Program Files\BitComet\Torrents\Batman - The Long Halloween.xml
C:\Program Files\BitComet\Torrents\Batman.Begins[2005]DVDrip.h264.[Eng]-phrax.torrent
C:\Program Files\BitComet\Torrents\Batman.Begins[2005]DVDrip.h264.[Eng]-phrax.xml
C:\Program Files\BitComet\Torrents\beginner_1_20.torrent
C:\Program Files\BitComet\Torrents\beginner_1_20.xml
C:\Program Files\BitComet\Torrents\Berserk_OST+Single_-_Forces.torrent
C:\Program Files\BitComet\Torrents\Berserk_OST+Single_-_Forces.xml
C:\Program Files\BitComet\Torrents\Beyonce - B Day [2006][CD+2 SkidVids+Cov].torrent
C:\Program Files\BitComet\Torrents\Beyonce - B Day [2006][CD+2 SkidVids+Cov].xml
C:\Program Files\BitComet\Torrents\Beyonce - B Day [2006][CD+2 SkidVids+Cov]_chat.xml
C:\Program Files\BitComet\Torrents\Black Sabbath-The Best of Black Sabbath(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\Black Sabbath-The Best of Black Sabbath(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\Blades.Of.Glory[2007]DvDrip.AC3[Eng]-aXXo.torrent
C:\Program Files\BitComet\Torrents\Blades.Of.Glory[2007]DvDrip.AC3[Eng]-aXXo.xml
C:\Program Files\BitComet\Torrents\Bleach 6th Op - Aqua Timez - Alones.mp3.torrent
C:\Program Files\BitComet\Torrents\Bleach 6th Op - Aqua Timez - Alones.mp3.xml
C:\Program Files\BitComet\Torrents\BON JOVI.torrent
C:\Program Files\BitComet\Torrents\BON JOVI.xml
C:\Program Files\BitComet\Torrents\BON JOVI_chat.xml
C:\Program Files\BitComet\Torrents\Boston - Greatest Hits.torrent
C:\Program Files\BitComet\Torrents\Boston - Greatest Hits.xml
C:\Program Files\BitComet\Torrents\Boys_Like_Girls-Boys_Like_Girls-(Advance)-2006-MP3.torrent
C:\Program Files\BitComet\Torrents\Boys_Like_Girls-Boys_Like_Girls-(Advance)-2006-MP3.xml
C:\Program Files\BitComet\Torrents\Breaking Benjamin - Phobia.torrent
C:\Program Files\BitComet\Torrents\Breaking Benjamin - Phobia.xml
C:\Program Files\BitComet\Torrents\Breaking Benjamin - Phobia_chat.xml
C:\Program Files\BitComet\Torrents\Bullet for My Valentine - The Poison (Limited Edition-Digipak) [2005][SLIPKNOT][www.emwreloaded.com].torrent
C:\Program Files\BitComet\Torrents\Bullet for My Valentine - The Poison (Limited Edition-Digipak) [2005][SLIPKNOT][www.emwreloaded.com].xml
C:\Program Files\BitComet\Torrents\Bullet for My Valentine - The Poison (Limited Edition-Digipak) [2005][SLIPKNOT][www.emwreloaded.com]_chat.xml
C:\Program Files\BitComet\Torrents\Cartel- Discography.torrent
C:\Program Files\BitComet\Torrents\Cartel- Discography.xml
C:\Program Files\BitComet\Torrents\Cartel- Discography_chat.xml
C:\Program Files\BitComet\Torrents\Cassie - Cassie (Advance 2006) - R&B By FEFE2003.rar.torrent
C:\Program Files\BitComet\Torrents\Cassie - Cassie (Advance 2006) - R&B By FEFE2003.rar.xml
C:\Program Files\BitComet\Torrents\Cassie - Cassie (Advance 2006) - R&B By FEFE2003.rar_chat.xml
C:\Program Files\BitComet\Torrents\Chamillionaire-The_Sound_Of_Revenge-2005-RNS.torrent
C:\Program Files\BitComet\Torrents\Chamillionaire-The_Sound_Of_Revenge-2005-RNS.xml
C:\Program Files\BitComet\Torrents\Chamillionaire-The_Sound_Of_Revenge-2005-RNS_chat.xml
C:\Program Files\BitComet\Torrents\Chamillionaire - Ultimate Victory (Retail 2007) - Rap.(www.lokotorrents.com).torrent
C:\Program Files\BitComet\Torrents\Chamillionaire - Ultimate Victory (Retail 2007) - Rap.(www.lokotorrents.com).xml
C:\Program Files\BitComet\Torrents\Chingy-Hoodstar-2006-The Pirate Bay-.torrent
C:\Program Files\BitComet\Torrents\Chingy-Hoodstar-2006-The Pirate Bay-.xml
C:\Program Files\BitComet\Torrents\Chingy-Hoodstar-2006-The Pirate Bay-_chat.xml
C:\Program Files\BitComet\Torrents\Chingy Hoodstar 2006.torrent
C:\Program Files\BitComet\Torrents\Chingy Hoodstar 2006.xml
C:\Program Files\BitComet\Torrents\Chingy Hoodstar 2006_chat.xml
C:\Program Files\BitComet\Torrents\Chiodos Bone Palace Ballet.torrent
C:\Program Files\BitComet\Torrents\Chiodos Bone Palace Ballet.xml
C:\Program Files\BitComet\Torrents\Chiodos.torrent
C:\Program Files\BitComet\Torrents\Chiodos.xml
C:\Program Files\BitComet\Torrents\Circa Survive - Juturna (2005).torrent
C:\Program Files\BitComet\Torrents\Circa Survive - Juturna (2005).xml
C:\Program Files\BitComet\Torrents\Circa Survive - On Letting Go.torrent
C:\Program Files\BitComet\Torrents\Circa Survive - On Letting Go.xml
C:\Program Files\BitComet\Torrents\Circa Survive - On Letting Go_chat.xml
C:\Program Files\BitComet\Torrents\Civil War.torrent
C:\Program Files\BitComet\Torrents\Civil War.xml
C:\Program Files\BitComet\Torrents\Cloverfield[2008]DvDrip[Eng]-FXG.torrent
C:\Program Files\BitComet\Torrents\Cloverfield[2008]DvDrip[Eng]-FXG.xml
C:\Program Files\BitComet\Torrents\Cobra Starship - While The City Sleeps, We Rule The Streets [2006].torrent
C:\Program Files\BitComet\Torrents\Cobra Starship - While The City Sleeps, We Rule The Streets [2006].xml
C:\Program Files\BitComet\Torrents\Coheed and Cambria - No World For Tomorrow [mp3-vrb-2007].torrent
C:\Program Files\BitComet\Torrents\Coheed and Cambria - No World For Tomorrow [mp3-vrb-2007].xml
C:\Program Files\BitComet\Torrents\Coheed_And_Cambria-Good_Apollo_I'm_Burning_Star_IV_Volume_One-2005-h8me.torrent
C:\Program Files\BitComet\Torrents\Coheed_And_Cambria-Good_Apollo_I'm_Burning_Star_IV_Volume_One-2005-h8me.xml
C:\Program Files\BitComet\Torrents\Comics 01-10-07.torrent
C:\Program Files\BitComet\Torrents\Comics 01-10-07.xml
C:\Program Files\BitComet\Torrents\Common - Finding Forever.torrent
C:\Program Files\BitComet\Torrents\Common - Finding Forever.xml
C:\Program Files\BitComet\Torrents\Constantine[2005]DvDRip[Eng]-BoBo.torrent
C:\Program Files\BitComet\Torrents\Constantine[2005]DvDRip[Eng]-BoBo.xml
C:\Program Files\BitComet\Torrents\Cute_Is_What_We_Aim_For-The_Same_Old_Blood_Rush_With_A_New_Touch-2006-MP3.torrent
C:\Program Files\BitComet\Torrents\Cute_Is_What_We_Aim_For-The_Same_Old_Blood_Rush_With_A_New_Touch-2006-MP3.xml
C:\Program Files\BitComet\Torrents\daft punk - discovery.torrent
C:\Program Files\BitComet\Torrents\daft punk - discovery.xml
C:\Program Files\BitComet\Torrents\DangerDoom_-_The_Mouse_And_The_Mask-2005-uTs.torrent
C:\Program Files\BitComet\Torrents\DangerDoom_-_The_Mouse_And_The_Mask-2005-uTs.xml
C:\Program Files\BitComet\Torrents\Danity Kane - Danity Kane.torrent
C:\Program Files\BitComet\Torrents\Danity Kane - Danity Kane.xml
C:\Program Files\BitComet\Torrents\Danity Kane - Danity Kane_chat.xml
C:\Program Files\BitComet\Torrents\Daphne Loves Derby - Good Night Witness Light.torrent
C:\Program Files\BitComet\Torrents\Daphne Loves Derby - Good Night Witness Light.xml
C:\Program Files\BitComet\Torrents\Daphne Loves Derby - On the Strength of All Convinced (2005).torrent
C:\Program Files\BitComet\Torrents\Daphne Loves Derby - On the Strength of All Convinced (2005).xml
C:\Program Files\BitComet\Torrents\Dark Horse Comics - Frank Miller's 300 (5-Issue Graphic Novel).torrent
C:\Program Files\BitComet\Torrents\Dark Horse Comics - Frank Miller's 300 (5-Issue Graphic Novel).xml
C:\Program Files\BitComet\Torrents\Death Cab For Cutie - Plans(StefWan-Team).torrent
C:\Program Files\BitComet\Torrents\Death Cab For Cutie - Plans(StefWan-Team).xml
C:\Program Files\BitComet\Torrents\Death Cab For Cutie - Plans(StefWan-Team)_chat.xml
C:\Program Files\BitComet\Torrents\Dir en grey - Agitated Screams of Maggots [2006.11.14].torrent
C:\Program Files\BitComet\Torrents\Dir en grey - Agitated Screams of Maggots [2006.11.14].xml
C:\Program Files\BitComet\Torrents\Dir en grey - Agitated Screams of Maggots [2006.11.14]_chat.xml
C:\Program Files\BitComet\Torrents\Dir en grey.torrent
C:\Program Files\BitComet\Torrents\Dir en grey.xml
C:\Program Files\BitComet\Torrents\Dir en grey_chat.xml
C:\Program Files\BitComet\Torrents\Disturbed.torrent
C:\Program Files\BitComet\Torrents\Disturbed.xml
C:\Program Files\BitComet\Torrents\Disturbed_chat.xml
C:\Program Files\BitComet\Torrents\Disturbia[2007]DvDrip[Eng]-aXXo.torrent
C:\Program Files\BitComet\Torrents\Disturbia[2007]DvDrip[Eng]-aXXo.xml
C:\Program Files\BitComet\Torrents\Disturbia[2007]DvDrip[Eng]-aXXo_chat.xml
C:\Program Files\BitComet\Torrents\Dropping_Daylight-Brace_Yourself-2006-tLOC.torrent
C:\Program Files\BitComet\Torrents\Dropping_Daylight-Brace_Yourself-2006-tLOC.xml
C:\Program Files\BitComet\Torrents\E-40-My_Ghetto_Report_Card-2006-CR.torrent
C:\Program Files\BitComet\Torrents\E-40-My_Ghetto_Report_Card-2006-CR.xml
C:\Program Files\BitComet\Torrents\E-40-My_Ghetto_Report_Card-2006-CR_chat.xml
C:\Program Files\BitComet\Torrents\emery-the_question-[WEBRIP]-DANCOR-2005.torrent
C:\Program Files\BitComet\Torrents\emery-the_question-[WEBRIP]-DANCOR-2005.xml
C:\Program Files\BitComet\Torrents\emery-the_question-[WEBRIP]-DANCOR-2005_chat.xml
C:\Program Files\BitComet\Torrents\Evanescence -The Open Door.torrent
C:\Program Files\BitComet\Torrents\Evanescence -The Open Door.xml
C:\Program Files\BitComet\Torrents\Evanescence -The Open Door_chat.xml
