Spyware / Malware / Virus Removal

[Resolved] my computer is pissing me off...help

10 min read

Looking for the outcome? Ask AI

kari82 Topic Starter

Post #1December 25, 2008, 3:15 PM UTC

so I keep getting annoying pop ups and my computer is running super slow. I keep running virus scans but the problem is not going away… I have ran avg, combo fix, Malwarebytes' Anti-Malware, Abexo Free Registry Cleaner, and a windows thing. I didn't save any of the logs. I am posting my hijack this log from today. please help!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:13:12 AM, on

12/25/2008
Platform: Windows XP SP3 (WinNT

5.01.2600)
MSIE: Internet Explorer v7.00

(7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows

Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common

Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService

.exe
C:\PROGRA~1\Grisoft\AVG7\avgam

svr.exe
C:\PROGRA~1\Grisoft\AVG7\avgup

svc.exe
C:\PROGRA~1\Grisoft\AVG7\avgem

c.exe
C:\Program

Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network

Associates\Common

Framework\FrameworkService.exe
C:\Program Files\Network

Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common

Files\Microsoft

Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Network

Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network

Associates\Common

Framework\UpdaterUI.exe
C:\Program Files\Common

Files\Network

Associates\TalkBack\TBMon.exe
C:\Program

Files\NETGEAR\WG111v2

Configuration Utility\RtWLan.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Yahoo!\Search

Protection\SearchProtection.exe
C:\Program

Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program

Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.

exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program

Files\NETGEAR\WG111v2

Configuration Utility\RtlWake.exe
C:\Program Files\NETGEAR\WG111

Configuration Utility\WG111CFG.exe
C:\WINDOWS\system32\WTablet\Ta

bUserW.exe
C:\Program

Files\iPod\bin\iPodService.exe
C:\Program Files\Network

Associates\VirusScan\Mcshield.exe
C:\Program Files\internet

explorer\iexplore.exe
C:\Program Files\Mozilla

Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend

Micro\HijackThis\HijackThis.exe

R1 -

HKCU\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://ie.redirect.hp.com/svs/rdr?TYPE

=3&tp=iesearch&locale=EN_US&c=Q4

04&bd=presario&pf=desktop
R0 -

HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://www.myspace.com/
R1 -

HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId

=69157
R1 -

HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId

=54896
R1 -

HKLM\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://ie.redirect.hp.com/svs/rdr?TYPE

=3&tp=iesearch&locale=EN_US&c=Q4

04&bd=presario&pf=desktop
R1 -

HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId

=54896
R0 -

HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId

=69157
R1 -

HKCU\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://us.rd.yahoo.com/customize/ie/d

efaults/su/msgr8/*http://www.yahoo.c

om
R1 -

HKCU\Software\Microsoft\Windows\

CurrentVersion\Internet

Settings,ProxyOverride = *.local
O2 - BHO: (no name) -

{6c1197e2-fc48-41c9-9ac0-8f0850b61ba

1} -

C:\WINDOWS\system32\vafubamu.dll
O2 - BHO: Java™ Plug-In SSV Helper

-

{761497BB-D6F0-462C-B6EB-D4DAF1

D92D43} - C:\Program

Files\Java\jre6\bin\ssv.dll
O2 - BHO: VS_IEHlprObj Class -

{829CAB51-A4EA-4a15-87B6-4B7D07

47939C} - C:\Program Files\Network

Associates\VirusScan\bho.dll
O2 - BHO: Windows Live Sign-in Helper

-

{9030D464-4C02-4ABF-8ECC-5164760

863C6} - C:\Program Files\Common

Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV

Helper -

{DBC80044-A445-435b-BC74-9C25C1

C588A9} - C:\Program

Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl -

{E7E6F031-17CE-4C07-BC86-EABFE5

94F69C} - C:\Program

Files\Java\jre6\lib\deploy\jqs\ie\jqs_pl

ugin.dll
O4 - HKLM\..\Run: [hpsysdrv]

c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard]

C:\WINDOWS\SMINST\RECGUAR

D.EXE
O4 - HKLM\..\Run: [VTTimer]

VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG]

AGRSMMSG.exe
O4 - HKLM\..\Run: [EPSON Stylus

Photo R200 Series]

C:\WINDOWS\System32\spool\DRIV

ERS\W32X86\3\E_S4I2H1.EXE /P30

"EPSON Stylus Photo R200 Series" /O6

"USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [ShStatEXE]

"C:\Program Files\Network

Associates\VirusScan\SHSTAT.EXE"

/STANDALONE
O4 - HKLM\..\Run:

[McAfeeUpdaterUI] "C:\Program

Files\Network Associates\Common

Framework\UpdaterUI.exe"

/StartedFromRunKey
O4 - HKLM\..\Run: [Network

Associates Error Reporting Service]

"C:\Program Files\Common

Files\Network

Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [RtWLan]

C:\Program

Files\NETGEAR\WG111v2

Configuration Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [NvCplDaemon]

RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,N

vStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe

/install
O4 - HKLM\..\Run: [NvMediaCenter]

RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.d

ll,NvTaskbarInit
O4 - HKLM\..\Run: [AlcxMonitor]

ALCXMNTR.EXE
O4 - HKLM\..\Run:

[YSearchProtection] "C:\Program

Files\Yahoo!\Search

Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Reader

Speed Launcher] "C:\Program

Files\Adobe\Reader

8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run:

[SunJavaUpdateSched] "C:\Program

Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run:

[AppleSyncNotifier] C:\Program

Files\Common Files\Apple\Mobile

Device

Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper]

"C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC]

C:\PROGRA~1\Grisoft\AVG7\avgcc.

exe /STARTUP
O4 - HKLM\..\Run: [deyefibawi]

Rundll32.exe

"C:\WINDOWS\system32\mafopiwo.d

ll",s
O4 - HKLM\..\Run: [9cd4121f]

rundll32.exe

"C:\WINDOWS\system32\lenidure.dll"

,b
O4 - HKLM\..\Run: [CPM9fe72183]

Rundll32.exe

"c:\windows\system32\heyejopo.dll",a
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run:

[YSearchProtection] C:\Program

Files\Yahoo!\Search

Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Search Protection]

C:\Program Files\Yahoo!\Search

Protection\SearchProtection.exe
O4 - HKUS\S-1-5-18\..\Run:

[DWQueuedReporting]

"c:\PROGRA~1\COMMON~1\MICR

OS~1\DW\dwtrig20.exe" -t (User

'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run:

[AVG7_Run]

C:\PROGRA~1\Grisoft\AVG7\avgw.

exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run:

[DWQueuedReporting]

"c:\PROGRA~1\COMMON~1\MICR

OS~1\DW\dwtrig20.exe" -t (User

'Default user')
O4 - Startup: Adobe Gamma.lnk =

C:\Program Files\Common

Files\Adobe\Calibration\Adobe

Gamma Loader.exe
O4 - Global Startup: OptiCAL

Startup.lnk = C:\Program

Files\PANTONE

COLORVISION\OptiCAL\OptiCAL.e

xe
O4 - Global Startup: Smart Wizard

Wireless Settings.lnk = ?
O4 - Global Startup: TabUserW.exe.lnk

=

C:\WINDOWS\system32\WTablet\Ta

bUserW.exe
O4 - Global Startup: WG111v2 Smart

Wizard Wireless Setting.lnk = ?
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba384965

83} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem:

@xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba384965

83} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net -

{F4430FE8-2638-42e5-B849-800749B94

EED} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem:

PartyPoker.net -

{F4430FE8-2638-42e5-B849-800749B94

EED} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F7

95683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows

Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F7

95683} - C:\Program

Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP:

c:\windows\system32\nwprovau.dll
O20 - AppInit_DLLs:

C:\WINDOWS\system32\dayoyadu.dll

c:\windows\system32\heyejopo.dll
O21 - SSODL: SSODL -

{EC43E3FD-5C60-46a6-97D7-E0B85D

BDD6C4} -

c:\windows\system32\heyejopo.dll
O22 - SharedTaskScheduler: STS -

{EC43E3FD-5C60-46a6-97D7-E0B85D

BDD6C4} -

c:\windows\system32\heyejopo.dll
O23 - Service: Adobe LM Service -

Adobe Systems - C:\Program

Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device -

Apple Inc. - C:\Program Files\Common

Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService

.exe
O23 - Service: AVG7 Alert Manager

Server (Avg7Alrt) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVG7\avgam

svr.exe
O23 - Service: AVG7 Update Service

(Avg7UpdSvc) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVG7\avgup

svc.exe
O23 - Service: AVG E-mail Scanner

(AVGEMS) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVG7\avgem

c.exe
O23 - Service: Bonjour Service - Apple

Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing

Service - Macrovision Europe Ltd. -

C:\Program Files\Common

Files\Macrovision Shared\FLEXnet

Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table

Manager (IDriverT) - Macrovision

Corporation - C:\Program

Files\Common

Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. -

C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter

(JavaQuickStarterService) - Sun

Microsystems, Inc. - C:\Program

Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework

Service (McAfeeFramework) - Network

Associates, Inc. - C:\Program

Files\Network Associates\Common

Framework\FrameworkService.exe
O23 - Service: Network Associates

McShield (McShield) - Network

Associates, Inc. - C:\Program

Files\Network

Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task

Manager (McTaskManager) - Network

Associates, Inc. - C:\Program

Files\Network

Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver

Service (NVSvc) - NVIDIA Corporation

-

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom

Technology, Corp. -

C:\WINDOWS\system32\Tablet.exe

–
End of file - 10089 bytes

Tomk

Post #2December 25, 2008, 3:33 PM UTC

Hi kari82,

and Merry Christmas!

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Open Notepad: Start > All Programs > Accessories > Notepad.
Click on Format and ensure that Wordwrap is unchecked. If it isn't, uncheck it.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

kari82

Post #3December 26, 2008, 3:49 AM UTC

well I accidentally ran it twice. This is the second log, i didn't save the first one. I walked away and when I came back I noticed my computer restarted, well sometimes it does on its own for no reason(very annoying). So I thought it messed up and ran it again, this time I waited and saw that it was suppose to do that. oops

ComboFix 08-12-21.04 - Compaq_Owner 2008-12-25 22:29:26.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.547 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ojevuyol.ini
.
—- Previous Run ——-
.
c:\windows\system32\egojavet.ini
c:\windows\system32\erudinel.ini
c:\windows\system32\ohejiwam.ini
c:\windows\system32\ojevuyol.ini

.
((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))
.

2008-12-22 03:20 . 2008-12-25 10:16 dr-h—– C:\$VAULT$.AVG
2008-12-22 03:15 . 2008-12-24 11:43 d——– c:\documents and settings\Compaq_Owner\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\LocalService\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\All Users\Application Data\Grisoft
2008-12-22 03:14 . 2008-12-22 03:19 d——– c:\documents and settings\All Users\Application Data\avg7
2008-12-18 06:14 . 2008-12-18 06:14 410,984 –a—— c:\windows\system32\deploytk.dll
2008-11-29 18:19 . 2008-11-29 18:20 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImagingAlbums
2008-11-29 18:19 . 2008-12-12 13:13 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImaging

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 18:05 ——— d—–w c:\program files\Quicken
2008-12-23 15:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Apple Computer
2008-12-22 09:50 ——— d—–w c:\program files\ornu
2008-12-18 11:13 ——— d—–w c:\program files\Java
2008-12-17 12:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\LimeWire
2008-12-17 11:01 ——— d—–w c:\program files\LimeWire
2008-11-01 12:15 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Yahoo!
2008-11-01 02:00 262,144 —-a-w C:\ntuser.dat
2008-10-25 22:20 47,360 —-a-w c:\documents and settings\Compaq_Owner\Application Data\pcouffin.sys
2008-06-26 04:06 7,496,920 —-a-w c:\program files\Firefox Setup 3.0.exe
2008-06-08 18:32 18,895,728 —-a-w c:\program files\Install_Messenger.exe
2007-10-26 02:26 779,312 -c–a-w c:\program files\MoveMediaPlayer_07074039.exe
2007-04-15 17:17 365,824 —-a-w c:\program files\bot250.zip
2007-04-05 14:35 5,154,816 -c–a-w c:\program files\WindowsDefender.msi
2006-10-25 17:49 322,329 -c–a-w c:\program files\Info101.widget
2006-08-30 01:29 198,254 —-a-w c:\program files\ProShots File Update.zip
2006-08-30 01:27 28,526,781 —-a-w c:\program files\Candid 2000 Mask.zip
2006-08-30 00:58 7,038,375 -c–a-w c:\program files\IPhotos Setup Install.exe
2006-08-14 03:26 1,355,912 -c–a-w c:\program files\install_flash_player.exe
2006-08-07 00:39 13,130,032 —-a-w c:\program files\IE7BETA3-WindowsXP-x86-enu.exe
2006-03-21 21:34 26,922 -c–a-w c:\program files\MoviePass Terms.html
2005-09-16 13:46 635,569 -c–a-w c:\program files\XviD-1.0.3-20122004.exe
2005-08-03 18:38 826 —-a-w c:\program files\install.adb
2005-04-23 02:52 315,624 —-a-w c:\program files\dxwebsetup.exe
2005-03-22 09:49 287,232 —-a-w c:\program files\Adobelmsvc Installer.dll
2005-03-22 08:29 19,533,824 —-a-w c:\program files\Photoshop.exe
2005-03-22 07:48 2,142,208 —-a-w c:\program files\PSArt.dll
2005-03-22 07:48 150,644 —-a-w c:\program files\TypeLibrary.tlb
2005-03-22 07:48 1,748,992 —-a-w c:\program files\PSViews.dll
2005-03-22 07:48 1,323,008 —-a-w c:\program files\Photoshop.dll
2005-03-22 07:43 1,144,622 —-a-w c:\program files\Tw10122.dat
2005-03-22 07:41 19,980,288 —-a-w c:\program files\ImageReady.exe
2005-03-22 07:13 41,984 —-a-w c:\program files\Plugin.dll
2005-03-16 22:57 61,440 -c–a-w c:\program files\regsresen_US.dll
2005-03-13 17:10 4,096,000 -c–a-w c:\program files\PDFL70.dll
2005-03-13 16:01 1,805,824 —-a-w c:\program files\AGM.dll
2005-03-11 00:31 3,715,072 -c–a-w c:\program files\MPS.dll
2005-03-09 21:59 1,560,169 —-a-w c:\program files\AdobeLM.dll
2005-03-09 08:32 151,552 -c–a-w c:\program files\AXE16SharedExpat.dll
2005-03-09 08:32 151,552 —-a-w c:\program files\AXE8SharedExpat.dll
2005-03-09 08:17 475,136 —-a-w c:\program files\AdobeXMP.dll
2005-03-09 08:07 630,784 —-a-w c:\program files\ACE.dll
2005-03-09 08:07 266,240 -c–a-w c:\program files\ARE.dll
2005-03-09 08:07 217,088 —-a-w c:\program files\BIBUtils.dll
2005-03-09 08:07 2,162,688 —-a-w c:\program files\CoolType.dll
2005-03-09 08:07 180,224 —-a-w c:\program files\Bib.dll
2005-03-08 11:23 4,153,344 —-a-w c:\program files\VersionCue.dll
2005-03-08 11:23 3,170,304 —-a-w c:\program files\VersionCueUI.dll
2005-03-03 19:39 425,984 —-a-w c:\program files\AdobeUpdater.dll
2005-03-01 20:46 45,486 -c–a-w c:\program files\Photoshop Read Me.wri
2005-02-25 17:50 157,035 -c–a-w c:\program files\LegalNotices.pdf
2005-02-17 15:28 663,552 -c–a-w c:\program files\FileInfo.dll
2005-02-15 06:03 561,152 -c–a-w c:\program files\JP2KLib.dll
2005-02-11 17:45 13,842 -c–a-w c:\program files\Activation ReadMe.htm
2005-02-10 17:36 143,360 -c–a-w c:\program files\epic_eula.dll
2005-02-08 17:43 49,152 -c–a-w c:\program files\persresen_US.dll
2005-02-08 17:43 45,056 -c–a-w c:\program files\eularesen_US.dll
2005-02-07 12:45 5,632 —-a-w c:\program files\agldt28l.dll
2005-01-19 18:31 155,648 —-a-w c:\program files\epic_regs.dll
2005-01-18 16:31 114,688 —-a-w c:\program files\epic_pers.dll
2005-01-12 18:23 180,224 —-a-w c:\program files\pdfsettings.dll
2004-08-24 19:55 126,976 —-a-w c:\program files\asneu.dll
2004-07-26 07:16 1,117,491 —-a-w c:\program files\dvdshrink32setup.exe
2004-06-22 16:57 589,824 —-a-w c:\program files\libagluc28.dll
2003-05-08 22:34 499,712 —-a-w c:\program files\msvcp71.dll
2003-05-08 22:32 348,160 —-a-w c:\program files\msvcr71.dll
2003-01-26 15:37 3,602 -c–a-w c:\program files\dme.reg
2000-08-29 04:19 401,462 —-a-w c:\program files\MSVCP60.DLL
1999-12-03 10:01 22,800 —-a-w c:\program files\Shfolder.dll
1999-02-02 04:00 266,293 -c–a-w c:\program files\Msvcrt.dll
2008-09-23 14:58 63,574 –sha-w c:\windows\system32\mafopiwo.dll
2008-09-23 14:58 63,574 –sha-w c:\windows\system32\vafubamu.dll
2008-08-05 01:58 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-23_10.45.22.98 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-26 02:51:54 97,950 –sha-w c:\windows\system32\fafisaya.dll
+ 2008-12-25 14:17:28 96,448 –sha-w c:\windows\system32\heyejopo.dll
+ 2008-12-26 02:51:52 85,135 –sha-w c:\windows\system32\loyuvejo.dll
+ 2008-12-24 02:58:26 84,781 –sha-w c:\windows\system32\mawijeho.dll
- 2008-12-23 15:40:44 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-26 03:34:23 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-24 02:58:26 97,877 –sha-w c:\windows\system32\tahiraga.dll
+ 2008-12-24 16:21:40 99,023 –sha-w c:\windows\system32\wegabalu.dll
+ 2008-12-26 03:34:25 16,384 —-atw c:\windows\TEMP\Perflib_Perfdata_580.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c1197e2-fc48-41c9-9ac0-8f0850b61ba1}]
2008-09-23 09:58 63574 –ahs—- c:\windows\system32\vafubamu.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-05-27 90112]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-05-21 135224]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"RtWLan"="c:\program files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe" [2005-03-25 491520]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-22 590848]
"deyefibawi"="c:\windows\system32\mafopiwo.dll" [2008-09-23 63574]
"CPM9fe72183"="c:\windows\system32\fafisaya.dll" [2008-12-25 97950]
"9cd4121f"="c:\windows\system32\loyuvejo.dll" [2008-12-25 85135]
"VTTimer"="VTTimer.exe" [2004-01-16 c:\windows\system32\VTTimer.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"nwiz"="nwiz.exe" [2004-10-29 c:\windows\system32\nwiz.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-22 219136]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-22 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
OptiCAL Startup.lnk - c:\program files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe [2003-03-18 3657728]
Smart Wizard Wireless Settings.lnk - c:\program files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe [2008-08-04 1044577]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-11-16 114688]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2005-10-04 745472]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"= "c:\windows\system32\fafisaya.dll" [2008-12-25 97950]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"= {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\fafisaya.dll [2008-12-25 97950]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\dayoyadu.dll c:\windows\system32\fafisaya.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\windows\system32\dayoyadu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Lphant\\eLePhantClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\Network Associates\\VirusScan\\shstat.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\WINDOWS\\system32\\WTablet\\TabUserW.exe"=
"c:\\WINDOWS\\explorer.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2005-07-08 55520]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2005-10-04 59136]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-08-08 14336]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2005-10-04 108160]
R3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2005-10-04 13532]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05497f18-fb9f-11dc-b1f6-000fb5b6d263}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40d40765-36e0-11da-b0cb-000fb5b6d263}]
\Shell\Auto\command - boot.pif
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.pif
.
Contents of the 'Scheduled Tasks' folder

