Spyware / Malware / Virus Removal

[Resolved] Please help!

71 min read

Looking for the outcome? Ask AI

Tomk

Post #16November 28, 2008, 4:22 AM UTC

jerryandcheri, Would you please try to run Malwarebytes' Anti-Malware is safemode?

jerryandcheri

Post #17November 29, 2008, 4:42 AM UTC

Hello, I tried to run Malwarebytes' Anti-Malware with no luck.

Tomk

Post #18November 29, 2008, 5:56 AM UTC

jerryandcheri,

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe
prunnet.exe

:Services

:Reg
[-HKEY_CLASSES_ROOT\CLSID\{D73F49B6-B51B-4d32-A3B7-BD04B8342F53}]
[-HKEY_CLASSES_ROOT\CLSID\{47388408-A0AF-4D5F-B715-FC5C9EEF2EF4}]
[-HKEY_CLASSES_ROOT\CLSID\{73259091-9574-4ED8-A40F-7F65AFC28634}]
[-HKEY_CLASSES_ROOT\CLSID\{F5A149DC-26C1-24C2-9785-502423DE2CA3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljJCvTnk]

:Files
c:\program files\morpheusbar
c:\windows\system32\yayaWQIa.dll
c:\windows\system32\ljJCvTnk.dll
c:\windows\system32\lzeqvqcjotggzqm.dll
c:\windows\system32\prunnet.exe
c:\program files\pokerstars
c:\windows\system32\aIQWayay.ini
c:\windows\system32\aIQWayay.ini2
c:\windows\system32\winpfz33.sys
c:\temp\tn3
c:\windows\Q2hlcmk
c:\windows\system32\msnav32.ax
c:\temp\FT62
c:\windows\system32\drivers\core.cache.dsk
c:\windows\system32\drivers\wdmaudd.sys
c:\temp\1cb
c:\windows\system32\x4
c:\windows\system32\mp
c:\windows\system32\ID2
c:\windows\system32\gp2
c:\windows\system32\dim
c:\windows\system32\MSINET.oca
c:\windows\system32\MSINET.DEP
c:\docume~1\cheri\applic~1\IUpd721
c:\docume~1\cheri\applic~1\NI.GSCNS
c:\program files\PremierOpinion
c:\windows\system32\znlenobnnmo.dll-uninst.exe
c:\windows\system32\uftackihuglvuy.exe
c:\windows\system32\cpnprt2.cid

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Then

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

jerryandcheri

Post #19November 29, 2008, 5:05 PM UTC

I was able to do the OT scan and here are the results c:\docume~1\cheri\applic~1\IUpd721\Logs moved successfully. c:\docume~1\cheri\applic~1\IUpd721 moved successfully. c:\docume~1\cheri\applic~1\NI.GSCNS moved successfully. c:\program files\PremierOpinion moved successfully. c:\windows\system32\znlenobnnmo.dll-uninst.exe moved successfully. c:\windows\system32\uftackihuglvuy.exe moved successfully. c:\windows\system32\cpnprt2.cid moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Cheri\LOCALS~1\Temp\Perflib_Perfdata_8cc.dat scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Cheri\LOCALS~1\Temp\~DF4BB7.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\mcafee_YlUbFEi3uo2r6F0 scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\mcmsc_2lHrrQpmagIFUo2 scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\mcmsc_dXGcbEFfgn6zrgg scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\mcmsc_nedaodCTRYDM7Ya scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\mcmsc_PnwVnXehM4MKUGk scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\WFV1.tmp scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11292008_113248 After that I tried to turn off anti-virus. McAfee will open but there is a blank screen. I cannot get into where to turn it off. Is there any other way? I also see that windows security is on also. I dont know how to shut that off. I have to work today so I will not be back until at least 10:30 pm. Thanks…

Tomk

Post #20November 29, 2008, 5:21 PM UTC

jerryandcheri, Go ahead and run the Lop S&D and don't worry about your anti-virus.

jerryandcheri

Post #21November 30, 2008, 4:46 AM UTC

Here is the log ——————–\\ Lop S&D 4.2.4-9c XP/Vista "C:\Lop SD" ( MAJ : 01-11-2008|16:30 ) Option : [1] ( Sat 11/29/2008|23:24 ) ——————–\\ Listing folders in APPLIC~1 [01/26/2004|07:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Identities [01/26/2004|08:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Jasc Software Inc [01/26/2004|07:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft [01/26/2004|08:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Real [01/26/2004|08:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sonic [01/26/2004|07:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sun [04/17/2007|07:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe [03/21/2008|06:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL [07/12/2007|06:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads [07/12/2007|06:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL OCP [08/09/2007|01:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple [03/31/2008|01:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer [05/11/2005|07:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Avery [11/11/2008|08:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BigFishGamesCache [07/15/2008|12:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BOONTY [01/29/2004|10:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BVRP Software [08/04/2006|06:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CanonBJ [02/26/2008|03:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Dell [07/15/2004|02:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ EA [04/17/2005|05:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GameHouse [03/25/2008|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GDYKZQUZXG [10/18/2008|09:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Gogii [06/06/2005|06:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek [05/10/2005|07:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield [04/24/2007|08:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ JollyBear [06/23/2007|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Knowledge Adventure [02/25/2007|07:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak [07/08/2008|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ludia [11/28/2008|11:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes [02/10/2007|08:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee [02/10/2007|08:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee.com [07/24/2007|10:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft [07/12/2006|12:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Motive [05/22/2004|05:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSN6 [09/03/2008|08:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ n7-89-o9-3r-4t-r9 [05/16/2007|03:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Napster [03/30/2008|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ pdf995 [10/25/2008|04:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PlayFirst [01/26/2004|08:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime [05/06/2007|11:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ RoboForm [01/26/2004|08:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI [06/29/2007|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ScanSoft [08/14/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SDYKZQUZXG [09/22/2008|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy [06/29/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SSScanAppDataDir [06/29/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SSScanWizard [11/23/2007|11:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SupportSoft [01/19/2008|10:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TaxCut [11/18/2008|02:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP [04/09/2005|05:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Trymedia [11/02/2008|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint [05/09/2008|11:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Wal-Mart [01/13/2006|08:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage [02/10/2007|08:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo [12/22/2005|08:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo! [05/06/2007|11:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion [12/02/2005|03:45] C:\DOCUME~1\Cheri\APPLIC~1\ .gaim [04/26/2008|09:15] C:\DOCUME~1\Cheri\APPLIC~1\ Adobe [05/07/2007|08:20] C:\DOCUME~1\Cheri\APPLIC~1\ AdobeAUM [07/14/2008|01:19] C:\DOCUME~1\Cheri\APPLIC~1\ AdobeUM [09/23/2004|08:46] C:\DOCUME~1\Cheri\APPLIC~1\ Aim [06/15/2005|03:32] C:\DOCUME~1\Cheri\APPLIC~1\ AOL [04/01/2008|11:32] C:\DOCUME~1\Cheri\APPLIC~1\ Apple Computer [08/03/2008|06:44] C:\DOCUME~1\Cheri\APPLIC~1\ Canon [12/11/2005|08:42] C:\DOCUME~1\Cheri\APPLIC~1\ CherinJerry [05/28/2007|04:13] C:\DOCUME~1\Cheri\APPLIC~1\ Comcast [05/13/2004|12:47] C:\DOCUME~1\Cheri\APPLIC~1\ Common Files [09/12/2005|05:43] C:\DOCUME~1\Cheri\APPLIC~1\ Corel [01/29/2004|11:51] C:\DOCUME~1\Cheri\APPLIC~1\ CyberLink [02/08/2005|07:36] C:\DOCUME~1\Cheri\APPLIC~1\ Digital Album Organizer [07/15/2004|02:00] C:\DOCUME~1\Cheri\APPLIC~1\ EA [06/06/2005|07:16] C:\DOCUME~1\Cheri\APPLIC~1\ FFDesigner [06/04/2005|08:14] C:\DOCUME~1\Cheri\APPLIC~1\ FotoFinish [07/14/2008|12:49] C:\DOCUME~1\Cheri\APPLIC~1\ FrameSize Options [11/23/2008|09:57] C:\DOCUME~1\Cheri\APPLIC~1\ FrostWire [09/14/2008|09:25] C:\DOCUME~1\Cheri\APPLIC~1\ FunWebProducts [09/03/2008|08:39] C:\DOCUME~1\Cheri\APPLIC~1\ GameHouse [11/24/2008|06:23] C:\DOCUME~1\Cheri\APPLIC~1\ GoodSync [12/12/2005|09:32] C:\DOCUME~1\Cheri\APPLIC~1\ Google [04/12/2007|08:41] C:\DOCUME~1\Cheri\APPLIC~1\ GTek [05/03/2004|10:51] C:\DOCUME~1\Cheri\APPLIC~1\ Help [04/18/2004|06:12] C:\DOCUME~1\Cheri\APPLIC~1\ Hewlett-Packard [01/26/2004|07:24] C:\DOCUME~1\Cheri\APPLIC~1\ Identities [05/25/2007|11:08] C:\DOCUME~1\Cheri\APPLIC~1\ InstallShield [11/17/2008|08:41] C:\DOCUME~1\Cheri\APPLIC~1\ IObit [05/21/2005|05:57] C:\DOCUME~1\Cheri\APPLIC~1\ Jasc [06/18/2005|11:49] C:\DOCUME~1\Cheri\APPLIC~1\ Jasc Software Inc [10/14/2008|07:25] C:\DOCUME~1\Cheri\APPLIC~1\ JoyBits [02/06/2004|02:34] C:\DOCUME~1\Cheri\APPLIC~1\ Leadertech [07/08/2008|10:45] C:\DOCUME~1\Cheri\APPLIC~1\ Ludia [02/02/2004|04:33] C:\DOCUME~1\Cheri\APPLIC~1\ Macromedia [11/19/2004|08:53] C:\DOCUME~1\Cheri\APPLIC~1\ McAfee.com [05/23/2004|03:46] C:\DOCUME~1\Cheri\APPLIC~1\ McAfee.com Personal Firewall [11/03/2008|08:55] C:\DOCUME~1\Cheri\APPLIC~1\ Microsoft [04/24/2007|10:44] C:\DOCUME~1\Cheri\APPLIC~1\ Morpheus [07/21/2005|06:24] C:\DOCUME~1\Cheri\APPLIC~1\ Motive [09/06/2008|11:30] C:\DOCUME~1\Cheri\APPLIC~1\ Move Networks [07/12/2007|06:13] C:\DOCUME~1\Cheri\APPLIC~1\ Mozilla [01/03/2006|10:56] C:\DOCUME~1\Cheri\APPLIC~1\ MSN6 [03/15/2005|07:41] C:\DOCUME~1\Cheri\APPLIC~1\ MSNInstaller [02/25/2005|07:25] C:\DOCUME~1\Cheri\APPLIC~1\ MyPublisher [07/24/2007|10:07] C:\DOCUME~1\Cheri\APPLIC~1\ MySpace [05/01/2006|09:10] C:\DOCUME~1\Cheri\APPLIC~1\ Netscape [05/16/2007|03:09] C:\DOCUME~1\Cheri\APPLIC~1\ Paltalk [03/30/2008|09:22] C:\DOCUME~1\Cheri\APPLIC~1\ pdf995 [10/25/2008|04:49] C:\DOCUME~1\Cheri\APPLIC~1\ PlayFirst [09/29/2008|07:34] C:\DOCUME~1\Cheri\APPLIC~1\ Pogo Games [05/18/2007|02:57] C:\DOCUME~1\Cheri\APPLIC~1\ Printer Info Cache [05/30/2004|01:10] C:\DOCUME~1\Cheri\APPLIC~1\ Real [06/05/2007|04:19] C:\DOCUME~1\Cheri\APPLIC~1\ RegistrySmart [12/13/2005|03:15] C:\DOCUME~1\Cheri\APPLIC~1\ Roxio [08/04/2006|06:01] C:\DOCUME~1\Cheri\APPLIC~1\ ScanSoft [04/18/2004|06:10] C:\DOCUME~1\Cheri\APPLIC~1\ Share-to-Web Upload Folder [01/13/2006|10:04] C:\DOCUME~1\Cheri\APPLIC~1\ Simple Star [10/20/2008|09:34] C:\DOCUME~1\Cheri\APPLIC~1\ Skinux [06/04/2005|08:03] C:\DOCUME~1\Cheri\APPLIC~1\ SmartDraw [02/18/2007|05:29] C:\DOCUME~1\Cheri\APPLIC~1\ Snapfish [02/06/2004|02:34] C:\DOCUME~1\Cheri\APPLIC~1\ Sonic [05/10/2007|01:39] C:\DOCUME~1\Cheri\APPLIC~1\ Stamps.com Internet Postage [10/08/2008|09:03] C:\DOCUME~1\Cheri\APPLIC~1\ Sudden Games [01/26/2004|07:53] C:\DOCUME~1\Cheri\APPLIC~1\ Sun [01/19/2008|11:06] C:\DOCUME~1\Cheri\APPLIC~1\ TaxCut [11/29/2008|11:31] C:\DOCUME~1\Cheri\APPLIC~1\ U3 [05/09/2008|11:59] C:\DOCUME~1\Cheri\APPLIC~1\ Wal-Mart [05/09/2008|11:54] C:\DOCUME~1\Cheri\APPLIC~1\ Wal-Mart Digital Photo Manager [05/25/2007|11:08] C:\DOCUME~1\Cheri\APPLIC~1\ Wal-Mart Digital Photo Viewer [05/13/2005|08:43] C:\DOCUME~1\Cheri\APPLIC~1\ Webroot [03/19/2006|06:02] C:\DOCUME~1\Cheri\APPLIC~1\ Yahoo! [04/07/2004|05:16] C:\DOCUME~1\Cheri\APPLIC~1\ Yahoo! Messenger [01/26/2004|07:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities [01/26/2004|08:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Jasc Software Inc [12/01/2007|03:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft [01/26/2004|08:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real [01/26/2004|08:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sonic