C:\Program Files\BitComet\Torrents\Fall Out Boy - From Under the Cork Tree.torrent
C:\Program Files\BitComet\Torrents\Fall Out Boy - From Under the Cork Tree.xml
C:\Program Files\BitComet\Torrents\Fall_Out_Boy-Infinity_On_High-2007-RNS.torrent
C:\Program Files\BitComet\Torrents\Fall_Out_Boy-Infinity_On_High-2007-RNS.xml
C:\Program Files\BitComet\Torrents\Fall_Out_Boy-Infinity_On_High-2007-RNS_chat.xml
C:\Program Files\BitComet\Torrents\Fear Before The March Of Flames.torrent
C:\Program Files\BitComet\Torrents\Fear Before The March Of Flames.xml
C:\Program Files\BitComet\Torrents\Fear Before The March Of Flames_chat.xml
C:\Program Files\BitComet\Torrents\Fearless.2006.WS.DVDRip.XviD.iNTERNAL.Eng.HardSub.[www.torrentfive.com].tor
rent
C:\Program Files\BitComet\Torrents\Fearless.2006.WS.DVDRip.XviD.iNTERNAL.Eng.HardSub.[www.torrentfive.com].xml
C:\Program Files\BitComet\Torrents\Fearless.2006.WS.DVDRip.XviD.iNTERNAL.Eng.HardSub.[www.xmlfive.com].xml
C:\Program Files\BitComet\Torrents\Fearless.2006.WS.DVDRip.XviD.iNTERNAL.Eng.HardSub.[www_chat.xmlfive.com]_ch
at.xml
C:\Program Files\BitComet\Torrents\Final Fantasy Soundtracks_chat.xml
C:\Program Files\BitComet\Torrents\Flyleaf - Flyleaf.torrent
C:\Program Files\BitComet\Torrents\Flyleaf - Flyleaf.xml
C:\Program Files\BitComet\Torrents\Foo_Fighters-In_Your_Honor-RETAIL-(2CD)-2005-h8me.torrent
C:\Program Files\BitComet\Torrents\Foo_Fighters-In_Your_Honor-RETAIL-(2CD)-2005-h8me.xml
C:\Program Files\BitComet\Torrents\Foo_Fighters-In_Your_Honor-RETAIL-(2CD)-2005-h8me_chat.xml
C:\Program Files\BitComet\Torrents\Found In The Flood.torrent
C:\Program Files\BitComet\Torrents\Found In The Flood.xml
C:\Program Files\BitComet\Torrents\Four Letter Lie.torrent
C:\Program Files\BitComet\Torrents\Four Letter Lie.xml
C:\Program Files\BitComet\Torrents\From Autumn To Ashes Discography (3 Albums).torrent
C:\Program Files\BitComet\Torrents\From Autumn To Ashes Discography (3 Albums).xml
C:\Program Files\BitComet\Torrents\FuneralForAFriend-Hours-2005.torrent
C:\Program Files\BitComet\Torrents\FuneralForAFriend-Hours-2005.xml
C:\Program Files\BitComet\Torrents\FuneralForAFriend-Hours-2005_chat.xml
C:\Program Files\BitComet\Torrents\Gackt [All Albums - 2005] (Visual Kei, J-Rock).torrent
C:\Program Files\BitComet\Torrents\Gackt [All Albums - 2005] (Visual Kei, J-Rock).xml
C:\Program Files\BitComet\Torrents\Gackt [All Albums - 2005] (Visual Kei, J-Rock)_chat.xml
C:\Program Files\BitComet\Torrents\Girls Gone Wild Triple Pack {College Girls 7} {On Campus} {Girl Power 9}.zip.torrent
C:\Program Files\BitComet\Torrents\Girls Gone Wild Triple Pack {College Girls 7} {On Campus} {Girl Power 9}.zip.xml
C:\Program Files\BitComet\Torrents\Girls Gone Wild Triple Pack {College Girls 7} {On Campus} {Girl Power 9}.zip_chat.xml
C:\Program Files\BitComet\Torrents\Gnarls Barkley - St Elsewhere (2006) By Colote.torrent
C:\Program Files\BitComet\Torrents\Gnarls Barkley - St Elsewhere (2006) By Colote.xml
C:\Program Files\BitComet\Torrents\Gnarls Barkley The Odd Couple DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Gnarls Barkley The Odd Couple DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\Guns n Roses - Appetite For Destruction (MFSL) (1987).torrent
C:\Program Files\BitComet\Torrents\Guns n Roses - Appetite For Destruction (MFSL) (1987).xml
C:\Program Files\BitComet\Torrents\Gym Class Heroes - As Cruel As School Children [2006][Hip Hop][www.newpct.com].torrent
C:\Program Files\BitComet\Torrents\Gym Class Heroes - As Cruel As School Children [2006][Hip Hop][www.newpct.com].xml
C:\Program Files\BitComet\Torrents\Gym Class Heroes - As Cruel As School Children [2006][Hip Hop][www.newpct.com]_chat.xml
C:\Program Files\BitComet\Torrents\H.I.M.torrent
C:\Program Files\BitComet\Torrents\H.I.M.xml
C:\Program Files\BitComet\Torrents\H.I.M_chat.xml
C:\Program Files\BitComet\Torrents\Haddaway.torrent
C:\Program Files\BitComet\Torrents\Haddaway.xml
C:\Program Files\BitComet\Torrents\Halifax-The_Inevitability_Of_A_Strange_World-2006-PMS.torrent
C:\Program Files\BitComet\Torrents\Halifax-The_Inevitability_Of_A_Strange_World-2006-PMS.xml
C:\Program Files\BitComet\Torrents\Harold & Kumar Go To White Castle [Extreme Unrated].torrent
C:\Program Files\BitComet\Torrents\Harold & Kumar Go To White Castle [Extreme Unrated].xml
C:\Program Files\BitComet\Torrents\Harold & Kumar Go To White Castle [Extreme Unrated]_chat.xml
C:\Program Files\BitComet\Torrents\Hawthorne_Heights-If_Only_You_Were_Lonely-(Advance)-2006-FNT.torrent
C:\Program Files\BitComet\Torrents\Hawthorne_Heights-If_Only_You_Were_Lonely-(Advance)-2006-FNT.xml
C:\Program Files\BitComet\Torrents\He Is Legend - Suck Out The Poison.torrent
C:\Program Files\BitComet\Torrents\He Is Legend - Suck Out The Poison.xml
C:\Program Files\BitComet\Torrents\Heroes Season 1 Complete-Xvid-MFG.torrent
C:\Program Files\BitComet\Torrents\Heroes Season 1 Complete-Xvid-MFG.xml
C:\Program Files\BitComet\Torrents\Heroine.torrent
C:\Program Files\BitComet\Torrents\Heroine.xml
C:\Program Files\BitComet\Torrents\Heroine_chat.xml
C:\Program Files\BitComet\Torrents\Hot Hot Heat-Make Up The Breakdown(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\Hot Hot Heat-Make Up The Breakdown(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\Hot Hot Heat -Elevator.torrent
C:\Program Files\BitComet\Torrents\Hot Hot Heat -Elevator.xml
C:\Program Files\BitComet\Torrents\I KILLED THE PROM QUEEN-MUSIC FOR THE RECENTLY DECEASED_FW81.torrent
C:\Program Files\BitComet\Torrents\I KILLED THE PROM QUEEN-MUSIC FOR THE RECENTLY DECEASED_FW81.xml
C:\Program Files\BitComet\Torrents\I_Am_Ghost-Lovers_Requiem XsXeX.torrent
C:\Program Files\BitComet\Torrents\I_Am_Ghost-Lovers_Requiem XsXeX.xml
C:\Program Files\BitComet\Torrents\j_dilla-the_shining-retail-2006-ftd.torrent
C:\Program Files\BitComet\Torrents\j_dilla-the_shining-retail-2006-ftd.xml
C:\Program Files\BitComet\Torrents\Jay-Z - Kingdom Come (2006) - Rap [www.torrentazos.com].rar.torrent
C:\Program Files\BitComet\Torrents\Jay-Z - Kingdom Come (2006) - Rap [www.xmlazos.com].rar.xml
C:\Program Files\BitComet\Torrents\Jay-Z - Kingdom Come (2006) - Rap [www_chat.xmlazos.com].rar_chat.xml
C:\Program Files\BitComet\Torrents\Jay Chou - Still Fantasy.torrent
C:\Program Files\BitComet\Torrents\Jay Chou - Still Fantasy.xml
C:\Program Files\BitComet\Torrents\Jay Chou - Still Fantasy_chat.xml
C:\Program Files\BitComet\Torrents\Jay Chou ??? - On The Run ???.torrent
C:\Program Files\BitComet\Torrents\Jay Chou ??? - On The Run ???.xml
C:\Program Files\BitComet\Torrents\Jedi Mind Tricks.-.Servants in Heaven Kings in Hell.-.2006.-.3astUpRoaR.torrent
C:\Program Files\BitComet\Torrents\Jedi Mind Tricks.-.Servants in Heaven Kings in Hell.-.2006.-.3astUpRoaR.xml
C:\Program Files\BitComet\Torrents\Jet Li - Unleashed (DVD-Rip) (AVI) (720x304) (1h37m26s) (Good Quality).avi.torrent
C:\Program Files\BitComet\Torrents\Jet Li - Unleashed (DVD-Rip) (AVI) (720x304) (1h37m26s) (Good Quality).avi.xml
C:\Program Files\BitComet\Torrents\Jimmy Eat World - Futures.torrent
C:\Program Files\BitComet\Torrents\Jimmy Eat World - Futures.xml
C:\Program Files\BitComet\Torrents\Jimmy_Eat_World-Chase_This_Light-(Real_Proper)-2007-JiMMYEATWORLD.torrent
C:\Program Files\BitComet\Torrents\Jimmy_Eat_World-Chase_This_Light-(Real_Proper)-2007-JiMMYEATWORLD.xml
C:\Program Files\BitComet\Torrents\Jin-Presents_The_Emcees_Properganda-2005-JET.torrent
C:\Program Files\BitComet\Torrents\Jin-Presents_The_Emcees_Properganda-2005-JET.xml
C:\Program Files\BitComet\Torrents\Jin-The_Rest_Is_History-2004-h8me.torrent
C:\Program Files\BitComet\Torrents\Jin-The_Rest_Is_History-2004-h8me.xml
C:\Program Files\BitComet\Torrents\Judas Priest Metal Works 73-93[www.pctrecords.com].torrent
C:\Program Files\BitComet\Torrents\Judas Priest Metal Works 73-93[www.pctrecords.com].xml
C:\Program Files\BitComet\Torrents\Jurassic 5 - Feedback.torrent
C:\Program Files\BitComet\Torrents\Jurassic 5 - Feedback.xml
C:\Program Files\BitComet\Torrents\Justin Timberlake - FutureSex-LoveSounds.torrent
C:\Program Files\BitComet\Torrents\Justin Timberlake - FutureSex-LoveSounds.xml
C:\Program Files\BitComet\Torrents\Justin Timberlake - FutureSex-LoveSounds_chat.xml
C:\Program Files\BitComet\Torrents\Kanye West - Graduation (320Kbps).torrent
C:\Program Files\BitComet\Torrents\Kanye West - Graduation (320Kbps).xml
C:\Program Files\BitComet\Torrents\Kanye_West-Late_Registration-2005-RNS.torrent
C:\Program Files\BitComet\Torrents\Kanye_West-Late_Registration-2005-RNS.xml
C:\Program Files\BitComet\Torrents\Kanye_West-Late_Registration-2005-RNS_chat.xml
C:\Program Files\BitComet\Torrents\Kill Hannah - Until Theres Nothing Left Of Us.torrent
C:\Program Files\BitComet\Torrents\Kill Hannah - Until Theres Nothing Left Of Us.xml
C:\Program Files\BitComet\Torrents\Killswitch Engage - As Daylight Dies [2006].torrent