2008-10-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2008-12-24 c:\windows\Tasks\ParetoLogic Registration.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2008-12-26 c:\windows\Tasks\smblsyfr.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2005-07-07 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-14 03:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.myspace.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - component: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-25 22:34:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\windows\system32\ojevuyol.ini 1603449 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\Tablet.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-12-25 22:40:12 - machine was rebooted [Compaq_Owner]
ComboFix-quarantined-files.txt 2008-12-26 03:39:59
ComboFix2.txt 2008-12-23 15:46:12
ComboFix3.txt 2008-07-10 00:40:02

Pre-Run: 57,589,919,744 bytes free
Post-Run: 57,571,880,960 bytes free

269 — E O F — 2008-12-26 03:23:37

Tomk

Post #4December 26, 2008, 5:14 AM UTC

kari82,

Please download Flash Disinfector.exe by sUBs and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the
utility to clean up those drives as well. Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that is plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

Disable your protection programs as we did before.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\windows\system32\vafubamu.dll
c:\windows\system32\mafopiwo.dll
c:\windows\system32\fafisaya.dll
c:\windows\system32\heyejopo.dll
c:\windows\system32\loyuvejo.dll
c:\windows\system32\mawijeho.dll
c:\windows\system32\tahiraga.dll
c:\windows\system32\wegabalu.dll
c:\windows\ALCXMNTR.EXE
c:\windows\system32\dayoyadu.dll
boot.pif
c:\windows\Tasks\smblsyfr.job

Rootkit::
c:\windows\system32\ojevuyol.ini

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c1197e2-fc48-41c9-9ac0-8f0850b61ba1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"deyefibawi"=-
"CPM9fe72183"=-
"9cd4121f"=-
"AlcxMonitor"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05497f18-fb9f-11dc-b1f6-000fb5b6d263}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40d40765-36e0-11da-b0cb-000fb5b6d263}]

Driver::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

ComboFix.txt
Kaspersky report
New HijackThis log taken after everything else completed

kari82

Post #5December 26, 2008, 5:25 PM UTC

it wolnt let me download that program when i click th link an error page comes up that says

File Not Found

Firefox can't find the file at http://www.techsupportforum.com/sectools/s…Disinfector.exe

* Could the item have been renamed, removed, or relocated?
* Is there a spelling, capitalization, or other typographical error in the address?
* Do you have sufficient access permissions to the requested item?

I kept clickin anyway and some how got something to download and then a box came up that said

C:\Documents and Settings\Compaq_Owner\Desktop\Flash_Disinfector.exe could not be saved, because the source file could not be read.

Try again later, or contact the server administrator.

Tomk

Post #6December 26, 2008, 5:30 PM UTC

kari82, Malware might be blocking it. Go ahead with the next steps.

kari82

Post #7December 26, 2008, 11:04 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:51:38 PM, on 12/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\rundll32.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: VS_IEHlprObj Class - {829CAB51-A4EA-4a15-87B6-4B7D0747939C} - C:\Program Files\Network Associates\VirusScan\bho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: OptiCAL Startup.lnk = C:\Program Files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 9342 bytes

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, December 26, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, December 26, 2008 16:40:53
Records in database: 1518105
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Files scanned: 112716
Threat name: 6
Infected objects: 12
Suspicious objects: 0
Duration of the scan: 03:39:17

File name / Threat name / Threats count
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\Beck\Beck - Cellphone's Dead.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\billie holiday\billie holiday[unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\Dave Matthews Band - Steady As We Go.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews[unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\shiney toy guns\shiney toy guns.wma Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Compaq_Owner\Application Data\Sun\Java\Deployment\cache\6.0\32\50c2ce60-505d1ce6 Infected: Trojan.Java.ClassLoader.as 3
C:\Documents and Settings\Compaq_Owner\Desktop\music\Beck\Beck - Cellphone's Dead.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Program Files\AdVantage\TR.dll Infected: not-a-virus:WebToolbar.Win32.WhenU.r 1
C:\QooBox\Quarantine\C\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe.vir Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f 1

The selected area was scanned.