Tomk

Post #22November 30, 2008, 5:09 AM UTC

jerryandcheri, I'm sorry but that is only half the report. If you still have it open, please try to post the whole thing. If you no longer have it open, I'm going to need you to run it again.

jerryandcheri

Post #23November 30, 2008, 5:17 AM UTC

I dont know how that happened..LOL ——————–\\ Lop S&D 4.2.4-9c XP/Vista "C:\Lop SD" ( MAJ : 01-11-2008|16:30 ) Option : [1] ( Sat 11/29/2008|23:24 ) ——————–\\ Listing folders in APPLIC~1 [01/26/2004|07:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Identities [01/26/2004|08:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Jasc Software Inc [01/26/2004|07:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft [01/26/2004|08:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Real [01/26/2004|08:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sonic [01/26/2004|07:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sun [04/17/2007|07:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe [03/21/2008|06:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL [07/12/2007|06:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads [07/12/2007|06:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL OCP [08/09/2007|01:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple [03/31/2008|01:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer [05/11/2005|07:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Avery [11/11/2008|08:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BigFishGamesCache [07/15/2008|12:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BOONTY [01/29/2004|10:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BVRP Software [08/04/2006|06:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CanonBJ [02/26/2008|03:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Dell [07/15/2004|02:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ EA [04/17/2005|05:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GameHouse [03/25/2008|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GDYKZQUZXG [10/18/2008|09:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Gogii [06/06/2005|06:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek [05/10/2005|07:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield [04/24/2007|08:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ JollyBear [06/23/2007|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Knowledge Adventure [02/25/2007|07:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak [07/08/2008|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ludia [11/28/2008|11:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes [02/10/2007|08:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee [02/10/2007|08:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee.com [07/24/2007|10:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft [07/12/2006|12:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Motive [05/22/2004|05:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSN6 [09/03/2008|08:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ n7-89-o9-3r-4t-r9 [05/16/2007|03:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Napster [03/30/2008|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ pdf995 [10/25/2008|04:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PlayFirst [01/26/2004|08:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime [05/06/2007|11:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ RoboForm [01/26/2004|08:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI [06/29/2007|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ScanSoft [08/14/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SDYKZQUZXG [09/22/2008|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy [06/29/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SSScanAppDataDir [06/29/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SSScanWizard [11/23/2007|11:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SupportSoft [01/19/2008|10:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TaxCut [11/18/2008|02:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP [04/09/2005|05:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Trymedia [11/02/2008|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint [05/09/2008|11:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Wal-Mart [01/13/2006|08:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage [02/10/2007|08:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo [12/22/2005|08:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo! [05/06/2007|11:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion [12/02/2005|03:45] C:\DOCUME~1\Cheri\APPLIC~1\ .gaim [04/26/2008|09:15] C:\DOCUME~1\Cheri\APPLIC~1\ Adobe [05/07/2007|08:20] C:\DOCUME~1\Cheri\APPLIC~1\ AdobeAUM [07/14/2008|01:19] C:\DOCUME~1\Cheri\APPLIC~1\ AdobeUM [09/23/2004|08:46] C:\DOCUME~1\Cheri\APPLIC~1\ Aim [06/15/2005|03:32] C:\DOCUME~1\Cheri\APPLIC~1\ AOL [04/01/2008|11:32] C:\DOCUME~1\Cheri\APPLIC~1\ Apple Computer [08/03/2008|06:44] C:\DOCUME~1\Cheri\APPLIC~1\ Canon [12/11/2005|08:42] C:\DOCUME~1\Cheri\APPLIC~1\ CherinJerry [05/28/2007|04:13] C:\DOCUME~1\Cheri\APPLIC~1\ Comcast [05/13/2004|12:47] C:\DOCUME~1\Cheri\APPLIC~1\ Common Files [09/12/2005|05:43] C:\DOCUME~1\Cheri\APPLIC~1\ Corel [01/29/2004|11:51] C:\DOCUME~1\Cheri\APPLIC~1\ CyberLink [02/08/2005|07:36] C:\DOCUME~1\Cheri\APPLIC~1\ Digital Album Organizer [07/15/2004|02:00] C:\DOCUME~1\Cheri\APPLIC~1\ EA [06/06/2005|07:16] C:\DOCUME~1\Cheri\APPLIC~1\ FFDesigner [06/04/2005|08:14] C:\DOCUME~1\Cheri\APPLIC~1\ FotoFinish [07/14/2008|12:49] C:\DOCUME~1\Cheri\APPLIC~1\ FrameSize Options [11/23/2008|09:57] C:\DOCUME~1\Cheri\APPLIC~1\ FrostWire [09/14/2008|09:25] C:\DOCUME~1\Cheri\APPLIC~1\ FunWebProducts [09/03/2008|08:39] C:\DOCUME~1\Cheri\APPLIC~1\ GameHouse [11/24/2008|06:23] C:\DOCUME~1\Cheri\APPLIC~1\ GoodSync [12/12/2005|09:32] C:\DOCUME~1\Cheri\APPLIC~1\ Google [04/12/2007|08:41] C:\DOCUME~1\Cheri\APPLIC~1\ GTek [05/03/2004|10:51] C:\DOCUME~1\Cheri\APPLIC~1\ Help [04/18/2004|06:12] C:\DOCUME~1\Cheri\APPLIC~1\ Hewlett-Packard [01/26/2004|07:24] C:\DOCUME~1\Cheri\APPLIC~1\ Identities [05/25/2007|11:08] C:\DOCUME~1\Cheri\APPLIC~1\ InstallShield [11/17/2008|08:41] C:\DOCUME~1\Cheri\APPLIC~1\ IObit [05/21/2005|05:57] C:\DOCUME~1\Cheri\APPLIC~1\ Jasc [06/18/2005|11:49] C:\DOCUME~1\Cheri\APPLIC~1\ Jasc Software Inc [10/14/2008|07:25] C:\DOCUME~1\Cheri\APPLIC~1\ JoyBits [02/06/2004|02:34] C:\DOCUME~1\Cheri\APPLIC~1\ Leadertech [07/08/2008|10:45] C:\DOCUME~1\Cheri\APPLIC~1\ Ludia [02/02/2004|04:33] C:\DOCUME~1\Cheri\APPLIC~1\ Macromedia [11/19/2004|08:53] C:\DOCUME~1\Cheri\APPLIC~1\ McAfee.com [05/23/2004|03:46] C:\DOCUME~1\Cheri\APPLIC~1\ McAfee.com Personal Firewall [11/03/2008|08:55] C:\DOCUME~1\Cheri\APPLIC~1\ Microsoft [04/24/2007|10:44] C:\DOCUME~1\Cheri\APPLIC~1\ Morpheus [07/21/2005|06:24] C:\DOCUME~1\Cheri\APPLIC~1\ Motive [09/06/2008|11:30] C:\DOCUME~1\Cheri\APPLIC~1\ Move Networks [07/12/2007|06:13] C:\DOCUME~1\Cheri\APPLIC~1\ Mozilla [01/03/2006|10:56] C:\DOCUME~1\Cheri\APPLIC~1\ MSN6 [03/15/2005|07:41] C:\DOCUME~1\Cheri\APPLIC~1\ MSNInstaller [02/25/2005|07:25] C:\DOCUME~1\Cheri\APPLIC~1\ MyPublisher [07/24/2007|10:07] C:\DOCUME~1\Cheri\APPLIC~1\ MySpace [05/01/2006|09:10] C:\DOCUME~1\Cheri\APPLIC~1\ Netscape [05/16/2007|03:09] C:\DOCUME~1\Cheri\APPLIC~1\ Paltalk [03/30/2008|09:22] C:\DOCUME~1\Cheri\APPLIC~1\ pdf995 [10/25/2008|04:49] C:\DOCUME~1\Cheri\APPLIC~1\ PlayFirst [09/29/2008|07:34] C:\DOCUME~1\Cheri\APPLIC~1\ Pogo Games [05/18/2007|02:57] C:\DOCUME~1\Cheri\APPLIC~1\ Printer Info Cache [05/30/2004|01:10] C:\DOCUME~1\Cheri\APPLIC~1\ Real [06/05/2007|04:19] C:\DOCUME~1\Cheri\APPLIC~1\ RegistrySmart [12/13/2005|03:15] C:\DOCUME~1\Cheri\APPLIC~1\ Roxio [08/04/2006|06:01] C:\DOCUME~1\Cheri\APPLIC~1\ ScanSoft [04/18/2004|06:10] C:\DOCUME~1\Cheri\APPLIC~1\ Share-to-Web Upload Folder [01/13/2006|10:04] C:\DOCUME~1\Cheri\APPLIC~1\ Simple Star [10/20/2008|09:34] C:\DOCUME~1\Cheri\APPLIC~1\ Skinux [06/04/2005|08:03] C:\DOCUME~1\Cheri\APPLIC~1\ SmartDraw [02/18/2007|05:29] C:\DOCUME~1\Cheri\APPLIC~1\ Snapfish [02/06/2004|02:34] C:\DOCUME~1\Cheri\APPLIC~1\ Sonic [05/10/2007|01:39] C:\DOCUME~1\Cheri\APPLIC~1\ Stamps.com Internet Postage [10/08/2008|09:03] C:\DOCUME~1\Cheri\APPLIC~1\ Sudden Games [01/26/2004|07:53] C:\DOCUME~1\Cheri\APPLIC~1\ Sun [01/19/2008|11:06] C:\DOCUME~1\Cheri\APPLIC~1\ TaxCut [11/29/2008|11:31] C:\DOCUME~1\Cheri\APPLIC~1\ U3 [05/09/2008|11:59] C:\DOCUME~1\Cheri\APPLIC~1\ Wal-Mart [05/09/2008|11:54] C:\DOCUME~1\Cheri\APPLIC~1\ Wal-Mart Digital Photo Manager [05/25/2007|11:08] C:\DOCUME~1\Cheri\APPLIC~1\ Wal-Mart Digital Photo Viewer [05/13/2005|08:43] C:\DOCUME~1\Cheri\APPLIC~1\ Webroot [03/19/2006|06:02] C:\DOCUME~1\Cheri\APPLIC~1\ Yahoo! [04/07/2004|05:16] C:\DOCUME~1\Cheri\APPLIC~1\ Yahoo! Messenger [01/26/2004|07:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities [01/26/2004|08:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Jasc Software Inc [12/01/2007|03:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft [01/26/2004|08:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real [01/26/2004|08:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sonic [01/26/2004|07:53] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sun [11/24/2008|06:59] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Adobe [08/01/2006|10:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Help [11/29/2004|08:59] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia [05/23/2004|03:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\ McAfee.com Personal Firewall [03/04/2008|02:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft [12/01/2007|03:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft ——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks [11/17/2008 10:24 AM][–a——] C:\WINDOWS\tasks\EasyShare Registration Task.job [11/29/2008 11:25 PM][–ah—–] C:\WINDOWS\tasks\User_Feed_Synchronization-{875F93DC-1064-4403-A4BD-13C181BC97CB}.job [11/17/2008 09:30 PM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [11/29/2008 03:30 AM][–a——] C:\WINDOWS\tasks\RegistrySmart Scheduled Scan.job [11/29/2008 11:24 PM][–ah—–] C:\WINDOWS\tasks\MP Scheduled Scan.job [11/15/2008 01:42 AM][–a——] C:\WINDOWS\tasks\McDefragTask.job [11/01/2008 12:00 AM][–a——] C:\WINDOWS\tasks\McQcTask.job [11/29/2008 11:20 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT [08/29/2002 06:00 AM][-r-h-c—] C:\WINDOWS\tasks\DESKTOP.INI ——————–\\ Listing Folders in C:\Program Files [08/13/2004|10:51] C:\Program Files\ 3DGroove [11/24/2007|12:47] C:\Program Files\ ABC-Ware [05/07/2007|08:11] C:\Program Files\ Adobe [10/13/2006|09:04] C:\Program Files\ AltoMP3 Gold [10/07/2007|02:40] C:\Program Files\ AmysGames [08/29/2005|10:45] C:\Program Files\ AOD [05/11/2007|07:29] C:\Program Files\ AOL [10/06/2008|02:37] C:\Program Files\ Apple Software Update [08/04/2006|05:57] C:\Program Files\ ArcSoft [11/21/2008|09:04] C:\Program Files\ AskSBar [05/11/2005|07:16] C:\Program Files\ Avery Dennison [06/09/2004|09:00] C:\Program Files\ AWS [08/14/2008|12:00] C:\Program Files\ BadgeHelp [11/11/2008|08:46] C:\Program Files\ bfgclient [07/16/2008|07:20] C:\Program Files\ BoontyGames [01/26/2004|08:01] C:\Program Files\ Broadcom Management Programs [07/06/2007|10:14] C:\Program Files\ CallWave [08/04/2006|05:55] C:\Program Files\ Canon [05/12/2007|08:33] C:\Program Files\ CCleaner [02/10/2007|11:54] C:\Program Files\ Comcast [07/15/2008|12:07] C:\Program Files\ Common Files [04/16/2008|11:00] C:\Program Files\ Coupons [11/02/2005|10:30] C:\Program Files\ CreataCard [12/03/2004|09:52] C:\Program Files\ Create & Print [10/20/2008|11:08] C:\Program Files\ Cribbage Buddy Pogo [02/16/2004|03:03] C:\Program Files\ CursorXP [01/26/2004|08:03] C:\Program Files\ CyberLink [02/24/2008|09:11] C:\Program Files\ DeductionPro 2007 [07/19/2008|10:56] C:\Program Files\ Dell [01/26/2004|08:08] C:\Program Files\ Dell Computer [11/23/2007|11:14] C:\Program Files\ Dell Support Center [04/12/2007|08:38] C:\Program Files\ DellSupport [05/22/2004|05:01] C:\Program Files\ Design Science [06/12/2005|01:02] C:\Program Files\ Disney [06/12/2004|07:32] C:\Program Files\ Disney Interactive [11/12/2008|09:34] C:\Program Files\ Drawing for Children [10/06/2008|10:40] C:\Program Files\ Dream Day First Home [01/29/2008|08:52] C:\Program Files\ Easy Photo Backup [03/24/2006|05:02] C:\Program Files\ EmpirePoker [05/25/2007|11:06] C:\Program Files\ eMusic Download Manager [11/25/2008|10:01] C:\Program Files\ ERUNT [12/05/2005|01:01] C:\Program Files\ FaxDrive [06/03/2007|10:00] C:\Program Files\ FaxTools [11/19/2008|05:23] C:\Program Files\ ffdshow [05/16/2007|03:53] C:\Program Files\ FileSubmit [02/08/2004|06:29] C:\Program Files\ Fisher-Price® [01/30/2004|05:25] C:\Program Files\ Fisher-Pricer [02/10/2007|08:00] C:\Program Files\ FotoFinish [11/24/2008|10:56] C:\Program Files\ FrostWire [02/08/2005|07:35] C:\Program Files\ Fujifilm e-Systems [09/03/2008|08:39] C:\Program Files\ GameHouse [10/05/2007|07:33] C:\Program Files\ Globe7 [09/04/2005|11:29] C:\Program Files\ GoldPocket [01/27/2008|12:29] C:\Program Files\ Google [04/03/2005|10:53] C:\Program Files\ Hasbro [10/13/2008|08:47] C:\Program Files\ Hasbro Interactive [01/07/2005|05:18] C:\Program Files\ Hewlett-Packard [12/03/2004|09:47] C:\Program Files\ HP [11/21/2005|08:06] C:\Program Files\ Hyperlinker [12/20/2005|05:17] C:\Program Files\ illiminable [06/13/2007|11:50] C:\Program Files\ ilo [10/13/2008|08:46] C:\Program Files\ IncrediMail [04/02/2005|04:58] C:\Program Files\ Infogrames [01/19/2008|11:08] C:\Program Files\ InstallShield Installation Information [03/15/2005|06:46] C:\Program Files\ InterActual [10/15/2008|02:21] C:\Program Files\ Internet Explorer [11/17/2008|08:41] C:\Program Files\ IObit [03/31/2008|01:31] C:\Program Files\ iPod [07/28/2007|02:32] C:\Program Files\ IrfanView [03/31/2008|01:31] C:\Program Files\ iTunes [03/03/2008|12:04] C:\Program Files\ IZArc [08/07/2007|10:42] C:\Program Files\ Jasc Software Inc [07/10/2008|12:28] C:\Program Files\ Java [06/20/2005|06:45] C:\Program Files\ JumpStart [06/23/2007|12:11] C:\Program Files\ JumpStart World [01/15/2008|08:33] C:\Program Files\ Kodak [04/12/2004|01:22] C:\Program Files\ Lavasoft [02/04/2008|07:53] C:\Program Files\ Leansoft [01/26/2004|08:05] C:\Program Files\ Learn2.com [07/20/2005|05:26] C:\Program Files\ Maestro Learning [11/28/2008|11:23] C:\Program Files\ Malwarebytes' Anti-Malware [01/26/2007|06:45] C:\Program Files\ Maxis [09/12/2008|11:26] C:\Program Files\ McAfee [02/10/2007|08:33] C:\Program Files\ McAfee.com [02/24/2008|07:33] C:\Program Files\ Memorex exPressit Label Design Studio [09/12/2008|11:16] C:\Program Files\ Messenger [05/27/2007|10:27] C:\Program Files\ MFInstall [01/26/2004|07:25] C:\Program Files\ Microsoft ActiveSync [06/27/2006|08:52] C:\Program Files\ Microsoft AntiSpyware [01/26/2004|07:26] C:\Program Files\ Microsoft Encarta [01/26/2004|07:24] C:\Program Files\ microsoft frontpage [01/26/2004|07:25] C:\Program Files\ Microsoft Money [01/21/2007|12:40] C:\Program Files\ Microsoft Office [10/16/2008|03:26] C:\Program Files\ Microsoft Picture It! 10 [01/26/2004|07:26] C:\Program Files\ Microsoft Picture It! 7 [03/24/2008|09:22] C:\Program Files\ Microsoft Silverlight [01/26/2004|07:25] C:\Program Files\ Microsoft Streets & Trips [01/26/2004|07:24] C:\Program Files\ Microsoft Works [01/26/2004|07:24] C:\Program Files\ Microsoft Works Suite 2003 [11/02/2005|10:31] C:\Program Files\ Modem Helper [11/23/2008|09:58] C:\Program Files\ Morpheus [09/12/2008|11:10] C:\Program Files\ Movie Maker [11/29/2008|11:55] C:\Program Files\ Mozilla Firefox [02/10/2007|08:05] C:\Program Files\ MSN [01/26/2004|07:24] C:\Program Files\ MSN Gaming Zone [02/10/2007|08:06] C:\Program Files\ MSN Messenger [11/19/2006|03:01] C:\Program Files\ MSXML 4.0 [01/26/2004|08:07] C:\Program Files\ MUSICMATCH [07/15/2008|12:06] C:\Program Files\ My Downloaded Games [08/12/2007|02:31] C:\Program Files\ MySpace [09/12/2008|11:07] C:\Program Files\ NetMeeting [06/01/2007|10:58] C:\Program Files\ NetRatingsNetmeter [12/14/2004|08:07] C:\Program Files\ Nstorm [10/13/2008|08:48] C:\Program Files\ Oberon Media [06/04/2007|06:24] C:\Program Files\ Online Services [09/12/2008|11:07] C:\Program Files\ Outlook Express [05/16/2007|03:09] C:\Program Files\ Paltalk Messenger [11/07/2006|01:21] C:\Program Files\ ParadisePoker [07/19/2008|10:55] C:\Program Files\ PCCheckupOnline [01/19/2008|11:07] C:\Program Files\ PDF995 [05/01/2005|07:08] C:\Program Files\ Pegasus Imaging [05/01/2006|09:10] C:\Program Files\ Photodex Presenter [12/14/2005|09:06] C:\Program Files\ PhotoMix [10/28/2007|05:52] C:\Program Files\ Picasa2 [06/12/2005|05:59] C:\Program Files\ PIXresizer [08/22/2005|04:16] C:\Program Files\ Plus! [07/15/2004|01:51] C:\Program Files\ Pogo Games [02/10/2007|08:08] C:\Program Files\ PokerChamps [02/10/2007|08:08] C:\Program Files\ PokerRoom.com [03/31/2008|01:29] C:\Program Files\ QuickTime [02/10/2007|12:08] C:\Program Files\ Real [08/30/2005|05:22] C:\Program Files\ Reality Digital [04/02/2005|08:10] C:\Program Files\ Rocket Division Software [03/31/2008|01:33] C:\Program Files\ Safari [02/11/2007|06:37] C:\Program Files\ Sarah's Mostly Harmless Key Banger [08/04/2006|06:00] C:\Program Files\ ScanSoft [03/03/2007|07:33] C:\Program Files\ Scholastic Digital Downloads [11/24/2008|04:32] C:\Program Files\ Siber Systems [02/15/2004|02:22] C:\Program Files\ Sierra On-Line [06/11/2007|09:43] C:\Program Files\ Siren [05/17/2006|10:47] C:\Program Files\ Skype [01/27/2008|01:22] C:\Program Files\ Sonic [07/11/2007|11:36] C:\Program Files\ Spybot - Search & Destroy [09/22/2008|11:03] C:\Program Files\ Spyware Doctor [02/24/2008|09:04] C:\Program Files\ Stamps.com Internet Postage [06/29/2004|10:33] C:\Program Files\ Stardock [04/11/2008|07:25] C:\Program Files\ support.com [03/30/2006|07:40] C:\Program Files\ TaxCut05 [02/16/2007|08:04] C:\Program Files\ TaxCut06 [01/19/2008|11:05] C:\Program Files\ TaxCut07 [01/13/2006|10:07] C:\Program Files\ TBONAS [05/26/2007|09:39] C:\Program Files\ tg games [11/11/2008|09:01] C:\Program Files\ The Hidden Object Show - Season 2 [06/12/2005|07:15] C:\Program Files\ The Learning Company [09/22/2008|06:52] C:\Program Files\ The Weather Channel FW [01/26/2007|06:44] C:\Program Files\ Three Rings Design [09/18/2006|08:20] C:\Program Files\ TopThemesXP [09/22/2008|11:14] C:\Program Files\ Trend Micro [07/15/2004|01:51] C:\Program Files\ TryMedia [02/10/2007|08:10] C:\Program Files\ UltimateBet [08/15/2007|11:48] C:\Program Files\ Uninstall Information [11/17/2008|10:35] C:\Program Files\ Unity [11/19/2008|02:47] C:\Program Files\ Veoh Networks [02/10/2007|08:17] C:\Program Files\ verizon [02/10/2007|08:13] C:\Program Files\ Verizon Online [08/30/2008|06:53] C:\Program Files\ Virtools [05/09/2008|11:59] C:\Program Files\ Wal-Mart [06/06/2005|06:15] C:\Program Files\ WebCyberCoach [01/26/2007|06:46] C:\Program Files\ WildTangent [12/31/2007|01:57] C:\Program Files\ Winamp [05/25/2007|11:08] C:\Program Files\ Windows Defender [11/25/2008|12:13] C:\Program Files\ Windows Live Safety Center [05/25/2007|11:07] C:\Program Files\ Windows Media Connect 2 [09/12/2008|11:07] C:\Program Files\ Windows Media Player [09/12/2008|11:07] C:\Program Files\ Windows NT [08/10/2004|09:09] C:\Program Files\ WindowsUpdate [02/10/2007|08:23] C:\Program Files\ WinMX [06/03/2007|10:00] C:\Program Files\ Wise Disk Cleaner [10/02/2007|05:01] C:\Program Files\ Wise Registry Cleaner [01/07/2005|05:20] C:\Program Files\ WON [01/26/2004|07:24] C:\Program Files\ XEROX [05/06/2007|10:22] C:\Program Files\ Yahoo! [02/10/2007|08:00] C:\Program Files\ Yahooligans ——————–\\ Listing Folders in C:\Program Files\Common Files [05/07/2007|08:12] C:\Program Files\Common Files\ Adobe [11/02/2008|03:45] C:\Program Files\Common Files\ AOL [01/29/2004|05:50] C:\Program Files\Common Files\ aolback [03/31/2008|01:26] C:\Program Files\Common Files\ Apple [07/15/2008|12:07] C:\Program Files\Common Files\ BOONTY Shared [01/26/2004|07:24] C:\Program Files\Common Files\ Designer [05/22/2008|10:05] C:\Program Files\Common Files\ eSellerate [09/23/2004|10:17] C:\Program Files\Common Files\ GTK [05/09/2008|11:59] C:\Program Files\Common Files\ HP [05/10/2005|07:53] C:\Program Files\Common Files\ InstallShield [05/11/2005|11:11] C:\Program Files\Common Files\ Jasc Software Inc [01/26/2004|07:53] C:\Program Files\Common Files\ Java [06/23/2007|12:10] C:\Program Files\Common Files\ Knowledge Adventure [10/20/2008|09:32] C:\Program Files\Common Files\ Kodak [08/01/2007|11:02] C:\Program Files\Common Files\ McAfee [05/16/2007|07:35] C:\Program Files\Common Files\ Microsoft Shared [01/26/2004|07:24] C:\Program Files\Common Files\ MSSoap [11/02/2005|04:16] C:\Program Files\Common Files\ NSV [01/26/2004|08:05] C:\Program Files\Common Files\ Nullsoft [09/08/2006|09:09] C:\Program Files\Common Files\ ODBC [01/26/2004|08:06] C:\Program Files\Common Files\ Real [06/29/2007|12:16] C:\Program Files\Common Files\ ScanSoft Shared [01/26/2004|07:24] C:\Program Files\Common Files\ Services [09/28/2005|01:15] C:\Program Files\Common Files\ Simple Star Shared [03/03/2004|02:43] C:\Program Files\Common Files\ Sonic [01/26/2004|07:24] C:\Program Files\Common Files\ SpeechEngines [08/05/2004|12:26] C:\Program Files\Common Files\ Stardock [11/23/2007|11:14] C:\Program Files\Common Files\ supportsoft [02/24/2008|07:31] C:\Program Files\Common Files\ SureThing Shared [02/02/2004|05:15] C:\Program Files\Common Files\ SWF Studio [09/12/2008|11:07] C:\Program Files\Common Files\ System [01/26/2004|08:06] C:\Program Files\Common Files\ xing shared ——————–\\ Process ( 56 Processes ) … OK ! ——————–\\ Searching with S_Lop No Lop folder found ! ——————–\\ Searching for Lop Files - Folders No Lop folder found ! ——————–\\ Searching within the Registry ….. OK ! ——————–\\ Checking the Hosts file Hosts file CLEAN ——————–\\ Searching for hidden files with Catchme ——————–\\ Searching for other infections ——————–\\ ROOTKIT !! Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Enum\Root\LEGACY_TDSSSERV.SYS] Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS] [F:11][D:0]-> C:\DOCUME~1\Cheri\LOCALS~1\Temp [F:2][D:0]-> C:\DOCUME~1\Cheri\Cookies [F:8][D:3]-> C:\DOCUME~1\Cheri\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - Sat 11/29/2008|23:37 - Option : [1] ——————–\\ Scan completed at 23:37:57