C:\Program Files\BitComet\Torrents\Killswitch Engage - As Daylight Dies [2006].xml
C:\Program Files\BitComet\Torrents\Killswitch Engage - As Daylight Dies [2006]_chat.xml
C:\Program Files\BitComet\Torrents\KISS - The Very Best Of Kiss.torrent
C:\Program Files\BitComet\Torrents\KISS - The Very Best Of Kiss.xml
C:\Program Files\BitComet\Torrents\Kutless Collection - including new CD.torrent
C:\Program Files\BitComet\Torrents\Kutless Collection - including new CD.xml
C:\Program Files\BitComet\Torrents\L'Arc~en~Ciel - AWAKE.torrent
C:\Program Files\BitComet\Torrents\L'Arc~en~Ciel - AWAKE.xml
C:\Program Files\BitComet\Torrents\L'Arc~en~Ciel - KISS (320kbps).torrent
C:\Program Files\BitComet\Torrents\L'Arc~en~Ciel - KISS (320kbps).xml
C:\Program Files\BitComet\Torrents\L.Arc.En.Ciel.torrent
C:\Program Files\BitComet\Torrents\L.Arc.En.Ciel.xml
C:\Program Files\BitComet\Torrents\Led Zeppelin-Early Days And Latter Days(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\Led Zeppelin-Early Days And Latter Days(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\Led Zeppelin - Mothership - 2CD (Best Of).torrent
C:\Program Files\BitComet\Torrents\Led Zeppelin - Mothership - 2CD (Best Of).xml
C:\Program Files\BitComet\Torrents\Lil Wayne - Tha Carter III (Explicit)(2008).torrent
C:\Program Files\BitComet\Torrents\Lil Wayne - Tha Carter III (Explicit)(2008).xml
C:\Program Files\BitComet\Torrents\Linkin Park - Minutes to Midnight 320kbps.torrent
C:\Program Files\BitComet\Torrents\Linkin Park - Minutes to Midnight 320kbps.xml
C:\Program Files\BitComet\Torrents\Linkin Park - Minutes to Midnight 320kbps_chat.xml
C:\Program Files\BitComet\Torrents\Lost Prophets-Liberation Transmission(f+bcovers) a DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Lost Prophets-Liberation Transmission(f+bcovers) a DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\Lost Prophets-Liberation Transmission(f+bcovers) a DHZ.Inc Release_chat.xml
C:\Program Files\BitComet\Torrents\Lost Prophets - Start Something.torrent
C:\Program Files\BitComet\Torrents\Lost Prophets - Start Something.xml
C:\Program Files\BitComet\Torrents\Ludacris - Release Therapy.torrent
C:\Program Files\BitComet\Torrents\Ludacris - Release Therapy.xml
C:\Program Files\BitComet\Torrents\Ludacris - Release Therapy_chat.xml
C:\Program Files\BitComet\Torrents\Lupe Fiasco - Lupe Fiasco's Food & Liquor [2006].torrent
C:\Program Files\BitComet\Torrents\Lupe Fiasco - Lupe Fiasco's Food & Liquor [2006].xml
C:\Program Files\BitComet\Torrents\Lupe Fiasco - The Cool (Retail 2007) [Mp3][www.zonatorrent.com].rar.torrent
C:\Program Files\BitComet\Torrents\Lupe Fiasco - The Cool (Retail 2007) [Mp3][www.zonatorrent.com].rar.xml
C:\Program Files\BitComet\Torrents\Lynyrd Skynyrd - All Time Greatest Hits (MP3@320Kbps).torrent
C:\Program Files\BitComet\Torrents\Lynyrd Skynyrd - All Time Greatest Hits (MP3@320Kbps).xml
C:\Program Files\BitComet\Torrents\Madvillain.torrent
C:\Program Files\BitComet\Torrents\Madvillain.xml
C:\Program Files\BitComet\Torrents\Marilyn Manson-Eat Me Drink Me[www.torrentspain.com].torrent
C:\Program Files\BitComet\Torrents\Marilyn Manson-Eat Me Drink Me[www.xmlspain.com].xml
C:\Program Files\BitComet\Torrents\Marilyn_Manson-Lest_We_Forget-(Retail)-2004-HHI.torrent
C:\Program Files\BitComet\Torrents\Marilyn_Manson-Lest_We_Forget-(Retail)-2004-HHI.xml
C:\Program Files\BitComet\Torrents\Marilyn_Manson-Lest_We_Forget-(Retail)-2004-HHI_chat.xml
C:\Program Files\BitComet\Torrents\Matchbook_Romance-Voices-2006-RTB.torrent
C:\Program Files\BitComet\Torrents\Matchbook_Romance-Voices-2006-RTB.xml
C:\Program Files\BitComet\Torrents\Matchbook_Romance-Voices-2006-RTB_chat.xml
C:\Program Files\BitComet\Torrents\Meg_&_Dia_-_Something_Real_[2006].torrent
C:\Program Files\BitComet\Torrents\Meg_&_Dia_-_Something_Real_[2006].xml
C:\Program Files\BitComet\Torrents\Messiah CompleX.torrent
C:\Program Files\BitComet\Torrents\Messiah CompleX.xml
C:\Program Files\BitComet\Torrents\Michael Jackson - Thriller [Solly4Life].mpg.torrent
C:\Program Files\BitComet\Torrents\Michael Jackson - Thriller [Solly4Life].mpg.xml
C:\Program Files\BitComet\Torrents\Michael Jackson - Thriller [Solly4Life].mpg_chat.xml
C:\Program Files\BitComet\Torrents\Michael Jackson ~ Definitive Collection (2006).torrent
C:\Program Files\BitComet\Torrents\Michael Jackson ~ Definitive Collection (2006).xml
C:\Program Files\BitComet\Torrents\Michael Jackson ~ Definitive Collection (2006)_chat.xml
C:\Program Files\BitComet\Torrents\Mindless Self Indulgence.torrent
C:\Program Files\BitComet\Torrents\Mindless Self Indulgence.xml
C:\Program Files\BitComet\Torrents\Mindless Self Indulgence_chat.xml
C:\Program Files\BitComet\Torrents\Mindless_Self_Indulgence-Youll_Rebel_To_Anything-(MET367)-Vinyl-2005-MTD.torrent
C:\Program Files\BitComet\Torrents\Mindless_Self_Indulgence-Youll_Rebel_To_Anything-(MET367)-Vinyl-2005-MTD.xml
C:\Program Files\BitComet\Torrents\MissyElliott-TheCookbook-2005.torrent
C:\Program Files\BitComet\Torrents\MissyElliott-TheCookbook-2005.xml
C:\Program Files\BitComet\Torrents\MissyElliott-TheCookbook-2005_chat.xml
C:\Program Files\BitComet\Torrents\Moero Nekketsu Rhythm Damashii Osu Tatakae Ouendan 2 OST.torrent
C:\Program Files\BitComet\Torrents\Moero Nekketsu Rhythm Damashii Osu Tatakae Ouendan 2 OST.xml
C:\Program Files\BitComet\Torrents\Motion_City_Soundtrack-Commit_This_To_Memory (2005).torrent
C:\Program Files\BitComet\Torrents\Motion_City_Soundtrack-Commit_This_To_Memory (2005).xml
C:\Program Files\BitComet\Torrents\Motion_City_Soundtrack-Commit_This_To_Memory (2005)_chat.xml
C:\Program Files\BitComet\Torrents\Muse-Black_Holes_and_Revelations-Retail-2006-JRP.torrent
C:\Program Files\BitComet\Torrents\Muse-Black_Holes_and_Revelations-Retail-2006-JRP.xml
C:\Program Files\BitComet\Torrents\My Chemical Romance-Three Cheers For Sweet Revenge(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\My Chemical Romance-Three Cheers For Sweet Revenge(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\My Chemical Romance-Three Cheers For Sweet Revenge(Darkside_RG)_chat.xml
C:\Program Files\BitComet\Torrents\My_Chemical_Romance_-_Welcome_to_the_Black_Parade-Promo-2006-RCD.torrent
C:\Program Files\BitComet\Torrents\My_Chemical_Romance_-_Welcome_to_the_Black_Parade-Promo-2006-RCD.xml
C:\Program Files\BitComet\Torrents\Nas-Greatest_Hits-Advance-2007-UKP.torrent
C:\Program Files\BitComet\Torrents\Nas-Greatest_Hits-Advance-2007-UKP.xml
C:\Program Files\BitComet\Torrents\Nas-Untitled[Nigger]-(Retail_Explicit_08)-FozzyBear.torrent
C:\Program Files\BitComet\Torrents\Nas-Untitled[Nigger]-(Retail_Explicit_08)-FozzyBear.xml
C:\Program Files\BitComet\Torrents\National.Treasure.2-Book.Of.Secrets[2007]DvDrip[Eng]-aXXo.torrent
C:\Program Files\BitComet\Torrents\National.Treasure.2-Book.Of.Secrets[2007]DvDrip[Eng]-aXXo.xml
C:\Program Files\BitComet\Torrents\Ne-Yo - In My Own Words [2006].torrent
C:\Program Files\BitComet\Torrents\Ne-Yo - In My Own Words [2006].xml
C:\Program Files\BitComet\Torrents\Ne-Yo - In My Own Words [2006]_chat.xml
C:\Program Files\BitComet\Torrents\Never Take Friendship Personal.torrent
C:\Program Files\BitComet\Torrents\Never Take Friendship Personal.xml
C:\Program Files\BitComet\Torrents\Nirvana - Discography.torrent
C:\Program Files\BitComet\Torrents\Nirvana - Discography.xml
C:\Program Files\BitComet\Torrents\Nirvana - Discography_chat.xml
C:\Program Files\BitComet\Torrents\Norma Jean - Redeemer.torrent
C:\Program Files\BitComet\Torrents\Norma Jean - Redeemer.xml
C:\Program Files\BitComet\Torrents\Nujabes.torrent
C:\Program Files\BitComet\Torrents\Nujabes.xml
C:\Program Files\BitComet\Torrents\OK Go.torrent
C:\Program Files\BitComet\Torrents\OK Go_chat.xml
C:\Program Files\BitComet\Torrents\Orange Range.torrent
C:\Program Files\BitComet\Torrents\Orange Range.xml
C:\Program Files\BitComet\Torrents\Orange Range_chat.xml
C:\Program Files\BitComet\Torrents\OST_Osu__Tatakae__Ouendan_.rar.torrent
C:\Program Files\BitComet\Torrents\OST_Osu__Tatakae__Ouendan_.rar.xml
C:\Program Files\BitComet\Torrents\Panic At The Disco-A Fever You Cant Sweat Out(with covers) a DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Panic At The Disco-A Fever You Cant Sweat Out(with covers) a DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\Panic At The Disco-A Fever You Cant Sweat Out(with covers) a DHZ.Inc Release_chat.xml
C:\Program Files\BitComet\Torrents\Paramore - CD, EP, Videos.torrent
C:\Program Files\BitComet\Torrents\Paramore - CD, EP, Videos.xml
C:\Program Files\BitComet\Torrents\PerfectWorld(ENG)_FullClientv126.torrent
C:\Program Files\BitComet\Torrents\PerfectWorld(ENG)_FullClientv126.xml
C:\Program Files\BitComet\Torrents\Pink Floyd-Dark Side of the Moon (Remastered)(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\Pink Floyd-Dark Side of the Moon (Remastered)(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\Pink Floyd-Dark Side of the Moon (Remastered)(Darkside_RG)_chat.xml