ComboFix 08-12-21.04 - Compaq_Owner 2008-12-26 12:48:43.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.656 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\ALCXMNTR.EXE
c:\windows\system32\dayoyadu.dll
c:\windows\system32\fafisaya.dll
c:\windows\system32\heyejopo.dll
c:\windows\system32\loyuvejo.dll
c:\windows\system32\mafopiwo.dll
c:\windows\system32\mawijeho.dll
c:\windows\system32\tahiraga.dll
c:\windows\system32\vafubamu.dll
c:\windows\system32\wegabalu.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ALCXMNTR.EXE
c:\windows\system32\fafisaya.dll
c:\windows\system32\heyejopo.dll
c:\windows\system32\imivagin.ini
c:\windows\system32\mafopiwo.dll
c:\windows\system32\mawijeho.dll
c:\windows\system32\ojevuyol.ini
c:\windows\system32\tahiraga.dll
c:\windows\system32\vafubamu.dll
c:\windows\system32\wegabalu.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))
.

2008-12-22 03:20 . 2008-12-26 12:38 dr-h—– C:\$VAULT$.AVG
2008-12-22 03:15 . 2008-12-24 11:43 d——– c:\documents and settings\Compaq_Owner\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\LocalService\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\All Users\Application Data\Grisoft
2008-12-22 03:14 . 2008-12-22 03:19 d——– c:\documents and settings\All Users\Application Data\avg7
2008-12-18 06:14 . 2008-12-18 06:14 410,984 –a—— c:\windows\system32\deploytk.dll
2008-11-29 18:19 . 2008-11-29 18:20 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImagingAlbums
2008-11-29 18:19 . 2008-12-12 13:13 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImaging

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 18:05 ——— d—–w c:\program files\Quicken
2008-12-23 15:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Apple Computer
2008-12-22 09:50 ——— d—–w c:\program files\ornu
2008-12-18 11:13 ——— d—–w c:\program files\Java
2008-12-17 12:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\LimeWire
2008-12-17 11:01 ——— d—–w c:\program files\LimeWire
2008-11-01 12:15 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Yahoo!
2008-11-01 02:00 262,144 —-a-w C:\ntuser.dat
2008-10-25 22:20 47,360 —-a-w c:\documents and settings\Compaq_Owner\Application Data\pcouffin.sys
2008-06-26 04:06 7,496,920 —-a-w c:\program files\Firefox Setup 3.0.exe
2008-06-08 18:32 18,895,728 —-a-w c:\program files\Install_Messenger.exe
2007-10-26 02:26 779,312 -c–a-w c:\program files\MoveMediaPlayer_07074039.exe
2007-04-15 17:17 365,824 —-a-w c:\program files\bot250.zip
2007-04-05 14:35 5,154,816 -c–a-w c:\program files\WindowsDefender.msi
2006-10-25 17:49 322,329 -c–a-w c:\program files\Info101.widget
2006-08-30 01:29 198,254 —-a-w c:\program files\ProShots File Update.zip
2006-08-30 01:27 28,526,781 —-a-w c:\program files\Candid 2000 Mask.zip
2006-08-30 00:58 7,038,375 -c–a-w c:\program files\IPhotos Setup Install.exe
2006-08-14 03:26 1,355,912 -c–a-w c:\program files\install_flash_player.exe
2006-08-07 00:39 13,130,032 —-a-w c:\program files\IE7BETA3-WindowsXP-x86-enu.exe
2006-03-21 21:34 26,922 -c–a-w c:\program files\MoviePass Terms.html
2005-09-16 13:46 635,569 -c–a-w c:\program files\XviD-1.0.3-20122004.exe
2005-08-03 18:38 826 —-a-w c:\program files\install.adb
2005-04-23 02:52 315,624 —-a-w c:\program files\dxwebsetup.exe
2005-03-22 09:49 287,232 —-a-w c:\program files\Adobelmsvc Installer.dll
2005-03-22 08:29 19,533,824 —-a-w c:\program files\Photoshop.exe
2005-03-22 07:48 2,142,208 —-a-w c:\program files\PSArt.dll
2005-03-22 07:48 150,644 —-a-w c:\program files\TypeLibrary.tlb
2005-03-22 07:48 1,748,992 —-a-w c:\program files\PSViews.dll
2005-03-22 07:48 1,323,008 —-a-w c:\program files\Photoshop.dll
2005-03-22 07:43 1,144,622 —-a-w c:\program files\Tw10122.dat
2005-03-22 07:41 19,980,288 —-a-w c:\program files\ImageReady.exe
2005-03-22 07:13 41,984 —-a-w c:\program files\Plugin.dll
2005-03-16 22:57 61,440 -c–a-w c:\program files\regsresen_US.dll
2005-03-13 17:10 4,096,000 -c–a-w c:\program files\PDFL70.dll
2005-03-13 16:01 1,805,824 —-a-w c:\program files\AGM.dll
2005-03-11 00:31 3,715,072 -c–a-w c:\program files\MPS.dll
2005-03-09 21:59 1,560,169 —-a-w c:\program files\AdobeLM.dll
2005-03-09 08:32 151,552 -c–a-w c:\program files\AXE16SharedExpat.dll
2005-03-09 08:32 151,552 —-a-w c:\program files\AXE8SharedExpat.dll
2005-03-09 08:17 475,136 —-a-w c:\program files\AdobeXMP.dll
2005-03-09 08:07 630,784 —-a-w c:\program files\ACE.dll
2005-03-09 08:07 266,240 -c–a-w c:\program files\ARE.dll
2005-03-09 08:07 217,088 —-a-w c:\program files\BIBUtils.dll
2005-03-09 08:07 2,162,688 —-a-w c:\program files\CoolType.dll
2005-03-09 08:07 180,224 —-a-w c:\program files\Bib.dll
2005-03-08 11:23 4,153,344 —-a-w c:\program files\VersionCue.dll
2005-03-08 11:23 3,170,304 —-a-w c:\program files\VersionCueUI.dll
2005-03-03 19:39 425,984 —-a-w c:\program files\AdobeUpdater.dll
2005-03-01 20:46 45,486 -c–a-w c:\program files\Photoshop Read Me.wri
2005-02-25 17:50 157,035 -c–a-w c:\program files\LegalNotices.pdf
2005-02-17 15:28 663,552 -c–a-w c:\program files\FileInfo.dll
2005-02-15 06:03 561,152 -c–a-w c:\program files\JP2KLib.dll
2005-02-11 17:45 13,842 -c–a-w c:\program files\Activation ReadMe.htm
2005-02-10 17:36 143,360 -c–a-w c:\program files\epic_eula.dll
2005-02-08 17:43 49,152 -c–a-w c:\program files\persresen_US.dll
2005-02-08 17:43 45,056 -c–a-w c:\program files\eularesen_US.dll
2005-02-07 12:45 5,632 —-a-w c:\program files\agldt28l.dll
2005-01-19 18:31 155,648 —-a-w c:\program files\epic_regs.dll
2005-01-18 16:31 114,688 —-a-w c:\program files\epic_pers.dll
2005-01-12 18:23 180,224 —-a-w c:\program files\pdfsettings.dll
2004-08-24 19:55 126,976 —-a-w c:\program files\asneu.dll
2004-07-26 07:16 1,117,491 —-a-w c:\program files\dvdshrink32setup.exe
2004-06-22 16:57 589,824 —-a-w c:\program files\libagluc28.dll
2003-05-08 22:34 499,712 —-a-w c:\program files\msvcp71.dll
2003-05-08 22:32 348,160 —-a-w c:\program files\msvcr71.dll
2003-01-26 15:37 3,602 -c–a-w c:\program files\dme.reg
2000-08-29 04:19 401,462 —-a-w c:\program files\MSVCP60.DLL
1999-12-03 10:01 22,800 —-a-w c:\program files\Shfolder.dll
1999-02-02 04:00 266,293 -c–a-w c:\program files\Msvcrt.dll
2008-08-05 01:58 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-23_10.45.22.98 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-26 16:53:39 87,133 –sha-w c:\windows\system32\nigavimi.dll
- 2008-12-23 15:40:44 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-26 17:55:38 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-26 16:53:39 95,839 –sha-w c:\windows\system32\vetariwo.dll
+ 2008-12-26 17:55:43 16,384 —-atw c:\windows\TEMP\Perflib_Perfdata_52c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-05-27 90112]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-05-21 135224]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"RtWLan"="c:\program files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe" [2005-03-25 491520]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-22 590848]
"VTTimer"="VTTimer.exe" [2004-01-16 c:\windows\system32\VTTimer.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"nwiz"="nwiz.exe" [2004-10-29 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-22 219136]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-22 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
OptiCAL Startup.lnk - c:\program files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe [2003-03-18 3657728]
Smart Wizard Wireless Settings.lnk - c:\program files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe [2008-08-04 1044577]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-11-16 114688]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2005-10-04 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Lphant\\eLePhantClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\Network Associates\\VirusScan\\shstat.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\WINDOWS\\system32\\WTablet\\TabUserW.exe"=
"c:\\WINDOWS\\AGRSMMSG.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2005-07-08 55520]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2005-10-04 59136]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-08-08 14336]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2005-10-04 108160]
R3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2005-10-04 13532]
.
Contents of the 'Scheduled Tasks' folder