Tomk

Post #24November 30, 2008, 5:25 AM UTC

jerryandcheri,

Aha. There's our problem.

Let's retry Combofix.

Please drag the copy on your desktop to your recycle bin.

Redownload it per earlier instructions except when saving it, change it's name to worknow.com. Then try to run following original instructions.

jerryandcheri

Post #25November 30, 2008, 6:15 AM UTC

ComboFix 08-11-29.03 - Cheri 2008-11-30 0:44:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1111 [GMT -5:00]
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Cheri\Application Data\FunWebProducts
c:\program files\Mozilla Firefox\plugins\NPMorpBr.dll
c:\program files\TBONAS
c:\temp\tn3
c:\windows\cdmxtras
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\customer_cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\heart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_down.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\plates.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\ticket.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\tray.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\music\mainmenumusic.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_bring_check_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_diner.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_food_ready_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_gain_heart_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pencil_write_2.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_rollover_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_seat_people_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\choosedifficulty.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\credits.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_lose.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_win.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help1.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help2.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\highscores.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\mainmenu.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradegrid.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradetitle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upsell.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalk.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalkup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancel.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancelup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\close.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\closeup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continueover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplay.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplayover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfoup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pause.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pauseover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submitup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagain.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagainover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscoreon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\comics\webcomic.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\career.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\customer.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\endless.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\global.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\powerups.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\stove.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\arrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\grab.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\open.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\arial.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\komikaaxis.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdown.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdownon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowleft.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowlefton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowright.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowrighton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowupon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\p1icon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\textedit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\title.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fifth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\first_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fourth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\second_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\playfirst_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\background.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\frames\upgrade_0001.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\upgrades.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\tableshadow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\choosedifficulty.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooseplayer.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooserestaurant.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\credits.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\game.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\gothighscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help2.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoreinfo.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoresubmit.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelover.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\loading.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainloop.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainmenu.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\ok.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\pause.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\style.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\tutorialintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upgrade.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upsell.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\webcomic.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\yesno.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\aol_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\gamelabsplash.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\playfirst_logo.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\strings.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\check.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\checkmark.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\clock.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closed.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closingtime.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\dollar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\coffee.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\tables.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\wallpaper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expert.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expertscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\fork_timer.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\goalcompleted.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level_career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\score.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\sound.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staroff.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staron.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumberup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\traynumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorial_character.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialarrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialbox.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\drinks.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\maitred.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\oven.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\select.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\shoes.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\stereo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\table.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\dinerdash.exe
c:\windows\Fonts\acrsecB.fon
c:\windows\Fonts\acrsecI.fon
c:\windows\Readme.txt
c:\windows\system32\cache329
c:\windows\system32\cache329\B_329_0_0_106800.htm
c:\windows\system32\cache329\B_329_0_0_107400.htm
c:\windows\system32\cache329\B_329_1_0_449200.gif
c:\windows\system32\cache329\B_329_1_0_449600.gif
c:\windows\system32\cache329\B_329_1_0_449600.htm
c:\windows\system32\cache329\B_329_1_0_454300.gif
c:\windows\system32\cache329\B_329_1_0_454300.htm
c:\windows\system32\cache329\B_329_2_0_105300.htm
c:\windows\system32\cache329\B_329_2_0_106800.htm
c:\windows\system32\cache329\B_329_2_0_107400.htm
c:\windows\system32\cache329\B_329_3_0_106800.htm
c:\windows\system32\cache329\B_329_3_0_107400.htm
c:\windows\system32\cache329\B_329_4_0_111600.htm
c:\windows\system32\cache329\B_329_4_0_152400.htm
c:\windows\system32\cache329\B_329_4_0_155300.htm
c:\windows\system32\cache329\B_329_4_0_164100.htm
c:\windows\system32\cache329\t_B_329_0_0_106800.htm
c:\windows\system32\cache329\t_B_329_0_0_107400.htm
c:\windows\system32\cache329\t_B_329_1_0_449600.htm
c:\windows\system32\cache329\t_B_329_1_0_454300.htm
c:\windows\system32\cache329\t_B_329_2_0_105300.htm
c:\windows\system32\cache329\t_B_329_2_0_106800.htm
c:\windows\system32\cache329\t_B_329_2_0_107400.htm
c:\windows\system32\cache329\t_B_329_3_0_106800.htm
c:\windows\system32\cache329\t_B_329_3_0_107400.htm
c:\windows\system32\cache329\t_B_329_4_0_111600.htm
c:\windows\system32\cache329\t_B_329_4_0_152400.htm
c:\windows\system32\cache329\t_B_329_4_0_155300.htm
c:\windows\system32\cache329\t_B_329_4_0_164100.htm
c:\windows\system32\drivers\fad.sys
c:\windows\system32\drivers\TDSSmqlt.sys
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\TDSSarxx.dll
c:\windows\system32\TDSScfmm.dll
c:\windows\system32\TDSSkkai.log
c:\windows\system32\TDSSlxcp.dll
c:\windows\system32\TDSSmtve.dat
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSoity.dll
c:\windows\system32\TDSSsahc.dll
c:\windows\system32\TDSSvoql.dll
c:\windows\system32\TDSSxhyf.log
c:\windows\system32\TempName.dll
c:\windows\system32\zxdnt3d.cfg
c:\windows\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_TDSSSERV.SYS
——-\Legacy_TDSSSERV.SYS
——-\Legacy_BOONTY_GAMES
——-\Legacy_MYWEBSEARCHSERVICE
——-\Legacy_NETWORK_MONITOR
——-\Service_Boonty Games
——-\Service_MyWebSearchService

((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 )))))))))))))))))))))))))))))))
.

2008-11-30 00:52 . 2008-11-30 00:52 d——– c:\temp\tn3
2008-11-29 23:19 . 2008-11-29 23:37 d——– C:\Lop SD
2008-11-29 11:32 . 2008-11-29 11:32 d——– C:\_OTMoveIt
2008-11-29 11:30 . 2008-11-29 11:31 d——– c:\documents and settings\Cheri\Application Data\U3
2008-11-29 00:55 . 2001-08-17 13:28 771,581 –a—— c:\windows\SYSTEM32\DLLCACHE\winacisa.sys
2008-11-29 00:55 . 2002-08-28 22:59 154,624 –a—— c:\windows\SYSTEM32\DLLCACHE\wlluc48.sys
2008-11-29 00:55 . 2008-04-13 20:12 116,224 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxwiadr.dll
2008-11-29 00:55 . 2001-08-17 22:37 99,865 –a—— c:\windows\SYSTEM32\DLLCACHE\xlog.exe
2008-11-29 00:55 . 2001-08-17 12:12 34,890 –a—— c:\windows\SYSTEM32\DLLCACHE\wlandrv2.sys
2008-11-29 00:55 . 2001-08-17 22:37 27,648 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxftplt.exe
2008-11-29 00:55 . 2001-08-17 22:36 23,040 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxwbtmp.dll
2008-11-29 00:55 . 2008-04-13 20:12 18,944 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxscnui.dll
2008-11-29 00:55 . 2001-08-17 12:11 16,970 –a—— c:\windows\SYSTEM32\DLLCACHE\xem336n5.sys
2008-11-29 00:55 . 2008-04-13 14:36 8,832 –a—— c:\windows\SYSTEM32\DLLCACHE\wmiacpi.sys
2008-11-29 00:55 . 2008-04-13 20:12 8,192 –a—— c:\windows\SYSTEM32\DLLCACHE\wshirda.dll
2008-11-29 00:55 . 2001-08-17 22:37 4,608 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxflnch.exe
2008-11-29 00:53 . 2001-08-17 22:36 495,616 –a—— c:\windows\SYSTEM32\DLLCACHE\sblfx.dll
2008-11-29 00:52 . 2001-08-17 13:28 899,146 –a—— c:\windows\SYSTEM32\DLLCACHE\r2mdkxga.sys
2008-11-29 00:51 . 2001-08-17 13:28 802,683 –a—— c:\windows\SYSTEM32\DLLCACHE\ltsm.sys
2008-11-29 00:50 . 2001-08-17 13:28 542,879 –a—— c:\windows\SYSTEM32\DLLCACHE\hsf_msft.sys
2008-11-29 00:49 . 2001-08-17 14:56 1,733,120 –a—— c:\windows\SYSTEM32\DLLCACHE\g400d.dll
2008-11-29 00:48 . 2001-08-17 12:13 980,034 –a—— c:\windows\SYSTEM32\DLLCACHE\cicap.sys
2008-11-29 00:47 . 2001-08-17 14:55 382,592 –a—— c:\windows\SYSTEM32\DLLCACHE\atidrab.dll
2008-11-29 00:46 . 2001-08-17 13:28 762,780 –a—— c:\windows\SYSTEM32\DLLCACHE\3cwmcru.sys
2008-11-28 23:21 . 2008-11-28 23:23 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-28 23:21 . 2008-11-28 23:21 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-28 23:21 . 2008-10-22 16:10 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-11-28 23:21 . 2008-10-22 16:10 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-11-27 15:00 . 2008-11-30 00:54 54,156 –ah—– c:\windows\QTFont.qfn
2008-11-27 15:00 . 2008-11-27 15:00 1,409 –a—— c:\windows\QTFont.for
2008-11-27 13:11 . 2008-11-27 13:11 d——– C:\fb1a564d7cd3e5bb0b021ca7
2008-11-26 14:01 . 2008-11-26 14:01 d——– C:\VundoFix Backups
2008-11-25 22:00 . 2008-11-25 22:01 d——– c:\program files\ERUNT
2008-11-25 12:23 . 2008-11-25 12:23 d——– C:\New Folder
2008-11-25 12:12 . 2008-11-25 12:13 d——– c:\program files\Windows Live Safety Center
2008-11-24 16:32 . 2008-11-24 18:23 d——– c:\documents and settings\Cheri\Application Data\GoodSync
2008-11-24 16:08 . 2004-01-26 20:10 d——– c:\documents and settings\newaccount\Application Data\Sonic
2008-11-24 16:08 . 2004-01-26 20:09 d——– c:\documents and settings\newaccount\Application Data\Jasc Software Inc
2008-11-24 16:08 . 2008-11-24 16:08 d——– c:\documents and settings\newaccount
2008-11-24 00:16 . 2008-11-24 00:16 86,272 –a—— c:\windows\SYSTEM32\DRIVERS\wdmaudd.sys
2008-11-24 00:16 . 2008-11-30 00:52 932 ——— c:\windows\SYSTEM32\DRIVERS\core.cache.dsk
2008-11-21 09:04 . 2008-11-24 22:56 d——– c:\program files\FrostWire
2008-11-21 09:04 . 2008-11-21 09:04 d——– c:\program files\AskSBar
2008-11-19 17:23 . 2008-11-19 17:23 d——– c:\program files\ffdshow
2008-11-19 17:23 . 2008-06-08 23:58 60,273 –a—— c:\windows\SYSTEM32\pthreadGC2.dll
2008-11-19 17:23 . 2008-06-12 20:36 7,680 –a—— c:\windows\SYSTEM32\ff_vfw.dll
2008-11-19 17:23 . 2007-07-10 18:10 547 –a—— c:\windows\SYSTEM32\ff_vfw.dll.manifest
2008-11-19 14:47 . 2008-11-19 14:47 d——– c:\program files\Veoh Networks
2008-11-17 20:41 . 2008-11-17 20:41 d——– c:\documents and settings\Cheri\Application Data\IObit
2008-11-17 10:35 . 2008-11-17 10:35 d——– c:\program files\Unity
2008-10-25 16:49 . 2008-10-25 16:49 d——– c:\documents and settings\Cheri\Application Data\PlayFirst
2008-10-25 16:49 . 2008-10-25 16:49 d——– c:\documents and settings\All Users\Application Data\PlayFirst
2008-10-20 09:34 . 2008-10-20 09:34 d——– c:\documents and settings\Cheri\Application Data\Skinux
2008-10-18 21:55 . 2008-10-18 21:55 d——– c:\documents and settings\All Users\Application Data\Gogii
2008-10-18 21:54 . 2008-11-11 21:01 d——– c:\program files\The Hidden Object Show - Season 2
2008-10-15 10:20 . 2008-10-20 11:08 d——– c:\program files\Cribbage Buddy Pogo
2008-10-15 00:36 . 2008-08-14 05:09 2,145,280 –a—— c:\windows\SYSTEM32\DLLCACHE\ntkrnlmp.exe
2008-10-15 00:35 . 2008-08-14 04:33 2,023,936 –a—— c:\windows\SYSTEM32\DLLCACHE\ntkrpamp.exe
2008-10-14 07:25 . 2008-10-14 07:25 d——– c:\documents and settings\Cheri\Application Data\JoyBits
2008-10-08 21:03 . 2008-10-08 21:03 d——– c:\documents and settings\Cheri\Application Data\Sudden Games
2008-10-08 21:00 . 2008-10-08 21:00 4,096 –a—— c:\windows\d3dx.dat
2008-10-06 22:50 . 2008-10-06 22:50 d——– c:\documents and settings\Cheri\Saved Games
2008-10-06 22:39 . 2008-10-06 22:40 d——– c:\program files\Dream Day First Home
2008-10-06 22:36 . 2008-11-11 08:46 d——– c:\program files\bfgclient
2008-10-06 22:34 . 2008-11-11 20:31 d——– c:\documents and settings\All Users\Application Data\BigFishGamesCache
2008-10-06 14:37 . 2008-10-06 14:37 d——– c:\program files\Apple Software Update