C:\Program Files\BitComet\Torrents\Pink Floyd-Wish You Were Here(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\Pink Floyd-Wish You Were Here(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\Pink Floyd - 1979 - The Wall.torrent
C:\Program Files\BitComet\Torrents\Pink Floyd - 1979 - The Wall.xml
C:\Program Files\BitComet\Torrents\Pirates of the Caribbean - The Curse of the Black Pearl [2003][DVDRip][H.264].torrent
C:\Program Files\BitComet\Torrents\Pirates of the Caribbean - The Curse of the Black Pearl [2003][DVDRip][H.264].xml
C:\Program Files\BitComet\Torrents\Plain White Ts-Every Second Counts - 2006.torrent
C:\Program Files\BitComet\Torrents\Plain White Ts-Every Second Counts - 2006.xml
C:\Program Files\BitComet\Torrents\Plain White Ts-Every Second Counts - 2006_chat.xml
C:\Program Files\BitComet\Torrents\Pussycat Dolls - PCD.torrent
C:\Program Files\BitComet\Torrents\Pussycat Dolls - PCD.xml
C:\Program Files\BitComet\Torrents\Pussycat Dolls - PCD_chat.xml
C:\Program Files\BitComet\Torrents\Quasimoto - The Further Adventures Of Lord Quas.torrent
C:\Program Files\BitComet\Torrents\Quasimoto - The Further Adventures Of Lord Quas.xml
C:\Program Files\BitComet\Torrents\Queen - The Platinum Collection Greatest Hits I, II & III (3CD)widgetzone.co.uk.torrent
C:\Program Files\BitComet\Torrents\Queen - The Platinum Collection Greatest Hits I, II & III (3CD)widgetzone.co.uk.xml
C:\Program Files\BitComet\Torrents\Ramones.torrent
C:\Program Files\BitComet\Torrents\Ramones.xml
C:\Program Files\BitComet\Torrents\Ramones_chat.xml
C:\Program Files\BitComet\Torrents\Red Hot Chili Peppers - 1991 - Blood Sugar Sex Magik.torrent
C:\Program Files\BitComet\Torrents\Red Hot Chili Peppers - 1991 - Blood Sugar Sex Magik.xml
C:\Program Files\BitComet\Torrents\Red Hot Chili Peppers.torrent
C:\Program Files\BitComet\Torrents\Red Hot Chili Peppers.xml
C:\Program Files\BitComet\Torrents\Red Hot Chili Peppers_chat.xml
C:\Program Files\BitComet\Torrents\Red Hot Chilli Peppers - Stadium Arcadium (with Covers) a DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Red Hot Chilli Peppers - Stadium Arcadium (with Covers) a DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\Red Hot Chilli Peppers - Stadium Arcadium (with Covers) a DHZ.Inc Release_chat.xml
C:\Program Files\BitComet\Torrents\Red Jumpsuit Apparatus.torrent
C:\Program Files\BitComet\Torrents\Red Jumpsuit Apparatus.xml
C:\Program Files\BitComet\Torrents\Red Jumpsuit Apparatus_chat.xml
C:\Program Files\BitComet\Torrents\Relient K - Five Score And Seven Years Ago-2007.torrent
C:\Program Files\BitComet\Torrents\Relient K - Five Score And Seven Years Ago-2007.xml
C:\Program Files\BitComet\Torrents\Relient K - Five Score And Seven Years Ago-2007_chat.xml
C:\Program Files\BitComet\Torrents\Riot! (2007).torrent
C:\Program Files\BitComet\Torrents\Riot! (2007).xml
C:\Program Files\BitComet\Torrents\Riot! (2007)_chat.xml
C:\Program Files\BitComet\Torrents\Rise_Against-The_Sufferer_And_The_Witness-(Unmastered_Advance)-2006-tLOC.torrent
C:\Program Files\BitComet\Torrents\Rise_Against-The_Sufferer_And_The_Witness-(Unmastered_Advance)-2006-tLOC.xml
C:\Program Files\BitComet\Torrents\Rolling Stones-Forty Licks(withcovers) a DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Rolling Stones-Forty Licks(withcovers) a DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\Rolling Stones-Forty Licks(withcovers) a DHZ.Inc Release_chat.xml
C:\Program Files\BitComet\Torrents\Run_Kid_Run-This_is_Who_We_Are-2006-MP3.torrent
C:\Program Files\BitComet\Torrents\Run_Kid_Run-This_is_Who_We_Are-2006-MP3.xml
C:\Program Files\BitComet\Torrents\Saosin-Saosin-2006-MP3.torrent
C:\Program Files\BitComet\Torrents\Saosin-Saosin-2006-MP3.xml
C:\Program Files\BitComet\Torrents\Saosin-Saosin-2006-MP3_chat.xml
C:\Program Files\BitComet\Torrents\Saosin.torrent
C:\Program Files\BitComet\Torrents\Saosin.xml
C:\Program Files\BitComet\Torrents\Scary_Kids_Scaring_Kids-Scary_Kids_Scaring_Kids-2007-RTB.torrent
C:\Program Files\BitComet\Torrents\Scary_Kids_Scaring_Kids-Scary_Kids_Scaring_Kids-2007-RTB.xml
C:\Program Files\BitComet\Torrents\Self Against City - Take It How You Want It.torrent
C:\Program Files\BitComet\Torrents\Self Against City - Take It How You Want It.xml
C:\Program Files\BitComet\Torrents\Semi-Pro[2008]DvDrip.AC3-aXXo.torrent
C:\Program Files\BitComet\Torrents\Semi-Pro[2008]DvDrip.AC3-aXXo.xml
C:\Program Files\BitComet\Torrents\Senses_Fail-Let_It_Enfold_You-(Reissue)-2005-RTB.torrent
C:\Program Files\BitComet\Torrents\Senses_Fail-Let_It_Enfold_You-(Reissue)-2005-RTB.xml
C:\Program Files\BitComet\Torrents\Senses_Fail-Let_It_Enfold_You-(Reissue)-2005-RTB_chat.xml
C:\Program Files\BitComet\Torrents\Senses_Fail-Still_Searching-2006-h8me.rar.torrent
C:\Program Files\BitComet\Torrents\Senses_Fail-Still_Searching-2006-h8me.rar.xml
C:\Program Files\BitComet\Torrents\Sex is Zero [Miyuki-Fansubs&Korean-Movies].torrent
C:\Program Files\BitComet\Torrents\Sex is Zero [Miyuki-Fansubs&Korean-Movies].xml
C:\Program Files\BitComet\Torrents\SexyBeach.3.inc.all.Expansions[English.Version]-nVa.rar.torrent
C:\Program Files\BitComet\Torrents\SexyBeach.3.inc.all.Expansions[English.Version]-nVa.rar.xml
C:\Program Files\BitComet\Torrents\Silverstein- When Broken Is Easily Fixed_(drisc).torrent
C:\Program Files\BitComet\Torrents\Silverstein- When Broken Is Easily Fixed_(drisc).xml
C:\Program Files\BitComet\Torrents\Silverstein-Arrivals_And_Departures-(Advance)-2007-FNT.torrent
C:\Program Files\BitComet\Torrents\Silverstein-Arrivals_And_Departures-(Advance)-2007-FNT.xml
C:\Program Files\BitComet\Torrents\Silverstein-Arrivals_And_Departures-(Advance)-2007-FNT_chat.xml
C:\Program Files\BitComet\Torrents\Silverstein-Discovering_The_Waterfront-(UK_Retail)-2006-uF.torrent
C:\Program Files\BitComet\Torrents\Silverstein-Discovering_The_Waterfront-(UK_Retail)-2006-uF.xml
C:\Program Files\BitComet\Torrents\Silverstein-Discovering_The_Waterfront-(UK_Retail)-2006-uF_chat.xml
C:\Program Files\BitComet\Torrents\Slayer - Christ Illusion.torrent
C:\Program Files\BitComet\Torrents\Slayer - Christ Illusion.xml
C:\Program Files\BitComet\Torrents\Slayer - Christ Illusion_chat.xml
C:\Program Files\BitComet\Torrents\Snow_Patrol-Eyes_Open-2006-FM.torrent
C:\Program Files\BitComet\Torrents\Snow_Patrol-Eyes_Open-2006-FM.xml
C:\Program Files\BitComet\Torrents\Snow_Patrol-Eyes_Open-2006-FM_chat.xml
C:\Program Files\BitComet\Torrents\Soulja_Boy-Souljaboytellem.Com-(RapGodFathers.com).torrent
C:\Program Files\BitComet\Torrents\Soulja_Boy-Souljaboytellem.Com-(RapGodFathers.com).xml
C:\Program Files\BitComet\Torrents\Spitalfield-Better_Than_Knowing_Where_You_Are-2006- XsXeX.torrent
C:\Program Files\BitComet\Torrents\Spitalfield-Better_Than_Knowing_Where_You_Are-2006- XsXeX.xml
C:\Program Files\BitComet\Torrents\Spitalfield-Better_Than_Knowing_Where_You_Are-2006- XsXeX_chat.xml
C:\Program Files\BitComet\Torrents\Step Up (Advance 2006) - Soundtrack By FEFE2003.rar.torrent
C:\Program Files\BitComet\Torrents\Step Up (Advance 2006) - Soundtrack By FEFE2003.rar.xml
C:\Program Files\BitComet\Torrents\Step Up (Advance 2006) - Soundtrack By FEFE2003.rar_chat.xml
C:\Program Files\BitComet\Torrents\Strata - Presents The End Of The World (Advance) - 2007.torrent
C:\Program Files\BitComet\Torrents\Strata - Presents The End Of The World (Advance) - 2007.xml
C:\Program Files\BitComet\Torrents\Sugarcult-Lights_Out-(RETAIL)-2006-h8me.rar.torrent
C:\Program Files\BitComet\Torrents\Sugarcult-Lights_Out-(RETAIL)-2006-h8me.rar.xml
C:\Program Files\BitComet\Torrents\System Of A Down - Hypnotize.rar.torrent
C:\Program Files\BitComet\Torrents\System Of A Down - Hypnotize.rar.xml
C:\Program Files\BitComet\Torrents\System Of A Down - Hypnotize.rar_chat.xml
C:\Program Files\BitComet\Torrents\T.I. - King.torrent
C:\Program Files\BitComet\Torrents\T.I. - King.xml
C:\Program Files\BitComet\Torrents\T.I. - King_chat.xml
C:\Program Files\BitComet\Torrents\T.I.VS. T.I.P…(320 KBPS).torrent
C:\Program Files\BitComet\Torrents\T.I.VS. T.I.P…(320 KBPS).xml
C:\Program Files\BitComet\Torrents\T.M.Revolution.torrent
C:\Program Files\BitComet\Torrents\T.M.Revolution.xml
C:\Program Files\BitComet\Torrents\Taking_Back_Sunday-Louder_Now-2006-JUST.torrent
C:\Program Files\BitComet\Torrents\Taking_Back_Sunday-Louder_Now-2006-JUST.xml
C:\Program Files\BitComet\Torrents\Taking_Back_Sunday-Louder_Now-2006-JUST_chat.xml
C:\Program Files\BitComet\Torrents\Talib Kweli-Ear Drum (Kingdom Music by Jade).torrent
C:\Program Files\BitComet\Torrents\Talib Kweli-Ear Drum (Kingdom Music by Jade).xml
C:\Program Files\BitComet\Torrents\Telling Secrets To Strangers.torrent
C:\Program Files\BitComet\Torrents\Telling Secrets To Strangers.xml