2008-10-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2008-12-24 c:\windows\Tasks\ParetoLogic Registration.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2008-12-26 c:\windows\Tasks\smblsyfr.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2005-07-07 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-14 03:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.myspace.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - component: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 13:05:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\Tablet.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-12-26 13:10:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-26 18:10:23
ComboFix2.txt 2008-12-26 03:40:13
ComboFix3.txt 2008-12-23 15:46:12
ComboFix4.txt 2008-07-10 00:40:02

Pre-Run: 57,342,492,672 bytes free
Post-Run: 57,325,318,144 bytes free

259 — E O F — 2008-12-26 03:23:37

Tomk

Post #8December 26, 2008, 11:49 PM UTC

kari82,

LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm
See Clean/Infected P2P Programs here

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\Beck\Beck - Cellphone's Dead.mp3
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\billie holiday\billie holiday[unreleased rare track].mp3
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\Dave Matthews Band - Steady As We Go.mp3
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews.mp3
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews[unreleased rare track].mp3
C:\Documents and Settings\All Users\Documents\kari\My Music\limewire downloads\shiney toy guns\shiney toy guns.wma
C:\Documents and Settings\Compaq_Owner\Application Data\Sun\Java\Deployment\cache\6.0\32\50c2ce60-505d1ce6
C:\Documents and Settings\Compaq_Owner\Desktop\music\Beck\Beck - Cellphone's Dead.mp3
C:\Program Files\AdVantage\TR.dll
c:\windows\Tasks\smblsyfr.job

Folder::

Registry::

Driver::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Download Rooter.exe to your desktop

Then doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

kari82

Post #9December 27, 2008, 3:49 AM UTC

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon™ XP 3200+ )
BIOS : Rev. 3.10
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot

Antivirus : AVG 7.5.552 7.5.552 (Activated)

C:\ (Local Disk) - NTFS - Total:149 Go (Free:53 Go)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (CD or DVD)

Fri 12/26/2008|22:46

———————-\\ Search..

———————-\\ Cracks & Keygens..

C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\Crack
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\Deployment.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\Instructions.nfo
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\redist
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\Setup.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\Torrent downloaded from Demonoid.com.txt
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\VersionInfo.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\WinBootstrapper.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\WinBootstrapper1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\Crack\Photoshop.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeALMAnchorServiceAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAssetServices3All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAUM5.1All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeBridge2All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCameraRaw4.0All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCMapsAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorCommonSetAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorNA_RecommendedAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorPhotoshopAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeFontsAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeHelpViewerAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeLinguisticsAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFL8All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFSettingsNAEU
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePhotoshop10en_US
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeStockPhotos1.5All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeTypeSupportAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeVersionCueClient3All
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeWinSoftLinguisticsPluginAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeXMPPanelsAll
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\BridgeStartMeeting
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\setup.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAssetServices3All\AdobeAssetServices3All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAssetServices3All\AdobeAssetServices3All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAssetServices3All\AdobeAssetServices3All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAssetServices3All\AdobeAssetServices3All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAUM5.1All\AdobeAUM5.1All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAUM5.1All\AdobeAUM5.1All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAUM5.1All\AdobeAUM5.1All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeAUM5.1All\AdobeAUM5.1All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeBridge2All\AdobeBridge2All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeBridge2All\AdobeBridge2All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeBridge2All\AdobeBridge2All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeBridge2All\AdobeBridge2All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCMapsAll\AdobeCMapsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCMapsAll\AdobeCMapsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCMapsAll\AdobeCMapsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeCMapsAll\AdobeCMapsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\en_US.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\ja_JP.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\ko_KR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\zh_CN.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorEU_ExtraSettingsAll\zh_TW.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\ar_AE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\cs_CZ.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\da_DK.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\de_DE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\el_GR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\en_GB.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\en_US.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\es_ES.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\fi_FI.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\fr_FR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\hu_HU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\it_IT.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\nb_NO.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\nl_NL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\pl_PL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\pt_BR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\ru_RU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\sv_SE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorJA_ExtraSettingsAll\tr_TR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorNA_RecommendedAll\en_US.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\ar_AE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\bg_BG.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\ca_ES.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\cs_CZ.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\da_DK.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\de_DE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\el_GR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\en_GB.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\en_US.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\es_ES.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\et_EE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\fi_FI.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\fr_FR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\he_IL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\hr_HR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\hu_HU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\it_IT.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\ja_JP.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\ko_KR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\lt_LT.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\lv_LV.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\nb_NO.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\nl_NL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\pl_PL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\pt_BR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\ro_RO.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\ru_RU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\sk_SK.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\sl_SI.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\sv_SE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\tr_TR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\uk_UA.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\zh_CN.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDefaultLanguageCS3All\zh_TW.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Bitte lesen.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Ilgeobogi.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Lees mij.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Leggimi.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Lisez-moi.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Léame.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Oyomikudasai.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Read Me.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Tu Wo Tang An.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Viktigt.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Zishu.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\ar_AE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\be_BY.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\bg_BG.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\ca_ES.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\cs_CZ.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\da_DK.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\de_DE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\el_GR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\en_GB.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\en_US.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\en_XC.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\en_XM.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\es_ES.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\es_QM.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\et_EE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\fi_FI.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\fr_FR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\fr_XM.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\he_IL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\hi_IN.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\hr_HR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\hu_HU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\is_IS.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\it_IT.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\ja_JP.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\ko_KR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\lt_LT.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\lv_LV.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\mk_MK.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\nb_NO.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\nl_NL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\pl_PL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\pt_BR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\ro_RO.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\ru_RU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\sh_YU.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\sk_SK.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\sl_SI.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\sq_AL.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\sv_SE.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\th_TH.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\tr_TR.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\uk_UA.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\vi_VN.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\zh_CN.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeExtendScriptToolKitAll\zh_TW.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeFontsAll\AdobeFontsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeFontsAll\AdobeFontsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeFontsAll\AdobeFontsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeFontsAll\AdobeFontsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFL8All\AdobePDFL8All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFL8All\AdobePDFL8All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFL8All\AdobePDFL8All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFL8All\AdobePDFL8All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFSettingsNAEU\AdobePDFSettingsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFSettingsNAEU\AdobePDFSettingsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFSettingsNAEU\AdobePDFSettingsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePDFSettingsNAEU\AdobePDFSettingsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePhotoshop10en_US\AdobePhotoshop10en_US.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePhotoshop10en_US\AdobePhotoshop10en_US.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePhotoshop10en_US\AdobePhotoshop10en_US.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePhotoshop10en_US\AdobePhotoshop10en_US1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobePhotoshop10en_US\en_US.mst
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeStockPhotos1.5All\AdobeStockPhotos1.5All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeStockPhotos1.5All\AdobeStockPhotos1.5All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeStockPhotos1.5All\AdobeStockPhotos1.5All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeStockPhotos1.5All\AdobeStockPhotos1.5All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeTypeSupportAll\AdobeTypeSupportAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeTypeSupportAll\AdobeTypeSupportAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeTypeSupportAll\AdobeTypeSupportAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeTypeSupportAll\AdobeTypeSupportAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeVersionCueClient3All\AdobeVersionCueClient3All.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeVersionCueClient3All\AdobeVersionCueClient3All.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeVersionCueClient3All\AdobeVersionCueClient3All.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeVersionCueClient3All\AdobeVersionCueClient3All1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeWinSoftLinguisticsPluginAll\AdobeWinSoftLinguisticsPluginAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeWinSoftLinguisticsPluginAll\AdobeWinSoftLinguisticsPluginAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeWinSoftLinguisticsPluginAll\AdobeWinSoftLinguisticsPluginAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeWinSoftLinguisticsPluginAll\AdobeWinSoftLinguisticsPluginAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeXMPPanelsAll\AdobeXMPPanelsAll.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeXMPPanelsAll\AdobeXMPPanelsAll.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeXMPPanelsAll\AdobeXMPPanelsAll.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\AdobeXMPPanelsAll\AdobeXMPPanelsAll1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\BridgeStartMeeting\BridgeStartMeeting.boot.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\BridgeStartMeeting\BridgeStartMeeting.msi
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\BridgeStartMeeting\BridgeStartMeeting.proxy.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\payloads\BridgeStartMeeting\BridgeStartMeeting1.cab
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\redist\WindowsInstaller-KB893803-v2-x86.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\redist\WindowsServer2003-KB898715-ia64-enu.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\redist\WindowsServer2003-KB898715-x64-enu.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\redist\WindowsServer2003-KB898715-x86-enu.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\redist\WindowsXP-KB898715-x64-enu.exe
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\main.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\main.xml
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\alert
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\scripts
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\alert\alert.css
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\alert\alert.html
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\alert\alert_ie.css
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\scripts\ContainerProxy.js
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\scripts\localization.js
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\scripts\silentWorkflow.js
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\common\scripts\utils.js
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\css
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\img
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\css\styles.css
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\img\progbarLeft_on.png
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\img\progbarRight.png
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\img\progbar_on.png
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack\resources\media\img\progbox.png
C:\DOCUME~1\COMPAQ~1\Recent\(CD Key) Microsoft Windows 95 98 Me 2000 2K Xp Plus Office Product Keys Cd Key License Crack.lnk