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-27 20:16 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-24 21:32 ——— d—–w c:\program files\Siber Systems
2008-11-24 02:58 ——— d—–w c:\program files\Morpheus
2008-11-24 02:57 ——— d—–w c:\documents and settings\Cheri\Application Data\FrostWire
2008-11-18 19:28 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-18 01:41 ——— d—–w c:\program files\IObit
2008-11-12 14:34 ——— d—–w c:\program files\Drawing for Children
2008-11-02 20:45 ——— d—–w c:\program files\Common Files\AOL
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:21 455,296 —-a-w c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-20 14:32 ——— d—–w c:\program files\Common Files\Kodak
2008-10-16 20:26 ——— d—–w c:\program files\Microsoft Picture It! 10
2008-10-16 19:13 202,776 —-a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\SYSTEM32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-15 16:34 337,408 —-a-w c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-14 01:48 ——— d—–w c:\program files\Oberon Media
2008-10-14 01:47 ——— d—–w c:\program files\Hasbro Interactive
2008-10-14 01:46 ——— d—–w c:\program files\IncrediMail
2008-10-03 17:41 6,066,176 ——w c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\SYSTEM32\msxml4.dll
2008-09-29 12:34 ——— d—–w c:\documents and settings\Cheri\Application Data\Pogo Games
2008-09-15 12:12 1,846,400 —-a-w c:\windows\SYSTEM32\win32k.sys
2008-09-15 12:12 1,846,400 —-a-w c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-09-10 01:14 1,307,648 —-a-w c:\windows\SYSTEM32\DLLCACHE\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\SYSTEM32\msxml6.dll
2008-09-08 10:41 333,824 —-a-w c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-09-04 17:15 1,106,944 —-a-w c:\windows\SYSTEM32\msxml3.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-08-27 08:24 3,593,216 —-a-w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2008-08-25 08:38 13,824 ——w c:\windows\SYSTEM32\DLLCACHE\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w c:\windows\SYSTEM32\DLLCACHE\iexplore.exe
2008-08-23 05:54 161,792 —-a-w c:\windows\SYSTEM32\DLLCACHE\ieakui.dll
2008-08-14 10:11 2,189,184 —-a-w c:\windows\SYSTEM32\ntoskrnl.exe
2008-08-14 10:11 2,189,184 —-a-w c:\windows\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-08-14 10:04 138,496 —-a-w c:\windows\SYSTEM32\DLLCACHE\afd.sys
2008-08-14 09:33 2,066,048 —-a-w c:\windows\SYSTEM32\ntkrnlpa.exe
2008-08-14 09:33 2,066,048 —-a-w c:\windows\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-08-14 03:56 30,976 —-a-w c:\windows\rascntrl.dll
2008-08-14 03:56 23,104 —-a-w c:\windows\SYSTEM32\svcprmpt.dll
2007-08-26 16:05 124,304 -c–a-w c:\documents and settings\Cheri\Application Data\GDIPFONTCACHEV1.DAT
2005-09-24 20:47 32 -c–a-r c:\documents and settings\All Users\hash.dat
2003-08-27 19:19 36,963 -c–a-r c:\program files\Common Files\SM1updtr.dll
2007-04-18 14:00 56 –sh–r c:\windows\SYSTEM32\5FAB9FD8E1.sys
2007-04-18 14:01 3,350 -csha-w c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2008-11-25 1406192]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2008-11-15 2235920]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2008-11-03 3522296]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-19 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-09-13 50688]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2005-06-21 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2005-06-21 126976]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2004-01-26 151597]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SM1BG"="c:\windows\SM1BG.EXE" [2003-08-27 94208]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2003-08-26 204800]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 53248]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]
"Tweak UI"="TWEAKUI.CPL" [2005-01-07 c:\windows\SYSTEM32\TWEAKUI.CPL]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 c:\windows\BCMSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 443968]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-19 160592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-24 218496]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2004-03-15 241664]
HP Image Zone Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2004-03-15 53248]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-07-07 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg30.dll
"VIDC.PIMJ"= pvljpg20.dll
"VIDC.PVW2"= PVWV220.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Dell Computer\\Dell Picture Studio v2.0\\launch.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Morpheus\\Morpheus.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

R1 wdmaudd;wdmaudd;c:\windows\system32\drivers\wdmaudd.sys [2008-11-24 86272]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" []
S3 GoogleDesktopManager-010108-205858;Google Desktop Manager 5.7.801.1629;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-01-27 29744]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7908d6a2-bbec-11dd-a496-000d56c12dc7}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-17 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2008-11-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-30 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2008-11-29 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart\RegistrySmart.exe []

2008-11-29 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart []

2008-11-30 c:\windows\Tasks\User_Feed_Synchronization-{875F93DC-1064-4403-A4BD-13C181BC97CB}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
BHO-{47388408-A0AF-4D5F-B715-FC5C9EEF2EF4} - (no file)
BHO-{F5A149DC-26C1-24C2-9785-502423DE2CA3} - (no file)

.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\Cheri\Application Data\Mozilla\Firefox\Profiles\rq259zor.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.ask.com/?o=20011&l=dis
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 00:53:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Windows Defender\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\program files\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-11-30 1:01:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-30 06:00:59

Pre-Run: 41,119,338,496 bytes free
Post-Run: 40,976,433,152 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

627 — E O F — 2008-11-25 13:30:04

Tomk

Post #26November 30, 2008, 6:46 AM UTC

jerryandcheri,

FrostWire and Morpheus
You have FrostWire and Morpheus, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm
See Clean/Infected P2P Programs here

I would recommend that you uninstall FrostWire and Morpheus, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

I see that Viewpoint is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto-updating for the Viewpoint Manager – the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.

To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.

Viewpoint Manager is considered as foistware instead of malware since it is often installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware
It is STRONGLY recommended that you remove the Viewpoint products; however, decide for yourself. To uninstall the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):

Click Start, then Settings, then click Control Panel.
In Control Panel, double-click Add or Remove Programs.
In Add or Remove Programs, Remove the Viewpoint component
Do the same for each Viewpoint component.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
c:\windows\QTFont.qfn
c:\windows\QTFont.for

Folder::
c:\temp\tn3
C:\Program Files\WildTangent

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7908d6a2-bbec-11dd-a496-000d56c12dc7}]

Rootkit::
c:\windows\SYSTEM32\DRIVERS\core.cache.dsk

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual user account.
Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log

jerryandcheri

Post #27December 1, 2008, 3:13 AM UTC last edited December 1, 2008, 3:13 AM UTC

Hello I cant seem to find frostwire or viewpoint stuff. I do have morpheus and will be more careful.

The only problems I seem to be having now is that something is trying to install when my PC boots. Also I am having a lot of pop-ups and dont want to disable them because I play lots of pogo games which require that pop-ups be allowed. Here are the logs requested…

Also, I can finally access this forum from my sick PC. I could not do that before.

ComboFix 08-11-30.01 - Cheri 2008-11-30 20:58:38.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1033 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\worknow.com
Command switches used :: c:\docume~1\Cheri\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\QTFont.for
c:\windows\QTFont.qfn
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\WildTangent
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\def.dat
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\images\dl_off.jpg
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\images\dl_on.jpg
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\images\main_hp.jpg
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\images\main_wg.jpg
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\images\spacer.gif
c:\program files\WildTangent\Apps\GameChannel\Notifications\{4bdc3f86-5f2f-4527-89e8-dbaaeb417821}\index.html
c:\program files\WildTangent\Apps\GameChannel\Notifications\{f388931a-fa43-4a56-baa1-8a6cd1d17a77}\def.dat
c:\program files\WildTangent\Apps\GameChannel\Notifications\{f388931a-fa43-4a56-baa1-8a6cd1d17a77}\images\background.jpg
c:\program files\WildTangent\Apps\GameChannel\Notifications\{f388931a-fa43-4a56-baa1-8a6cd1d17a77}\index.html
c:\program files\WildTangent\Apps\wtKernel0100.dll
c:\program files\WildTangent\Components\wtStreamProcessing0300.dll
c:\program files\WildTangent\LicenseStores\WT\1bbdbb4e-4d3f-49ac-ba3d-238675b15da1.wtlic
c:\temp\tn3
c:\windows\QTFont.for
c:\windows\QTFont.qfn
c:\windows\SYSTEM32\DRIVERS\core.cache.dsk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_BOONTY_GAMES
——-\Legacy_MYWEBSEARCHSERVICE
——-\Legacy_NETWORK_MONITOR

((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.