C:\Program Files\BitComet\Torrents\Tenacious D-The Pick Of Destiny(withcovers) A DHZ.Inc Release.torrent
C:\Program Files\BitComet\Torrents\Tenacious D-The Pick Of Destiny(withcovers) A DHZ.Inc Release.xml
C:\Program Files\BitComet\Torrents\The Academy Is… - Almost Here.torrent
C:\Program Files\BitComet\Torrents\The Academy Is… - Almost Here.xml
C:\Program Files\BitComet\Torrents\The Academy Is… - Santi.torrent
C:\Program Files\BitComet\Torrents\The Academy Is… - Santi.xml
C:\Program Files\BitComet\Torrents\The All American Rejects - Move Along.torrent
C:\Program Files\BitComet\Torrents\The All American Rejects - Move Along.xml
C:\Program Files\BitComet\Torrents\The Beatles.torrent
C:\Program Files\BitComet\Torrents\The Beatles.xml
C:\Program Files\BitComet\Torrents\The Beatles_chat.xml
C:\Program Files\BitComet\Torrents\The City Sleeps In Flames.torrent
C:\Program Files\BitComet\Torrents\The City Sleeps In Flames.xml
C:\Program Files\BitComet\Torrents\The Classic Crime - Albatross.torrent
C:\Program Files\BitComet\Torrents\The Classic Crime - Albatross.xml
C:\Program Files\BitComet\Torrents\The Devil and God are Raging Inside Me.torrent
C:\Program Files\BitComet\Torrents\The Devil and God are Raging Inside Me.xml
C:\Program Files\BitComet\Torrents\The Distillers Discography 3 albums.torrent
C:\Program Files\BitComet\Torrents\The Distillers Discography 3 albums.xml
C:\Program Files\BitComet\Torrents\The Distillers Discography 3 albums_chat.xml
C:\Program Files\BitComet\Torrents\The Fray - How To Save A Life.torrent
C:\Program Files\BitComet\Torrents\The Fray - How To Save A Life.xml
C:\Program Files\BitComet\Torrents\The Fray - How To Save A Life_chat.xml
C:\Program Files\BitComet\Torrents\The Killers - Sams Town [2006][CD+SkidVid+Cov].torrent
C:\Program Files\BitComet\Torrents\The Killers - Sams Town [2006][CD+SkidVid+Cov].xml
C:\Program Files\BitComet\Torrents\The Killers - Sams Town [2006][CD+SkidVid+Cov]_chat.xml
C:\Program Files\BitComet\Torrents\The Killers Sawdust 2007(mrsparkler).torrent
C:\Program Files\BitComet\Torrents\The Killers Sawdust 2007(mrsparkler).xml
C:\Program Files\BitComet\Torrents\The Postal Service - Give Up.torrent
C:\Program Files\BitComet\Torrents\The Postal Service - Give Up.xml
C:\Program Files\BitComet\Torrents\The Red Jumpsuit Apparatus - Don't You Fake It.torrent
C:\Program Files\BitComet\Torrents\The Red Jumpsuit Apparatus - Don't You Fake It.xml
C:\Program Files\BitComet\Torrents\The Roots - Rising Down [2008].torrent
C:\Program Files\BitComet\Torrents\The Roots - Rising Down [2008].xml
C:\Program Files\BitComet\Torrents\The Shins - Wincing the Night Away 2007.torrent
C:\Program Files\BitComet\Torrents\The Shins - Wincing the Night Away 2007.xml
C:\Program Files\BitComet\Torrents\The Shins - Wincing the Night Away 2007_chat.xml
C:\Program Files\BitComet\Torrents\The Sounds - Dying To Say This To You (2006) - Pop By www.torrentcity.com.torrent
C:\Program Files\BitComet\Torrents\The Sounds - Dying To Say This To You (2006) - Pop By www.xmlcity.com.xml
C:\Program Files\BitComet\Torrents\The World Ends With You OST.torrent
C:\Program Files\BitComet\Torrents\The World Ends With You OST.xml
C:\Program Files\BitComet\Torrents\The_Killers-Hot_Fuss_(Limited_Edition)-2005-XXL.torrent
C:\Program Files\BitComet\Torrents\The_Killers-Hot_Fuss_(Limited_Edition)-2005-XXL.xml
C:\Program Files\BitComet\Torrents\The_Killers-Hot_Fuss_(Limited_Edition)-2005-XXL_chat.xml
C:\Program Files\BitComet\Torrents\The_Summer_Obsession-This_Is_Where_You_Belong-(Retail)-2006-RTB.torrent
C:\Program Files\BitComet\Torrents\The_Summer_Obsession-This_Is_Where_You_Belong-(Retail)-2006-RTB.xml
C:\Program Files\BitComet\Torrents\The_Summer_Obsession-This_Is_Where_You_Belong-(Retail)-2006-RTB_chat.xml
C:\Program Files\BitComet\Torrents\The_Used-In_Love_And_Death-(Retail)-(READ_NFO)-2004-KzT.torrent
C:\Program Files\BitComet\Torrents\The_Used-In_Love_And_Death-(Retail)-(READ_NFO)-2004-KzT.xml
C:\Program Files\BitComet\Torrents\The_Used-Lies_For_The_Liars-2007-FNT.torrent
C:\Program Files\BitComet\Torrents\The_Used-Lies_For_The_Liars-2007-FNT.xml
C:\Program Files\BitComet\Torrents\The_Used-Lies_For_The_Liars-2007-FNT_chat.xml
C:\Program Files\BitComet\Torrents\Three Days Grace - OneX.torrent
C:\Program Files\BitComet\Torrents\Three Days Grace - OneX.xml
C:\Program Files\BitComet\Torrents\Three Days Grace - OneX_chat.xml
C:\Program Files\BitComet\Torrents\Three_6_Mafia-Most_Known_Unknown-(Reissue)-2006-RNS.torrent
C:\Program Files\BitComet\Torrents\Three_6_Mafia-Most_Known_Unknown-(Reissue)-2006-RNS.xml
C:\Program Files\BitComet\Torrents\Three_6_Mafia-Most_Known_Unknown-(Reissue)-2006-RNS_chat.xml
C:\Program Files\BitComet\Torrents\Thrice-The Artist In The Ambulance(Darkside_RG).torrent
C:\Program Files\BitComet\Torrents\Thrice-The Artist In The Ambulance(Darkside_RG).xml
C:\Program Files\BitComet\Torrents\Thrice - Vheissu.torrent
C:\Program Files\BitComet\Torrents\Thrice - Vheissu.xml
C:\Program Files\BitComet\Torrents\Thursday-A_City_By_The_Light_Divided-(Advance)-2006-uNi.torrent
C:\Program Files\BitComet\Torrents\Thursday-A_City_By_The_Light_Divided-(Advance)-2006-uNi.xml
C:\Program Files\BitComet\Torrents\Tim Armstrong - A Poet's Life [2007].torrent
C:\Program Files\BitComet\Torrents\Tim Armstrong - A Poet's Life [2007].xml
C:\Program Files\BitComet\Torrents\Transformers CaM XViD-THS(2007)(KvCD by Kingben666).torrent
C:\Program Files\BitComet\Torrents\Transformers CaM XViD-THS(2007)(KvCD by Kingben666).xml
C:\Program Files\BitComet\Torrents\Transformers Office Movie Prequel & Adaptation (Complete).torrent
C:\Program Files\BitComet\Torrents\Transformers Office Movie Prequel & Adaptation (Complete).xml
C:\Program Files\BitComet\Torrents\Transformers[2007]DvDrip[Eng]-aXXo.torrent
C:\Program Files\BitComet\Torrents\Transformers[2007]DvDrip[Eng]-aXXo.xml
C:\Program Files\BitComet\Torrents\Uncanny X-Men 494 (Both Covers) (2008) (Steam-DCP).cbr.torrent
C:\Program Files\BitComet\Torrents\Uncanny X-Men 494 (Both Covers) (2008) (Steam-DCP).cbr.xml
C:\Program Files\BitComet\Torrents\Underoath-Act_Of_Depression-1999-hXc.torrent
C:\Program Files\BitComet\Torrents\Underoath-Act_Of_Depression-1999-hXc.xml
C:\Program Files\BitComet\Torrents\VA - Snakes On A Plane The Album OST - BWR.torrent
C:\Program Files\BitComet\Torrents\VA - Snakes On A Plane The Album OST - BWR.xml
C:\Program Files\BitComet\Torrents\VA - Snakes On A Plane The Album OST - BWR_chat.xml
C:\Program Files\BitComet\Torrents\VA - The Fast And The Furious - Tokyo Drift - OST [2006][Soundtrack][www bitmp3 com].torrent
C:\Program Files\BitComet\Torrents\VA - The Fast And The Furious - Tokyo Drift - OST [2006][Soundtrack][www bitmp3 com].xml
C:\Program Files\BitComet\Torrents\Watchmen.torrent
C:\Program Files\BitComet\Torrents\Watchmen.xml
C:\Program Files\BitComet\Torrents\We Are Pilots.torrent
C:\Program Files\BitComet\Torrents\We Are Pilots.xml
C:\Program Files\BitComet\Torrents\We Were Dead Before the Ship Even Sank (2007).torrent
C:\Program Files\BitComet\Torrents\We Were Dead Before the Ship Even Sank (2007).xml
C:\Program Files\BitComet\Torrents\Where You Want To Be.torrent
C:\Program Files\BitComet\Torrents\Where You Want To Be.xml
C:\Program Files\BitComet\Torrents\Where You Want To Be_chat.xml
C:\Program Files\BitComet\Torrents\www.deluxeBits.to…My_Chemical_Romance-The_Black_Parade-2006-RNS.torrent
C:\Program Files\BitComet\Torrents\www.deluxeBits.to…My_Chemical_Romance-The_Black_Parade-2006-RNS.xml
C:\Program Files\BitComet\Torrents\www.deluxeBits.to…My_Chemical_Romance-The_Black_Parade-2006-RNS_chat.xml
C:\Program Files\BitComet\Torrents\Ying Yang Twins ft Wyclef-Dangerous (DVD)(music-video-torrents.afz.biz).mpg.torrent
C:\Program Files\BitComet\Torrents\Ying Yang Twins ft Wyclef-Dangerous (DVD)(music-video-torrents.afz.biz).mpg.xml
C:\Program Files\BitComet\Torrents\Ying Yang Twins ft Wyclef-Dangerous (DVD)(music-video-torrents.afz.biz).mpg_chat.xml
C:\Program Files\BitComet\Torrents\Ying_Yang_Twins-Chemically_Imbalanced-2006-TAM.torrent
C:\Program Files\BitComet\Torrents\Ying_Yang_Twins-Chemically_Imbalanced-2006-TAM.xml
C:\Program Files\BitComet\Torrents\Ying_Yang_Twins-Chemically_Imbalanced-2006-TAM_chat.xml
C:\Program Files\BitComet\Torrents\Ying_Yang_Twins-United_State_Of_Atlanta-2005-XXL.torrent
C:\Program Files\BitComet\Torrents\Ying_Yang_Twins-United_State_Of_Atlanta-2005-XXL.xml
C:\Program Files\BitComet\Torrents\Yung Joc - New Joc City.torrent
C:\Program Files\BitComet\Torrents\Yung Joc - New Joc City.xml
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\sysproc64\sysproc86.sys
C:\WINDOWS\system32\sysproc64 . . . . failed to delete
C:\WINDOWS\system32\sysproc64\sysproc32.sys . . . . failed to delete
C:\WINDOWS\system32\sysproc64\sysproc86.sys . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_Aldebaran