1 - "C:\Rooter$\Rooter_1.txt" - Fri 12/26/2008|22:46

———————-\\ Scan completed at 22:46

ComboFix 08-12-21.04 - Compaq_Owner 2008-12-26 22:34:44.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.515 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\Beck\Beck - Cellphone's Dead.mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\billie holiday\billie holiday[unreleased rare track].mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\Dave Matthews Band - Steady As We Go.mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews.mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews[unreleased rare track].mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\shiney toy guns\shiney toy guns.wma
c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\Deployment\cache\6.0\32\50c2ce60-505d1ce6
c:\documents and settings\Compaq_Owner\Desktop\music\Beck\Beck - Cellphone's Dead.mp3
c:\program files\AdVantage\TR.dll
c:\windows\Tasks\smblsyfr.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\Beck\Beck - Cellphone's Dead.mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\billie holiday\billie holiday[unreleased rare track].mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\Dave Matthews Band - Steady As We Go.mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews.mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\dave matthews\dave matthews[unreleased rare track].mp3
c:\documents and settings\All Users\Documents\kari\My Music\limewire downloads\shiney toy guns\shiney toy guns.wma
c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\Deployment\cache\6.0\32\50c2ce60-505d1ce6
c:\documents and settings\Compaq_Owner\Desktop\music\Beck\Beck - Cellphone's Dead.mp3
c:\program files\AdVantage\TR.dll
c:\windows\Tasks\smblsyfr.job

.
((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.

2008-12-22 03:20 . 2008-12-26 18:39 dr-h—– C:\$VAULT$.AVG
2008-12-22 03:15 . 2008-12-24 11:43 d——– c:\documents and settings\Compaq_Owner\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\LocalService\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\All Users\Application Data\Grisoft
2008-12-22 03:14 . 2008-12-22 03:19 d——– c:\documents and settings\All Users\Application Data\avg7
2008-12-18 06:14 . 2008-12-18 06:14 410,984 –a—— c:\windows\system32\deploytk.dll
2008-11-29 18:19 . 2008-11-29 18:20 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImagingAlbums
2008-11-29 18:19 . 2008-12-12 13:13 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImaging

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-27 03:34 ——— d—–w c:\program files\AdVantage
2008-12-26 20:09 ——— d—–w c:\program files\Quicken
2008-12-26 16:53 95,839 –sha-w c:\windows\system32\vetariwo.dll
2008-12-26 16:53 87,133 –sha-w c:\windows\system32\nigavimi.dll
2008-12-23 15:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Apple Computer
2008-12-23 14:58 63,574 –sha-w c:\windows\system32\bofofevu.dll
2008-12-22 09:50 ——— d—–w c:\program files\ornu
2008-12-18 11:13 ——— d—–w c:\program files\Java
2008-12-17 12:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\LimeWire
2008-12-17 11:01 ——— d—–w c:\program files\LimeWire
2008-11-01 12:15 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Yahoo!
2008-11-01 02:00 262,144 —-a-w C:\ntuser.dat
2008-10-25 22:20 47,360 —-a-w c:\documents and settings\Compaq_Owner\Application Data\pcouffin.sys
2008-10-23 12:36 286,720 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 —-a-w c:\windows\system32\wininet.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:06 268,648 —-a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 —-a-w c:\windows\system32\muweb.dll
2008-10-03 10:02 247,326 —-a-w c:\windows\system32\strmdll.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-06-26 04:06 7,496,920 —-a-w c:\program files\Firefox Setup 3.0.exe
2008-06-08 18:32 18,895,728 —-a-w c:\program files\Install_Messenger.exe
2007-10-26 02:26 779,312 -c–a-w c:\program files\MoveMediaPlayer_07074039.exe
2007-04-15 17:17 365,824 —-a-w c:\program files\bot250.zip
2007-04-05 14:35 5,154,816 -c–a-w c:\program files\WindowsDefender.msi
2006-10-25 17:49 322,329 -c–a-w c:\program files\Info101.widget
2006-08-30 01:29 198,254 —-a-w c:\program files\ProShots File Update.zip
2006-08-30 01:27 28,526,781 —-a-w c:\program files\Candid 2000 Mask.zip
2006-08-30 00:58 7,038,375 -c–a-w c:\program files\IPhotos Setup Install.exe
2006-08-14 03:26 1,355,912 -c–a-w c:\program files\install_flash_player.exe
2006-08-07 00:39 13,130,032 —-a-w c:\program files\IE7BETA3-WindowsXP-x86-enu.exe
2006-03-21 21:34 26,922 -c–a-w c:\program files\MoviePass Terms.html
2005-09-16 13:46 635,569 -c–a-w c:\program files\XviD-1.0.3-20122004.exe
2005-08-03 18:38 826 —-a-w c:\program files\install.adb
2005-04-23 02:52 315,624 —-a-w c:\program files\dxwebsetup.exe
2005-03-22 09:49 287,232 —-a-w c:\program files\Adobelmsvc Installer.dll
2005-03-22 08:29 19,533,824 —-a-w c:\program files\Photoshop.exe
2005-03-22 07:48 2,142,208 —-a-w c:\program files\PSArt.dll
2005-03-22 07:48 150,644 —-a-w c:\program files\TypeLibrary.tlb
2005-03-22 07:48 1,748,992 —-a-w c:\program files\PSViews.dll
2005-03-22 07:48 1,323,008 —-a-w c:\program files\Photoshop.dll
2005-03-22 07:43 1,144,622 —-a-w c:\program files\Tw10122.dat
2005-03-22 07:41 19,980,288 —-a-w c:\program files\ImageReady.exe
2005-03-22 07:13 41,984 —-a-w c:\program files\Plugin.dll
2005-03-16 22:57 61,440 -c–a-w c:\program files\regsresen_US.dll
2005-03-13 17:10 4,096,000 -c–a-w c:\program files\PDFL70.dll
2005-03-13 16:01 1,805,824 —-a-w c:\program files\AGM.dll
2005-03-11 00:31 3,715,072 -c–a-w c:\program files\MPS.dll
2005-03-09 21:59 1,560,169 —-a-w c:\program files\AdobeLM.dll
2005-03-09 08:32 151,552 -c–a-w c:\program files\AXE16SharedExpat.dll
2005-03-09 08:32 151,552 —-a-w c:\program files\AXE8SharedExpat.dll
2005-03-09 08:17 475,136 —-a-w c:\program files\AdobeXMP.dll
2005-03-09 08:07 630,784 —-a-w c:\program files\ACE.dll
2005-03-09 08:07 266,240 -c–a-w c:\program files\ARE.dll
2005-03-09 08:07 217,088 —-a-w c:\program files\BIBUtils.dll
2005-03-09 08:07 2,162,688 —-a-w c:\program files\CoolType.dll
2005-03-09 08:07 180,224 —-a-w c:\program files\Bib.dll
2005-03-08 11:23 4,153,344 —-a-w c:\program files\VersionCue.dll
2005-03-08 11:23 3,170,304 —-a-w c:\program files\VersionCueUI.dll
2005-03-03 19:39 425,984 —-a-w c:\program files\AdobeUpdater.dll
2005-03-01 20:46 45,486 -c–a-w c:\program files\Photoshop Read Me.wri
2005-02-25 17:50 157,035 -c–a-w c:\program files\LegalNotices.pdf
2005-02-17 15:28 663,552 -c–a-w c:\program files\FileInfo.dll
2005-02-15 06:03 561,152 -c–a-w c:\program files\JP2KLib.dll
2005-02-11 17:45 13,842 -c–a-w c:\program files\Activation ReadMe.htm
2005-02-10 17:36 143,360 -c–a-w c:\program files\epic_eula.dll
2005-02-08 17:43 49,152 -c–a-w c:\program files\persresen_US.dll
2005-02-08 17:43 45,056 -c–a-w c:\program files\eularesen_US.dll
2005-02-07 12:45 5,632 —-a-w c:\program files\agldt28l.dll
2005-01-19 18:31 155,648 —-a-w c:\program files\epic_regs.dll
2005-01-18 16:31 114,688 —-a-w c:\program files\epic_pers.dll
2005-01-12 18:23 180,224 —-a-w c:\program files\pdfsettings.dll
2004-08-24 19:55 126,976 —-a-w c:\program files\asneu.dll
2004-07-26 07:16 1,117,491 —-a-w c:\program files\dvdshrink32setup.exe
2004-06-22 16:57 589,824 —-a-w c:\program files\libagluc28.dll
2003-05-08 22:34 499,712 —-a-w c:\program files\msvcp71.dll
2003-05-08 22:32 348,160 —-a-w c:\program files\msvcr71.dll
2003-01-26 15:37 3,602 -c–a-w c:\program files\dme.reg
2000-08-29 04:19 401,462 —-a-w c:\program files\MSVCP60.DLL
1999-12-03 10:01 22,800 —-a-w c:\program files\Shfolder.dll
1999-02-02 04:00 266,293 -c–a-w c:\program files\Msvcrt.dll
2008-08-05 01:58 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-23_10.45.22.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-23 15:40:44 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-26 17:55:38 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-26 17:55:43 16,384 —-atw c:\windows\TEMP\Perflib_Perfdata_52c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-05-27 90112]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-05-21 135224]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"RtWLan"="c:\program files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe" [2005-03-25 491520]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-22 590848]
"VTTimer"="VTTimer.exe" [2004-01-16 c:\windows\system32\VTTimer.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"nwiz"="nwiz.exe" [2004-10-29 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-22 219136]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-22 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
OptiCAL Startup.lnk - c:\program files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe [2003-03-18 3657728]
Smart Wizard Wireless Settings.lnk - c:\program files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe [2008-08-04 1044577]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-11-16 114688]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2005-10-04 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Lphant\\eLePhantClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\Network Associates\\VirusScan\\shstat.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\WINDOWS\\system32\\WTablet\\TabUserW.exe"=
"c:\\WINDOWS\\AGRSMMSG.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2005-07-08 55520]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2005-10-04 59136]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-08-08 14336]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2005-10-04 108160]
R3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2005-10-04 13532]
.
Contents of the 'Scheduled Tasks' folder

2008-10-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2008-12-26 c:\windows\Tasks\ParetoLogic Registration.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2005-07-07 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-14 03:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.myspace.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=Q404&bd;=presario&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=Q404&bd;=presario&pf;=desktop
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - component: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 22:38:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-26 22:39:35
ComboFix-quarantined-files.txt 2008-12-27 03:38:43
ComboFix2.txt 2008-12-26 18:10:41
ComboFix3.txt 2008-12-26 03:40:13
ComboFix4.txt 2008-12-23 15:46:12
ComboFix5.txt 2008-12-27 03:28:26

Pre-Run: 57,264,144,384 bytes free
Post-Run: 57,300,168,704 bytes free

256 — E O F — 2008-12-26 03:23:37

Tomk

Post #10December 27, 2008, 4:19 AM UTC

kari82,

Odds are, you got infected because you download cracks.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\DOCUME~1\COMPAQ~1\Recent\(CD Key) Microsoft Windows 95 98 Me 2000 2K Xp Plus Office Product Keys Cd Key License Crack.lnk
c:\windows\system32\vetariwo.dll
c:\windows\system32\nigavimi.dll
c:\windows\system32\bofofevu.dll

Folder::
C:\DOCUME~1\COMPAQ~1\Desktop\progrms\Adobe\Adobe Photoshop CS3 Extended + Crack

Registry::

Driver::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also, please post me a new HijackThis log.

kari82

Post #11December 27, 2008, 7:26 AM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:25:04 AM, on 12/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: VS_IEHlprObj Class - {829CAB51-A4EA-4a15-87B6-4B7D0747939C} - C:\Program Files\Network Associates\VirusScan\bho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [RtWLan] C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe /H
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: OptiCAL Startup.lnk = C:\Program Files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 9106 bytes

ComboFix 08-12-21.04 - Compaq_Owner 2008-12-27 2:11:08.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.585 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\docume~1\COMPAQ~1\Recent\(CD Key) Microsoft Windows 95 98 Me 2000 2K Xp Plus Office Product Keys Cd Key License Crack.lnk
c:\windows\system32\bofaofevu.dll
c:\windows\system32\nigavimi.dll
c:\windows\system32\vetariwo.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\COMPAQ~1\Recent\(CD Key) Microsoft Windows 95 98 Me 2000 2K Xp Plus Office Product Keys Cd Key License Crack.lnk
c:\windows\system32\bofofevu.dll
c:\windows\system32\nigavimi.dll
c:\windows\system32\vetariwo.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.

2008-12-26 22:46 . 2008-12-26 22:46 d——– C:\Rooter$
2008-12-22 03:20 . 2008-12-26 18:39 dr-h—– C:\$VAULT$.AVG
2008-12-22 03:15 . 2008-12-24 11:43 d——– c:\documents and settings\Compaq_Owner\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\LocalService\Application Data\AVG7
2008-12-22 03:14 . 2008-12-22 03:14 d——– c:\documents and settings\All Users\Application Data\Grisoft
2008-12-22 03:14 . 2008-12-22 03:19 d——– c:\documents and settings\All Users\Application Data\avg7
2008-12-18 06:14 . 2008-12-18 06:14 410,984 –a—— c:\windows\system32\deploytk.dll
2008-11-29 18:19 . 2008-11-29 18:20 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImagingAlbums
2008-11-29 18:19 . 2008-12-12 13:13 d——– c:\documents and settings\Compaq_Owner\.BlackRiverImaging

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-27 03:34 ——— d—–w c:\program files\AdVantage
2008-12-26 20:09 ——— d—–w c:\program files\Quicken
2008-12-23 15:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Apple Computer
2008-12-22 09:50 ——— d—–w c:\program files\ornu
2008-12-18 11:13 ——— d—–w c:\program files\Java
2008-12-17 12:48 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\LimeWire
2008-12-17 11:01 ——— d—–w c:\program files\LimeWire
2008-11-01 12:15 ——— d—–w c:\documents and settings\Compaq_Owner\Application Data\Yahoo!
2008-11-01 02:00 262,144 —-a-w C:\ntuser.dat
2008-10-25 22:20 47,360 —-a-w c:\documents and settings\Compaq_Owner\Application Data\pcouffin.sys
2008-10-23 12:36 286,720 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 —-a-w c:\windows\system32\wininet.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:06 268,648 —-a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 —-a-w c:\windows\system32\muweb.dll
2008-10-03 10:02 247,326 —-a-w c:\windows\system32\strmdll.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-06-26 04:06 7,496,920 —-a-w c:\program files\Firefox Setup 3.0.exe
2008-06-08 18:32 18,895,728 —-a-w c:\program files\Install_Messenger.exe
2007-10-26 02:26 779,312 -c–a-w c:\program files\MoveMediaPlayer_07074039.exe
2007-04-15 17:17 365,824 —-a-w c:\program files\bot250.zip
2007-04-05 14:35 5,154,816 -c–a-w c:\program files\WindowsDefender.msi
2006-10-25 17:49 322,329 -c–a-w c:\program files\Info101.widget
2006-08-30 01:29 198,254 —-a-w c:\program files\ProShots File Update.zip
2006-08-30 01:27 28,526,781 —-a-w c:\program files\Candid 2000 Mask.zip
2006-08-30 00:58 7,038,375 -c–a-w c:\program files\IPhotos Setup Install.exe
2006-08-14 03:26 1,355,912 -c–a-w c:\program files\install_flash_player.exe
2006-08-07 00:39 13,130,032 —-a-w c:\program files\IE7BETA3-WindowsXP-x86-enu.exe
2006-03-21 21:34 26,922 -c–a-w c:\program files\MoviePass Terms.html
2005-09-16 13:46 635,569 -c–a-w c:\program files\XviD-1.0.3-20122004.exe
2005-08-03 18:38 826 —-a-w c:\program files\install.adb
2005-04-23 02:52 315,624 —-a-w c:\program files\dxwebsetup.exe
2005-03-22 09:49 287,232 —-a-w c:\program files\Adobelmsvc Installer.dll
2005-03-22 08:29 19,533,824 —-a-w c:\program files\Photoshop.exe
2005-03-22 07:48 2,142,208 —-a-w c:\program files\PSArt.dll
2005-03-22 07:48 150,644 —-a-w c:\program files\TypeLibrary.tlb
2005-03-22 07:48 1,748,992 —-a-w c:\program files\PSViews.dll
2005-03-22 07:48 1,323,008 —-a-w c:\program files\Photoshop.dll
2005-03-22 07:43 1,144,622 —-a-w c:\program files\Tw10122.dat
2005-03-22 07:41 19,980,288 —-a-w c:\program files\ImageReady.exe
2005-03-22 07:13 41,984 —-a-w c:\program files\Plugin.dll
2005-03-16 22:57 61,440 -c–a-w c:\program files\regsresen_US.dll
2005-03-13 17:10 4,096,000 -c–a-w c:\program files\PDFL70.dll
2005-03-13 16:01 1,805,824 —-a-w c:\program files\AGM.dll
2005-03-11 00:31 3,715,072 -c–a-w c:\program files\MPS.dll
2005-03-09 21:59 1,560,169 —-a-w c:\program files\AdobeLM.dll
2005-03-09 08:32 151,552 -c–a-w c:\program files\AXE16SharedExpat.dll
2005-03-09 08:32 151,552 —-a-w c:\program files\AXE8SharedExpat.dll
2005-03-09 08:17 475,136 —-a-w c:\program files\AdobeXMP.dll
2005-03-09 08:07 630,784 —-a-w c:\program files\ACE.dll
2005-03-09 08:07 266,240 -c–a-w c:\program files\ARE.dll
2005-03-09 08:07 217,088 —-a-w c:\program files\BIBUtils.dll
2005-03-09 08:07 2,162,688 —-a-w c:\program files\CoolType.dll
2005-03-09 08:07 180,224 —-a-w c:\program files\Bib.dll
2005-03-08 11:23 4,153,344 —-a-w c:\program files\VersionCue.dll
2005-03-08 11:23 3,170,304 —-a-w c:\program files\VersionCueUI.dll
2005-03-03 19:39 425,984 —-a-w c:\program files\AdobeUpdater.dll
2005-03-01 20:46 45,486 -c–a-w c:\program files\Photoshop Read Me.wri
2005-02-25 17:50 157,035 -c–a-w c:\program files\LegalNotices.pdf
2005-02-17 15:28 663,552 -c–a-w c:\program files\FileInfo.dll
2005-02-15 06:03 561,152 -c–a-w c:\program files\JP2KLib.dll
2005-02-11 17:45 13,842 -c–a-w c:\program files\Activation ReadMe.htm
2005-02-10 17:36 143,360 -c–a-w c:\program files\epic_eula.dll
2005-02-08 17:43 49,152 -c–a-w c:\program files\persresen_US.dll
2005-02-08 17:43 45,056 -c–a-w c:\program files\eularesen_US.dll
2005-02-07 12:45 5,632 —-a-w c:\program files\agldt28l.dll
2005-01-19 18:31 155,648 —-a-w c:\program files\epic_regs.dll
2005-01-18 16:31 114,688 —-a-w c:\program files\epic_pers.dll
2005-01-12 18:23 180,224 —-a-w c:\program files\pdfsettings.dll
2004-08-24 19:55 126,976 —-a-w c:\program files\asneu.dll
2004-07-26 07:16 1,117,491 —-a-w c:\program files\dvdshrink32setup.exe
2004-06-22 16:57 589,824 —-a-w c:\program files\libagluc28.dll
2003-05-08 22:34 499,712 —-a-w c:\program files\msvcp71.dll
2003-05-08 22:32 348,160 —-a-w c:\program files\msvcr71.dll
2003-01-26 15:37 3,602 -c–a-w c:\program files\dme.reg
2000-08-29 04:19 401,462 —-a-w c:\program files\MSVCP60.DLL
1999-12-03 10:01 22,800 —-a-w c:\program files\Shfolder.dll
1999-02-02 04:00 266,293 -c–a-w c:\program files\Msvcrt.dll
2008-08-05 01:58 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-23_10.45.22.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-23 15:40:44 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-27 06:52:21 16,137 —-a-w c:\windows\system32\tablet.dat
+ 2008-12-27 06:52:31 16,384 —-atw c:\windows\TEMP\Perflib_Perfdata_574.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-05-27 90112]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-05-21 135224]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"RtWLan"="c:\program files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe" [2005-03-25 491520]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-10-29 4620288]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-10-29 86016]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-22 590848]
"VTTimer"="VTTimer.exe" [2004-01-16 c:\windows\system32\VTTimer.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"nwiz"="nwiz.exe" [2004-10-29 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-22 219136]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-04-22 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
OptiCAL Startup.lnk - c:\program files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe [2003-03-18 3657728]
Smart Wizard Wireless Settings.lnk - c:\program files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe [2008-08-04 1044577]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-11-16 114688]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2005-10-04 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Lphant\\eLePhantClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\Network Associates\\VirusScan\\shstat.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\WINDOWS\\system32\\WTablet\\TabUserW.exe"=
"c:\\WINDOWS\\AGRSMMSG.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2005-07-08 55520]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2005-10-04 59136]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-08-08 14336]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys [2005-10-04 108160]
R3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2005-10-04 13532]
.
Contents of the 'Scheduled Tasks' folder

2008-10-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-27 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2008-12-26 c:\windows\Tasks\ParetoLogic Registration.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2005-07-07 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-14 03:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.myspace.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - component: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll
FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\yher4ua1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 02:14:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-27 2:16:03
ComboFix-quarantined-files.txt 2008-12-27 07:15:14
ComboFix2.txt 2008-12-27 03:39:36
ComboFix3.txt 2008-12-26 18:10:41
ComboFix4.txt 2008-12-26 03:40:13
ComboFix5.txt 2008-12-27 07:09:44

Pre-Run: 56,717,475,840 bytes free
Post-Run: 57,312,829,440 bytes free

242 — E O F — 2008-12-26 03:23:37

Tomk

Post #12December 27, 2008, 7:31 AM UTC

kari82,

Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.
You can delete any other tools that we ran.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:

From your desktop, right-click on My Computer,
click on Properties
Select the Automatic Updates tab
Click on Automatic
Click on Apply button
Click on OK to exit.

If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Tomk

Post #13December 28, 2008, 1:43 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] my computer is pissing me off...help

✨ Ask AI

Ask AI