2008-11-30 21:04 . 2008-11-30 21:04 d——– c:\temp\tn3
2008-11-29 23:19 . 2008-11-29 23:37 d——– C:\Lop SD
2008-11-29 11:32 . 2008-11-29 11:32 d——– C:\_OTMoveIt
2008-11-29 11:30 . 2008-11-29 11:31 d——– c:\documents and settings\Cheri\Application Data\U3
2008-11-29 00:55 . 2001-08-17 13:28 771,581 –a—— c:\windows\SYSTEM32\DLLCACHE\winacisa.sys
2008-11-29 00:55 . 2002-08-28 22:59 154,624 –a—— c:\windows\SYSTEM32\DLLCACHE\wlluc48.sys
2008-11-29 00:55 . 2008-04-13 20:12 116,224 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxwiadr.dll
2008-11-29 00:55 . 2001-08-17 22:37 99,865 –a—— c:\windows\SYSTEM32\DLLCACHE\xlog.exe
2008-11-29 00:55 . 2001-08-17 12:12 34,890 –a—— c:\windows\SYSTEM32\DLLCACHE\wlandrv2.sys
2008-11-29 00:55 . 2001-08-17 22:37 27,648 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxftplt.exe
2008-11-29 00:55 . 2001-08-17 22:36 23,040 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxwbtmp.dll
2008-11-29 00:55 . 2008-04-13 20:12 18,944 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxscnui.dll
2008-11-29 00:55 . 2001-08-17 12:11 16,970 –a—— c:\windows\SYSTEM32\DLLCACHE\xem336n5.sys
2008-11-29 00:55 . 2008-04-13 14:36 8,832 –a—— c:\windows\SYSTEM32\DLLCACHE\wmiacpi.sys
2008-11-29 00:55 . 2008-04-13 20:12 8,192 –a—— c:\windows\SYSTEM32\DLLCACHE\wshirda.dll
2008-11-29 00:55 . 2001-08-17 22:37 4,608 –a—— c:\windows\SYSTEM32\DLLCACHE\xrxflnch.exe
2008-11-29 00:53 . 2001-08-17 22:36 495,616 –a—— c:\windows\SYSTEM32\DLLCACHE\sblfx.dll
2008-11-29 00:52 . 2001-08-17 13:28 899,146 –a—— c:\windows\SYSTEM32\DLLCACHE\r2mdkxga.sys
2008-11-29 00:51 . 2001-08-17 13:28 802,683 –a—— c:\windows\SYSTEM32\DLLCACHE\ltsm.sys
2008-11-29 00:50 . 2001-08-17 13:28 542,879 –a—— c:\windows\SYSTEM32\DLLCACHE\hsf_msft.sys
2008-11-29 00:49 . 2001-08-17 14:56 1,733,120 –a—— c:\windows\SYSTEM32\DLLCACHE\g400d.dll
2008-11-29 00:48 . 2001-08-17 12:13 980,034 –a—— c:\windows\SYSTEM32\DLLCACHE\cicap.sys
2008-11-29 00:47 . 2001-08-17 14:55 382,592 –a—— c:\windows\SYSTEM32\DLLCACHE\atidrab.dll
2008-11-29 00:46 . 2001-08-17 13:28 762,780 –a—— c:\windows\SYSTEM32\DLLCACHE\3cwmcru.sys
2008-11-28 23:21 . 2008-11-28 23:23 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-28 23:21 . 2008-11-28 23:21 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-28 23:21 . 2008-10-22 16:10 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-11-28 23:21 . 2008-10-22 16:10 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-11-27 13:11 . 2008-11-27 13:11 d——– C:\fb1a564d7cd3e5bb0b021ca7
2008-11-26 14:01 . 2008-11-26 14:01 d——– C:\VundoFix Backups
2008-11-25 22:00 . 2008-11-25 22:01 d——– c:\program files\ERUNT
2008-11-25 12:23 . 2008-11-25 12:23 d——– C:\New Folder
2008-11-25 12:12 . 2008-11-25 12:13 d——– c:\program files\Windows Live Safety Center
2008-11-24 16:32 . 2008-11-24 18:23 d——– c:\documents and settings\Cheri\Application Data\GoodSync
2008-11-24 16:08 . 2004-01-26 20:10 d——– c:\documents and settings\newaccount\Application Data\Sonic
2008-11-24 16:08 . 2004-01-26 20:09 d——– c:\documents and settings\newaccount\Application Data\Jasc Software Inc
2008-11-24 16:08 . 2008-11-24 16:08 d——– c:\documents and settings\newaccount
2008-11-24 00:16 . 2008-11-30 21:04 167,976 ——— c:\windows\SYSTEM32\DRIVERS\core.cache.dsk
2008-11-24 00:16 . 2008-11-24 00:16 86,272 –a—— c:\windows\SYSTEM32\DRIVERS\wdmaudd.sys
2008-11-21 09:04 . 2008-11-24 22:56 d——– c:\program files\FrostWire
2008-11-21 09:04 . 2008-11-21 09:04 d——– c:\program files\AskSBar
2008-11-19 17:23 . 2008-11-19 17:23 d——– c:\program files\ffdshow
2008-11-19 17:23 . 2008-06-08 23:58 60,273 –a—— c:\windows\SYSTEM32\pthreadGC2.dll
2008-11-19 17:23 . 2008-06-12 20:36 7,680 –a—— c:\windows\SYSTEM32\ff_vfw.dll
2008-11-19 17:23 . 2007-07-10 18:10 547 –a—— c:\windows\SYSTEM32\ff_vfw.dll.manifest
2008-11-19 14:47 . 2008-11-19 14:47 d——– c:\program files\Veoh Networks
2008-11-17 20:41 . 2008-11-17 20:41 d——– c:\documents and settings\Cheri\Application Data\IObit
2008-11-17 10:35 . 2008-11-17 10:35 d——– c:\program files\Unity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 01:50 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee
2008-12-01 01:49 ——— d—–w c:\program files\McAfee.com
2008-11-27 20:16 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-24 21:32 ——— d—–w c:\program files\Siber Systems
2008-11-24 02:58 ——— d—–w c:\program files\Morpheus
2008-11-24 02:57 ——— d—–w c:\documents and settings\Cheri\Application Data\FrostWire
2008-11-18 19:28 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-18 01:41 ——— d—–w c:\program files\IObit
2008-11-12 14:34 ——— d—–w c:\program files\Drawing for Children
2008-11-12 02:01 ——— d—–w c:\program files\The Hidden Object Show - Season 2
2008-11-12 01:31 ——— d—–w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2008-11-11 13:46 ——— d—–w c:\program files\bfgclient
2008-11-02 20:45 ——— d—–w c:\program files\Common Files\AOL
2008-10-25 21:49 ——— d—–w c:\documents and settings\Cheri\Application Data\PlayFirst
2008-10-25 21:49 ——— d—–w c:\documents and settings\All Users\Application Data\PlayFirst
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 16:08 ——— d—–w c:\program files\Cribbage Buddy Pogo
2008-10-20 14:34 ——— d—–w c:\documents and settings\Cheri\Application Data\Skinux
2008-10-20 14:32 ——— d—–w c:\program files\Common Files\Kodak
2008-10-19 02:55 ——— d—–w c:\documents and settings\All Users\Application Data\Gogii
2008-10-16 20:26 ——— d—–w c:\program files\Microsoft Picture It! 10
2008-10-14 12:25 ——— d—–w c:\documents and settings\Cheri\Application Data\JoyBits
2008-10-14 01:48 ——— d—–w c:\program files\Oberon Media
2008-10-14 01:47 ——— d—–w c:\program files\Hasbro Interactive
2008-10-14 01:46 ——— d—–w c:\program files\IncrediMail
2008-10-09 02:03 ——— d—–w c:\documents and settings\Cheri\Application Data\Sudden Games
2008-10-07 03:40 ——— d—–w c:\program files\Dream Day First Home
2008-10-06 19:37 ——— d—–w c:\program files\Apple Software Update
2007-08-26 16:05 124,304 -c–a-w c:\documents and settings\Cheri\Application Data\GDIPFONTCACHEV1.DAT
2005-09-24 20:47 32 -c–a-r c:\documents and settings\All Users\hash.dat
2003-08-27 19:19 36,963 -c–a-r c:\program files\Common Files\SM1updtr.dll
2007-04-18 14:00 56 –sh–r c:\windows\SYSTEM32\5FAB9FD8E1.sys
2007-04-18 14:01 3,350 -csha-w c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2008-11-25 1406192]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2008-11-15 2235920]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2008-11-03 3522296]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-19 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-09-13 50688]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2005-06-21 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2005-06-21 126976]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2004-01-26 151597]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SM1BG"="c:\windows\SM1BG.EXE" [2003-08-27 94208]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2003-08-26 204800]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 53248]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]
"Tweak UI"="TWEAKUI.CPL" [2005-01-07 c:\windows\SYSTEM32\TWEAKUI.CPL]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 c:\windows\BCMSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 443968]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-19 160592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-24 218496]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2004-03-15 241664]
HP Image Zone Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2004-03-15 53248]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-07-07 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg30.dll
"VIDC.PIMJ"= pvljpg20.dll
"VIDC.PVW2"= PVWV220.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Dell Computer\\Dell Picture Studio v2.0\\launch.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Morpheus\\Morpheus.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

R1 wdmaudd;wdmaudd;c:\windows\system32\drivers\wdmaudd.sys [2008-11-24 86272]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" []
S3 GoogleDesktopManager-010108-205858;Google Desktop Manager 5.7.801.1629;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-01-27 29744]
.
Contents of the 'Scheduled Tasks' folder

2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-17 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2008-12-01 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2008-11-29 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart\RegistrySmart.exe []

2008-11-29 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart []

2008-11-30 c:\windows\Tasks\User_Feed_Synchronization-{875F93DC-1064-4403-A4BD-13C181BC97CB}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 21:04:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Windows Defender\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\SYSTEM32\wscntfy.exe
c:\program files\Microsoft Office\Office10\WINWORD.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
c:\program files\Microsoft Works\MSWORKS.EXE
.
**************************************************************************
.
Completion time: 2008-11-30 21:11:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-01 02:11:06
ComboFix2.txt 2008-11-30 06:01:12

Pre-Run: 41,260,847,104 bytes free
Post-Run: 41,245,769,728 bytes free

229 — E O F — 2008-11-25 13:30:04

SDFix: Version 1.240
Run by [removed] on Sun 11/30/2008 at 09:34 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\.ico - Deleted

Could Not Remove C:\WINDOWS\system32\drivers\core.cache.dsk

Folder C:\Temp\tn3 - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 21:43:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\TDSSserv.sys]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSmqlt.sys"
"group"="file system"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\TDSSserv.sys\modules]
"TDSSserv"="\systemroot\system32\drivers\TDSSmqlt.sys"
"TDSSl"="\systemroot\system32\TDSSoity.dll"
"tdssservers"="\systemroot\system32\TDSSmtve.dat"
"tdssmain"="\systemroot\system32\TDSSarxx.dll"
"tdsslog"="\systemroot\system32\TDSSvoql.dll"
"tdssadw"="\systemroot\system32\TDSScfmm.dll"
"tdssinit"="\systemroot\system32\TDSSlxcp.dll"
"tdssurls"="\systemroot\system32\TDSSnmxh.log"
"tdsspanels"="\systemroot\system32\TDSSsahc.dll"
"tdsserrors"="\systemroot\system32\TDSSxhyf.log"
"TDSSproc"="\systemroot\system32\TDSSkkai.log"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\TDSSserv.sys]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSmqlt.sys"
"group"="file system"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\TDSSserv.sys\modules]
"TDSSserv"="\systemroot\system32\drivers\TDSSmqlt.sys"
"TDSSl"="\systemroot\system32\TDSSoity.dll"
"tdssservers"="\systemroot\system32\TDSSmtve.dat"
"tdssmain"="\systemroot\system32\TDSSarxx.dll"
"tdsslog"="\systemroot\system32\TDSSvoql.dll"
"tdssadw"="\systemroot\system32\TDSScfmm.dll"
"tdssinit"="\systemroot\system32\TDSSlxcp.dll"
"tdssurls"="\systemroot\system32\TDSSnmxh.log"
"tdsspanels"="\systemroot\system32\TDSSsahc.dll"
"tdsserrors"="\systemroot\system32\TDSSxhyf.log"
"TDSSproc"="\systemroot\system32\TDSSkkai.log"

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Dell Computer\\Dell Picture Studio v2.0\\launch.exe"="C:\\Program Files\\Dell Computer\\Dell Picture Studio v2.0\\launch.exe:*:Enabled:Jasc Paint Shop Photo Album Application"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Enabled:M5Shell"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"="C:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe:*:Enabled:Veoh Web Player "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\1125330371\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1125330371\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