((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 )))))))))))))))))))))))))))))))
.

2008-08-27 19:39 . 2008-08-27 19:40 d–hs—- C:\Documents and Settings\NetworkService\Application Data\sysproc64
2008-08-27 19:39 . 2008-08-27 19:40 d–hs—- C:\Documents and Settings\LocalService\Application Data\sysproc64
2008-08-27 16:37 . 2008-08-27 16:37 d——– C:\rsit
2008-08-21 20:29 . 2008-08-27 19:39 d–hs—- C:\WINDOWS\system32\sysproc64
2008-08-10 20:21 . 2008-08-10 20:21 d——– C:\Program Files\Orca
2008-08-10 19:53 . 2007-01-19 03:21 d——– C:\Program Files\illusion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 02:34 ——— d—–w C:\Program Files\DNA
2008-08-27 05:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
2008-08-03 06:13 ——— d—–w C:\Program Files\Java
2008-07-22 01:52 ——— d—–w C:\Program Files\SystemRequirementsLab
2008-07-22 01:52 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\SystemRequirementsLab
2008-07-19 07:20 ——— d—–w C:\Program Files\iTunes
2008-07-19 07:20 ——— d—–w C:\Program Files\iPod
2008-07-19 07:03 ——— d—–w C:\Program Files\Safari
2008-07-03 23:04 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-07-03 23:04 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\Malwarebytes
2008-07-03 23:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-01 06:56 ——— d—–w C:\Program Files\Combined Community Codec Pack
2008-07-01 06:16 ——— d—–w C:\Program Files\VideoLAN
2008-07-01 06:11 ——— d—–w C:\Program Files\DivX
2008-06-28 21:16 34,296 —-a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-28 21:16 17,144 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2007-09-14 05:45 5,632 –sha-w C:\Program Files\Thumbs.db
2006-03-26 06:57 59,904 -c–a-w C:\Program Files\Judge Miller.ppt
2005-09-26 23:11 21 -c–a-w C:\Program Files\AVPersonalAVWIN.INI
.

((((((((((((((((((((((((((((( snapshot@2008-08-27_18.58.40.90 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-28 01:45:13 16,384 -c–a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-28 02:39:09 16,384 -c–a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-28 01:45:13 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-28 02:39:09 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-08-28 01:45:13 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-28 02:39:09 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 09:15 50528]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15:56 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2wSysTray]
–a—— 2007-01-03 18:00 393216 C:\Program Files\2Wire\2PortalMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
–a—— 2008-01-03 09:15 50528 C:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autocleaner]
–a—— 2002-04-07 08:35 45880 C:\Program Files\Auto Cleaner\cleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
–a—— 2008-07-18 22:21 266497 C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-03 15:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
–a—— 2006-05-09 17:24 50760 C:\Program Files\Common Files\AOL\1134242000\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a—— 2004-11-02 08:59 126976 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a—— 2004-11-02 09:03 155648 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
–a—— 2006-11-16 13:42 183367 C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra—— 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
–a—— 2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]
–a—— 2003-07-14 10:52 40960 C:\WINDOWS\ltmsg.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1134242000\\ee\\aolsoftware.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Wizet\\MapleStory\\MapleStory.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1720:TCP"= 1720:TCP:BitComet 1720 TCP
"1720:UDP"= 1720:UDP:BitComet 1720 UDP
"56579:TCP"= 56579:TCP:BitComet 56579 TCP
"56579:UDP"= 56579:UDP:BitComet 56579 UDP