C:\WINDOWS\system32\drivers\core.cache.dsk Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 28 Oct 2007 5,903,928 A..H. — "C:\Program Files\Picasa2\setup.exe"
Wed 18 Apr 2007 56 ..SHR — "C:\WINDOWS\SYSTEM32\5FAB9FD8E1.sys"
Wed 18 Apr 2007 3,350 A.SH. — "C:\WINDOWS\SYSTEM32\KGyGaAvL.sys"
Fri 29 Jul 2005 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 14 Mar 2005 299,008 A..H. — "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 28 Feb 2005 61,440 A..H. — "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Mon 21 May 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 12 Apr 2005 95,892 A..H. — "C:\Program Files\Comcast\Comcast PhotoShow 4\data\Comcast PhotoShow Deluxe.exe"
Fri 29 Jul 2005 4,348 …H. — "C:\Documents and Settings\Cheri\My Documents\My Music\License Backup\drmv1key.bak"
Mon 1 May 2006 20 A..H. — "C:\Documents and Settings\Cheri\My Documents\My Music\License Backup\drmv1lic.bak"
Mon 23 Jan 2006 488 A.SH. — "C:\Documents and Settings\Cheri\My Documents\My Music\License Backup\drmv2key.bak"
Sat 29 Nov 2008 0 A..H. — "C:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\SYSTEM\data\BIT2.tmp"
Thu 4 Oct 2007 8 A..H. — "C:\Documents and Settings\Cheri\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Thu 4 Oct 2007 8 A..H. — "C:\Documents and Settings\Cheri\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Thu 4 Oct 2007 8 A..H. — "C:\Documents and Settings\Cheri\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Wed 3 Oct 2007 8 A..H. — "C:\Documents and Settings\Cheri\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:37 PM, on 11/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {D73F49B1-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL (file missing)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm; - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (file missing)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: 3 Point Showdown by pogo - http://game1.pogo.com/applet-6.2.0.30/thre…t-ob-assets.cab
O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/applet-6.2.0.30/omah…a-ob-assets.cab
O16 - DPF: Aces Up! by pogo - http://game1.pogo.com/applet-6.2.5.42/aces…s-ob-assets.cab
O16 - DPF: Ali Baba Slots TM by pogo - http://slots.pogo.com/applet-6.1.0.39/slot…a-ob-assets.cab
O16 - DPF: All-Star Football Challenge by pogo - http://game1.pogo.com/applet-6.5.4.27/alls…arfb2-en_US.cab
O16 - DPF: Armored Attack by pogo - http://game4.pogo.com/applet-6.1.0.39/ccta…k-ob-assets.cab
O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-6.2.2.66/back…n-ob-assets.cab
O16 - DPF: Blackjack by pogo - http://game1.pogo.com/applet-6.2.1.41/blac…k-ob-assets.cab
O16 - DPF: Buckaroo Blackjack TM by pogo - http://vbjack.pogo.com/applet-6.0.0.32/vid…k-ob-assets.cab
O16 - DPF: Canasta by pogo - http://game1.pogo.com/applet-6.5.3.44/cana…nasta-en_US.cab
O16 - DPF: Checkers by pogo - http://game3.pogo.com/applet-6.1.2.25/chec…s-ob-assets.cab
O16 - DPF: Chess by pogo - http://game1.pogo.com/applet-6.1.5.21/ches…2-ob-assets.cab
O16 - DPF: Cribbage by pogo - http://game1.pogo.com/applet-6.2.3.36/crib…e-ob-assets.cab
O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/applet-6.1.4.22/chec…g-ob-assets.cab
O16 - DPF: Dominoes by pogo - http://game1.pogo.com/applet-6.8.2.23/domi…omino-en_US.cab
O16 - DPF: EA Sports Web Soccer by pogo - http://game1.pogo.com/applet-6.2.5.42/socc…r-ob-assets.cab
O16 - DPF: Euchre by pogo - http://game1.pogo.com/applet-6.2.4.23/euch…e-ob-assets.cab
O16 - DPF: EZ Win Bingo by pogo - http://bingoe.pogo.com/applet-6.0.4.31/bin…e-ob-assets.cab
O16 - DPF: First Class Solitaire by pogo - http://game1.pogo.com/applet-6.2.0.30/soli…2-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.5.4.27/supe…bingo-en_US.cab
O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/applet-6.1.5.21/harv…t-ob-assets.cab
O16 - DPF: Hearts by pogo - http://game1.pogo.com/applet-6.1.4.22/hear…s-ob-assets.cab
O16 - DPF: High Stakes Poker by pogo - http://game1.pogo.com/applet-6.5.4.27/draw…poker-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/applet-6.1.3.28/pool…l-ob-assets.cab
O16 - DPF: Its Outta Here 2 by pogo - http://itsout.pogo.com/applet-5.9.4.30/its…e-ob-assets.cab
O16 - DPF: Jigsaw Detective by pogo - http://game1.pogo.com/applet-6.6.5.31/jigs…igsaw-en_US.cab
O16 - DPF: Jokers Wild Poker by pogo - http://vpjoke.pogo.com/applet-5.9.3.29/vid…d-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://game1.pogo.com/applet-6.7.0.40/gin/gin-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.2.5.42/lott…o-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game1.pogo.com/applet-6.5.2.33/mahj…hjong-en_US.cab
O16 - DPF: Multiline Slots by pogo - http://game1.pogo.com/applet-6.1.4.29/mlsl…s-ob-assets.cab
O16 - DPF: NASCAR Web Racing by pogo - http://game1.pogo.com/applet-6.2.1.34/nasc…r-ob-assets.cab
O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/applet-6.2.1.34/paig…w-ob-assets.cab
O16 - DPF: Payday FreeCell by pogo - http://game5.pogo.com/applet-6.1.3.21/free…l-ob-assets.cab
O16 - DPF: Pebble Beach Golf by pogo - http://game4.pogo.com/applet-6.0.2.21/pebb…e-ob-assets.cab
O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/applet-6.2.5.42/wate…l-ob-assets.cab
O16 - DPF: Perfect Passer by pogo - http://game1.pogo.com/applet-6.2.0.30/perf…r-ob-assets.cab
O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-6.1.3.28/flin…r-ob-assets.cab
O16 - DPF: Pinochle by pogo - http://game1.pogo.com/applet-6.2.2.51/pino…e-ob-assets.cab
O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-6.1.4.22/popf…u-ob-assets.cab
O16 - DPF: Poppit by pogo - http://game1.pogo.com/applet-6.2.1.34/popp…2-ob-assets.cab
O16 - DPF: Poppit TM by pogo - http://game1.pogo.com/applet-6.1.2.32/popp…t-ob-assets.cab
O16 - DPF: Quick Quack by pogo - http://game1.pogo.com/applet-6.5.2.33/hots…treak-en_US.cab
O16 - DPF: SciFi Slots by pogo - http://scifi.pogo.com/applet-6.0.1.20/slot…i-ob-assets.cab
O16 - DPF: Showbiz Slots by pogo - http://game1.pogo.com/applet-6.1.4.22/slot…z-ob-assets.cab
O16 - DPF: Spades by pogo - http://game3.pogo.com/applet-6.1.2.32/spad…s-ob-assets.cab
O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-6.2.5.42/spid…r-ob-assets.cab
O16 - DPF: Squelchies by pogo - http://game1.pogo.com/applet-6.2.5.42/sque…s-ob-assets.cab
O16 - DPF: Sweet Tooth TM by pogo - http://game1.pogo.com/applet-6.2.4.32/swee…h-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/applet-6.2.0.30/hold…m-ob-assets.cab
O16 - DPF: Top Down Baseball Challenge by pogo - http://game1.pogo.com/applet-6.5.4.27/topd…down2-en_US.cab
O16 - DPF: Tri-Peaks by pogo - http://game1.pogo.com/applet-6.5.5.29/peaks/peaks-en_US.cab
O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-6.1.5.28/jumb…e-ob-assets.cab
O16 - DPF: Turbo 21 TM by pogo - http://game1.pogo.com/applet-6.2.1.27/turb…1-ob-assets.cab
O16 - DPF: Vert Skater by pogo - http://game1.pogo.com/applet-6.2.0.30/vert…r-ob-assets.cab
O16 - DPF: Video Poker by pogo - http://vpoker.pogo.com/applet-6.0.3.28/vid…r-ob-assets.cab
O16 - DPF: Word Whomp by pogo - http://game5.pogo.com/applet-6.0.4.37/word…p-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.1.5.21/whac…n-ob-assets.cab
O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.2.3.39/word…g-ob-assets.cab
O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.1.2.32/worl…s-ob-assets.cab
O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/clients/y/yt1_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/Messe…nt.cab28578.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…76/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v49/bjattack/bjattack.cab
O16 - DPF: {596AF4AC-40A0-474A-9F86-33F0A90F0FD6} (PictureItLauncher Class) - http://photos.msn.com/resources/neutral/co…ls/DigWebX2.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E2B469B-7444-42C3-BE28-7A54E05AC049} (PrintCtrl Class) - file://D:\MEMDISC\ALBUM_A\VIEW\PLUGIN\HPODPRTC.CAB
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} - http://hoylegames.sierra.com/cab/WONWebLauncherControl.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {B8E71371-F7F7-11D2-A2CE-0060B0FB9D0D} (CDToolCtrl Class) - http://free.aol.com/tryaolfree/cdt175/aolcdt175.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} - http://www.disney.go.com/games/downloads/g…GameManager.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://myspace.oberon-media.com/gameshell/…sh.1.0.0.80.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab28578.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://chat.msn.com/controls/msnchat45.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Desktop Manager 5.7.801.1629 (GoogleDesktopManager-010108-205858) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

–
End of file - 21902 bytes

Tomk

Post #28December 1, 2008, 4:08 AM UTC

jerryandcheri,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\WINDOWS\system32\drivers\core.cache.dsk

Rootkit::
C:\WINDOWS\system32\drivers\core.cache.dsk

Folder::
c:\temp\tn3
c:\documents and settings\All Users\Application Data\Viewpoint
c:\documents and settings\Cheri\Application Data\FrostWire

Driver::
Viewpoint Manager Service

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\TDSSserv.sys\modules]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\TDSSserv.sys\modules]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

jerryandcheri

Post #29December 1, 2008, 1:23 PM UTC

I did not do the last two things you asked. I had an issue last night after I did the last step. A box popped up and said that Prunnet.exe encountered a proplem and has to close. After that the icons and start menu disappeared. Now when I restarted my PC they are not there again. I had to use task manager to open IE. Isnt prunnet something we tried to get rid of?

Tomk

Post #30December 1, 2008, 2:37 PM UTC

jerryandcheri,

Prunnet.exe is definitely something we want to get rid of. See here: http://www.prevx.com/filenames/87044521211…UNNET2EEXE.html
Were you able to get any logs?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Please help!

✨ Ask AI

Ask AI