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2008-04-16 21:48]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2008-07-18 22:21]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-08-21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 19:41:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-08-27 19:53:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-28 02:53:05
ComboFix2.txt 2008-08-28 01:59:44
ComboFix3.txt 2007-08-10 22:15:38

Pre-Run: 8,518,242,304 bytes free
Post-Run: 8,503,398,400 bytes free

886 — E O F — 2008-08-15 07:48:40












——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, August 29, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, August 28, 2008 19:13:15
Records in database: 1157785
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Files scanned: 101384
Threat name: 3
Infected objects: 6
Suspicious objects: 0
Duration of the scan: 12:30:22


File name / Threat name / Threats count
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\Setup Application stuff\mirc617.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 1
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\stepmania simfiles\IGunZ-09252006-09282006-update-FIXED.zip Infected: not-a-virus:Monitor.Win32.KeyLogger.jn 1
C:\Documents and Settings\Paul Chiu\Shared\Kayla Ervin - Eve with Swiss Beatzz - Tambourine.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Paul Chiu\Shared\o remix dbsk.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Program Files\mIRC\backup\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 1
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 1

The selected area was scanned.













Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:09, on 2008-08-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Paul Chiu\Local Settings\temp\jkos-Paul Chiu\binaries\ScanningProcess.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 7388 bytes
Post #14
OmegaUltima,

With the number of trojans, rbots, and keyloggers on your computer, I would be very surprised if your information isn't severely compromised. It appears that many of these got on your system through torrents. At least some of them came with files related to online gaming. Some of these Trojans are specifically designed to steal player ID's, passwords, and other log in information like product keys. I would strongly suggest that you change everything you can (using a different computer) and monitor activities as best you can. I don't know that there is anything you can do about stolen keys but hope for the best and be more careful in the future.

To continue:

Disable your protection programs as we did before.

  • Please open HijackThis and run Do a system scan only
  • Check the boxes next to ONLY the entries listed below(if present):
    • F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
      O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…514/mcfscan.cab
  • Close all programs except for HijackThis.
  • Click on Fix checked
  • A box will pop up asking you if you wish to fix the selected items. Please choose YES.
  • Once it has fixed them, please exit/close HijackThis.

Next

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    KILLALL::

File::
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\stepmania simfiles\IGunZ-09252006-09282006-update-FIXED.zip
C:\Documents and Settings\Paul Chiu\Shared\Kayla Ervin - Eve with Swiss Beatzz - Tambourine.mp3
C:\Documents and Settings\Paul Chiu\Shared\o remix dbsk.mp3
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply along with a new HijackThis log.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #15
ComboFix 08-08-27.03 - Paul Chiu 2008-08-29 12:53:18.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.282 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Paul Chiu\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\stepmania simfiles\IGunZ-09252006-09282006-update-FIXED.zip
C:\Documents and Settings\Paul Chiu\Shared\Kayla Ervin - Eve with Swiss Beatzz - Tambourine.mp3
C:\Documents and Settings\Paul Chiu\Shared\o remix dbsk.mp3
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\bin.clearspring.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\#SharedObjects\J73MW5H4\static.youku.com\v1.0.0318\v\swf\qplayer.swf\qplayer.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Paul Chiu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Documents and Settings\Paul Chiu\Desktop\Stuff\stepmania simfiles\IGunZ-09252006-09282006-update-FIXED.zip
C:\Documents and Settings\Paul Chiu\Shared\Kayla Ervin - Eve with Swiss Beatzz - Tambourine.mp3
C:\Documents and Settings\Paul Chiu\Shared\o remix dbsk.mp3

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-29 )))))))))))))))))))))))))))))))
.

2008-08-27 19:39 . 2008-08-28 12:21 d–hs—- C:\Documents and Settings\NetworkService\Application Data\sysproc64
2008-08-27 19:39 . 2008-08-28 12:21 d–hs—- C:\Documents and Settings\LocalService\Application Data\sysproc64
2008-08-27 16:37 . 2008-08-27 16:37 d——– C:\rsit
2008-08-21 20:29 . 2008-08-29 13:00 d–hs—- C:\WINDOWS\system32\sysproc64
2008-08-10 20:21 . 2008-08-10 20:21 d——– C:\Program Files\Orca
2008-08-10 19:53 . 2007-01-19 03:21 d——– C:\Program Files\illusion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 02:34 ——— d—–w C:\Program Files\DNA
2008-08-27 05:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic
2008-08-03 06:13 ——— d—–w C:\Program Files\Java
2008-07-22 01:52 ——— d—–w C:\Program Files\SystemRequirementsLab
2008-07-22 01:52 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\SystemRequirementsLab
2008-07-19 07:20 ——— d—–w C:\Program Files\iTunes
2008-07-19 07:20 ——— d—–w C:\Program Files\iPod
2008-07-19 07:03 ——— d—–w C:\Program Files\Safari
2008-07-03 23:04 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-07-03 23:04 ——— d—–w C:\Documents and Settings\Paul Chiu\Application Data\Malwarebytes
2008-07-03 23:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-01 06:56 ——— d—–w C:\Program Files\Combined Community Codec Pack
2008-07-01 06:16 ——— d—–w C:\Program Files\VideoLAN
2008-07-01 06:11 ——— d—–w C:\Program Files\DivX
2008-06-28 21:16 34,296 —-a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-28 21:16 17,144 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2007-09-14 05:45 5,632 –sha-w C:\Program Files\Thumbs.db
2006-03-26 06:57 59,904 -c–a-w C:\Program Files\Judge Miller.ppt
2005-09-26 23:11 21 -c–a-w C:\Program Files\AVPersonalAVWIN.INI
.

((((((((((((((((((((((((((((( snapshot@2008-08-27_18.58.40.90 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-28 01:45:13 16,384 -c–a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-29 20:00:48 16,384 -c–a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-28 01:45:13 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-29 20:00:48 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-08-28 01:45:13 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-29 20:00:48 32,768 -c–a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-28 01:45:16 34,910 —-a-w C:\WINDOWS\system32\sysproc64\sysproc86.sys
+ 2008-08-29 20:00:52 34,910 —-a-w C:\WINDOWS\system32\sysproc64\sysproc86.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 09:15 50528]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15:56 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 17:19 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2wSysTray]
–a—— 2007-01-03 18:00 393216 C:\Program Files\2Wire\2PortalMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
–a—— 2008-01-03 09:15 50528 C:\Program Files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autocleaner]
–a—— 2002-04-07 08:35 45880 C:\Program Files\Auto Cleaner\cleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
–a—— 2008-07-18 22:21 266497 C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-03 15:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
–a—— 2006-05-09 17:24 50760 C:\Program Files\Common Files\AOL\1134242000\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a—— 2004-11-02 08:59 126976 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a—— 2004-11-02 09:03 155648 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
–a—— 2006-11-16 13:42 183367 C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra—— 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
–a—— 2004-09-07 13:47 57344 C:\WINDOWS\ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTMSG]
–a—— 2003-07-14 10:52 40960 C:\WINDOWS\ltmsg.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1134242000\\ee\\aolsoftware.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Wizet\\MapleStory\\MapleStory.exe"=
"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1720:TCP"= 1720:TCP:BitComet 1720 TCP
"1720:UDP"= 1720:UDP:BitComet 1720 UDP
"56579:TCP"= 56579:TCP:BitComet 56579 TCP
"56579:UDP"= 56579:UDP:BitComet 56579 UDP

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2008-04-16 21:48]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2008-07-18 22:21]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]
.
Contents of the 'Scheduled Tasks' folder

2008-08-21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 13:02:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2008-08-29 13:15:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-29 20:15:19
ComboFix2.txt 2008-08-28 02:53:31
ComboFix3.txt 2008-08-28 01:59:44
ComboFix4.txt 2007-08-10 22:15:38

Pre-Run: 8,419,250,176 bytes free
Post-Run: 8,454,017,024 bytes free

176 — E O F — 2008-08-15 07:48:40





















Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:19, on 2008-08-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.vistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\Program Files\Common Files\EzTools\hsppp.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

–
End of file - 6701 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI