Spyware / Malware / Virus Removal

[Resolved] No access on infected PC

15 min read

Looking for the outcome? Ask AI

kangaroo Topic Starter

Post #1January 16, 2009, 11:51 AM UTC

A friend has a badly infected PC running Windows XP. His AVG free detected fakealert[1].htm was present and he periodically gets alerts popping up in the middle of the screen. I'm not sure exactly what they say and the one that came up while I was talking on the phone to him disappeared before I could get him to copy it to me. He cannot update AVG as the server connection is blocked. Nor can he connect to this web site (I gave him instructions to create an account and post a topic), nor either the ESET or Kaspersky online scanner sites. I sent him the Chrome setup file (to see if the site blocking problem was IE specific or if his TCP/IP stack had been corrupted) and the HiJackThis file. As exe files they were blocked by his ISP's filter; so I renamed their extensions from exe to efw and zipped them. He received the zip file and I talked him through extracting the files to his desktop and then renaming them from efw to exe. When he tried to run them he got the error dialog: Titlebar: C:\\Document and Settings\Bob\Desktop\.exe.exe; message Red X: Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the file. I had him go into Control Panel | User Accounts which showed his account as Computer Administrator. So I'm not sure if his administrator privileges can be denied by some malware. I'm not sure why the file name referenced in the title bar shows ".exe.exe"; I had told him to right click on the file on his desktop and select Rename then backspace over the fw and replace it with xe to change the file extension from efw to exe. When he could not run HiJackThis.exe I told him to rename the file, by right clicking and selecting Rename and then with the file name highlighted to just type "mike.exe" and tap the Enter key to apply the new name. When he ran this the error dialog box used the file name "mike.exe.exe" which I talked him through doing a PrtSc, paste into a Word document and emailing that to me so I got the exact text of the error. Just to be sure the files I sent were not corrupted, I did the rename to them on my PC and then ran them both without any errors. Can you suggest a course of action to try and remove all this malware from his PC, please? I've put HiJackThis, MBAM and other utilities I have seen you refer to in other posts onto a CD and can take that to him to get over the problem of not being able to connect to these sites. However, I don't know how to get over the problem that the files will not run. Hoping you can help on this baffling problem.

LDTate

Post #2January 18, 2009, 1:46 PM UTC

Hello and Welcome to the forum.

Unable to access websites

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

NOTE: worksnow is actually Combofix renamed so user is able download and run Combofix

Download worksnow from HERE:

* IMPORTANT !!! Save worksnow to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on worksnow & follow the prompts.

Note: worksnow will run without the Recovery Console installed.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, combofix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

kangaroo

Post #3January 20, 2009, 10:48 PM UTC

Hi LDT; sorry for the delay but without any Internet browsing working my friend had to wait until I could take the worksnow file to him. Have just done that. Here is the log from ComboFix:

ComboFix 09-01-05.05 - Bob 2009-01-21 9:01:23.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.655 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Outdated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Antivirus 2009
c:\program files\Antivirus 2009\av2009.exe
c:\program files\INSTALL.LOG
C:\smp.bat
c:\windows\IE4 Error Log.txt
c:\windows\system32\DelSelf.bat
c:\windows\system32\ieupdates.exe.tmp
c:\windows\system32\msxml71.dll
c:\windows\system32\sysproc64
c:\windows\system32\sysproc64\sysproc32.sys
c:\windows\system32\sysproc64\sysproc86.sys

.
((((((((((((((((((((((((( Files Created from 2008-12-20 to 2009-01-20 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-19 04:32 77,824 —-a-w c:\windows\system32\7Jv5vJhh.exe
2009-01-17 02:06 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2008-12-13 06:37 ——— d—–w c:\program files\NoAdware3
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U"="copy" [X]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Cognac"="c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe" [2009-01-18 98820]
"MSFox"="c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe" [2008-12-02 73220]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b3b5a6c-42bf-11db-a490-0016173936df}]
\Shell\AutoRun\command - I:\PStart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{288de822-8820-11db-a50d-0016173936df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sys.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fde5d04-8c0d-11db-a524-0016173936df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sys.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93e27a98-ee68-11dc-973f-0016173936df}]
\Shell\AutoRun\command - E:\autorunner.exe "index.html"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab05ac28-647a-11db-a4b5-0016173936df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sys.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-activeds - c:\windows\system32\activeds.exe
HKCU-Run-28436492427508753852833980586650 - c:\program files\Antivirus 2009\av2009.exe
HKCU-Explorer_Run-scApp - c:\docume~1\Bob\LOCALS~1\Temp\suchost.exe

.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {43DB925C-936E-4B26-B9EA-DA68F9FC7506} = 203.8.183.1 192.189.54.33
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 09:02:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
scApp = c:\docume~1\Bob\LOCALS~1\Temp\suchost.exe??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
scApp = c:\docume~1\Bob\LOCALS~1\Temp\suchost.exe??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-21 9:03:43
ComboFix-quarantined-files.txt 2009-01-20 22:03:41

Pre-Run: 152,028,913,664 bytes free
Post-Run: 152,171,257,856 bytes free

943 — E O F — 2009-01-14 06:29:15

===================================================

And here is the ComboFix.txt content:

ComboFix 09-01-05.05 - Bob 2009-01-21 9:01:23.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.655 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Outdated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Antivirus 2009
c:\program files\Antivirus 2009\av2009.exe
c:\program files\INSTALL.LOG
C:\smp.bat
c:\windows\IE4 Error Log.txt
c:\windows\system32\DelSelf.bat
c:\windows\system32\ieupdates.exe.tmp
c:\windows\system32\msxml71.dll
c:\windows\system32\sysproc64
c:\windows\system32\sysproc64\sysproc32.sys
c:\windows\system32\sysproc64\sysproc86.sys

.
((((((((((((((((((((((((( Files Created from 2008-12-20 to 2009-01-20 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-19 04:32 77,824 —-a-w c:\windows\system32\7Jv5vJhh.exe
2009-01-17 02:06 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2008-12-13 06:37 ——— d—–w c:\program files\NoAdware3
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U"="copy" [X]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Cognac"="c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe" [2009-01-18 98820]
"MSFox"="c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe" [2008-12-02 73220]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b3b5a6c-42bf-11db-a490-0016173936df}]
\Shell\AutoRun\command - I:\PStart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{288de822-8820-11db-a50d-0016173936df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sys.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fde5d04-8c0d-11db-a524-0016173936df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sys.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93e27a98-ee68-11dc-973f-0016173936df}]
\Shell\AutoRun\command - E:\autorunner.exe "index.html"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab05ac28-647a-11db-a4b5-0016173936df}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sys.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-14 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-10 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-17 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2009-01-16 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe [2009-01-19 15:32]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-activeds - c:\windows\system32\activeds.exe
HKCU-Run-28436492427508753852833980586650 - c:\program files\Antivirus 2009\av2009.exe
HKCU-Explorer_Run-scApp - c:\docume~1\Bob\LOCALS~1\Temp\suchost.exe

.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {43DB925C-936E-4B26-B9EA-DA68F9FC7506} = 203.8.183.1 192.189.54.33
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 09:02:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
scApp = c:\docume~1\Bob\LOCALS~1\Temp\suchost.exe??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
scApp = c:\docume~1\Bob\LOCALS~1\Temp\suchost.exe??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-21 9:03:43
ComboFix-quarantined-files.txt 2009-01-20 22:03:41

Pre-Run: 152,028,913,664 bytes free
Post-Run: 152,171,257,856 bytes free

943 — E O F — 2009-01-14 06:29:15

================================================

We then successfully ran HiJackThis and here is that log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:43 AM, on 21/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Bob\LOCALS~1\Temp\xxx1987.exe
C:\DOCUME~1\Bob\LOCALS~1\Temp\13.tmp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Bob\Desktop\HiJackThis_v2-02.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\Bob\LOCALS~1\Temp\13.tmp.exe
O4 - HKCU\..\Run: [MSFox] C:\DOCUME~1\Bob\LOCALS~1\Temp\xxx1987.exe
O4 - HKCU\..\Run: copy /Y "C:\WINDOWS\system32\msxml71.dll.upd" "C:\WINDOWS\system32\msxml71.dll"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{43DB925C-936E-4B26-B9EA-DA68F9FC7506}: NameServer = 203.8.183.1 192.189.54.33
O17 - HKLM\System\CS1\Services\Tcpip\..\{43DB925C-936E-4B26-B9EA-DA68F9FC7506}: NameServer = 203.8.183.1 192.189.54.33
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 4838 bytes

========================================

Computer behaviour now:
I haven't yet done a reboot but we now were able to run HiJackThis (which we couldn't do before: I had to delete the previous copy I had emailed to this PC and copy/paste a fresh copy from my PC to this one; presumably the previous copy had been infected stopping it from running).

The AVG Updater ran and updated AVG; I've turned on the Resident Shield and AVG now appears normal.

Before, when Bob tried to run Disk Defragmenter, he got a path error. Now using Start | All Programs | Accessories | System Tools | Disk Defragmenter it starts OK and reports disk space correctly but if I try to do an anlysis I get a Red X dialog: "Disk Defragmenter could not start."

At least we seem now to be able to use the PC. I'll await your instructions on what you find in the logs.

LDTate

Post #4January 20, 2009, 11:25 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\windows\system32\7Jv5vJhh.exe
c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe
c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe
c:\windows\system32\oembios.exe

AtJob::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U"=-
"Cognac"=-
"MSFox"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b3b5a6c-42bf-11db-a490-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{288de822-8820-11db-a50d-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fde5d04-8c0d-11db-a524-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93e27a98-ee68-11dc-973f-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab05ac28-647a-11db-a4b5-0016173936df}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

kangaroo

Post #5January 22, 2009, 10:08 AM UTC

Hi LDT, Created the CFScript.txt file on the desktop; renamed worksnow.exe to ComboFix.exe (showed the white cat on red circle icon); dragged CFScript.txt onto the ComboFix icon and released the left mouse button. Nothing happened, just the highlighting of the ComboFix.exe name went back to white text against the wallpaper of the desktop. Did not see the copying progress bar as in your animated image. How else can we get ComboFix to apply this script?

LDTate

Post #6January 22, 2009, 1:29 PM UTC

I'm not sure why you renamed the file? rename it back and try again.

kangaroo

Post #7January 23, 2009, 5:03 AM UTC

Hi LDT,
Sorry about that; I thought your references to ComboFix.exe and the icon suggested we do that just to confirm the correct icon.

After renaming back to worksnow.exe and dragging and dropping CFSrcipt.txt onto the worksnow.exe icon ComboFix ran. It reported first that there was an updated version but we said not to download that (thinking it would terminate the execution of CFScript.txt); it then said ComboFix v_09-01-05.5 had expired and offered to run in reduced functionality mode. It then ran and we saved the logs; here is the log.txt:

ComboFix 09-01-05.05 - Bob 2009-01-23 13:52:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.61.1033.18.1015.643 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
Command switches used :: c:\documents and settings\Bob\Desktop\CFScript.txt
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe
c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe
c:\windows\system32\7Jv5vJhh.exe
c:\windows\system32\oembios.exe
.

((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2009-01-17 02:06 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2008-12-13 06:37 ——— d—–w c:\program files\NoAdware3
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_ 9.02.57.12 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-20 21:25:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-23 02:01:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-23 02:01:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-23 02:01:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-20 20:55:47 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-23 02:14:11 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-20 20:55:47 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-23 02:14:11 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2006-12-01 11:56:00 96,256 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 11:54:32 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 11:54:34 548,864 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 11:54:32 626,688 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 13:25:52 1,101,824 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 13:25:56 1,093,120 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 13:25:58 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 13:26:00 57,856 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 13:08:00 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 13:08:00 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 13:08:00 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 13:08:00 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 13:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-23 13:52:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-23 13:53:24
ComboFix-quarantined-files.txt 2009-01-23 02:53:22
ComboFix2.txt 2009-01-20 22:03:44

Pre-Run: 151,803,334,656 bytes free
Post-Run: 151,856,914,432 bytes free

946 — E O F — 2009-01-14 06:29:15

================================================

Here is the ComboFix.txt:

ComboFix 09-01-05.05 - Bob 2009-01-23 13:52:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.61.1033.18.1015.643 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
Command switches used :: c:\documents and settings\Bob\Desktop\CFScript.txt
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe
c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe
c:\windows\system32\7Jv5vJhh.exe
c:\windows\system32\oembios.exe
.

((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2009-01-17 02:06 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2008-12-13 06:37 ——— d—–w c:\program files\NoAdware3
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_ 9.02.57.12 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-20 21:25:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-23 02:01:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-23 02:01:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-23 02:01:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-20 20:55:47 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-23 02:14:11 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-20 20:55:47 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-23 02:14:11 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2006-12-01 11:56:00 96,256 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 11:54:32 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 11:54:34 548,864 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 11:54:32 626,688 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 13:25:52 1,101,824 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 13:25:56 1,093,120 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 13:25:58 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 13:26:00 57,856 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 13:08:00 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 13:08:00 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 13:08:00 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 13:08:00 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 13:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-10 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-23 13:52:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-23 13:53:24
ComboFix-quarantined-files.txt 2009-01-23 02:53:22
ComboFix2.txt 2009-01-20 22:03:44

Pre-Run: 151,803,334,656 bytes free
Post-Run: 151,856,914,432 bytes free

946 — E O F — 2009-01-14 06:29:15
=======================================================

We then ran HiJackThis; here is the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:56:19 PM, on 23/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Bob\Desktop\HiJackThis_v2-02.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 4240 bytes
=======================================

Computer behaviour now:
A reboot took about 1:30 to shutdown and login back to a desktop. We were able to run HiJackThis.

We had turned off the AVG Resident Shield to run ComboFix; I've turned on the Resident Shield and AVG appears to be working normally (started a scan and stopped it after it got to the HDD).

As before, when Bob tried to run Disk Defragmenter before we started this thread, he got a path error. After the initial actions and still now Disk Defragmenter starts OK and reports disk space correctly but if I try to do an anlysis I get a Red X dialog: "Disk Defragmenter could not start." Not sure if windows is damaged or this is still part of the infection problem.

We still seem to be able to use the PC. I'll await your further instructions on what you find in the new logs.

LDTate

Post #8January 23, 2009, 1:45 PM UTC

File::
c:\windows\system32\7Jv5vJhh.exe
c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe
c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe
c:\windows\system32\oembios.exe

Folder::
c:\program files\NoAdware3


AtJob::

Driver::
TDSSpaxt

Reglock::
c:\window\system32\drivers\TDSSpaxt.sys

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cognac"=-
"MSFox"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b3b5a6c-42bf-11db-a490-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{288de822-8820-11db-a50d-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fde5d04-8c0d-11db-a524-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93e27a98-ee68-11dc-973f-0016173936df}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab05ac28-647a-11db-a4b5-0016173936df}]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]

kangaroo

Post #9January 24, 2009, 1:27 AM UTC

Hi LDT,

Here is the ComboFix report:

ComboFix 09-01-05.05 - Bob 2009-01-24 12:12:13.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.668 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
Command switches used :: c:\documents and settings\Bob\Desktop\CFScript.txt
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
c:\docume~1\Bob\LOCALS~1\Temp\13.tmp.exe
c:\docume~1\Bob\LOCALS~1\Temp\xxx1987.exe
c:\windows\system32\7Jv5vJhh.exe
c:\windows\system32\oembios.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\NoAdware3
c:\program files\NoAdware3\noadware3_050807.na

.
((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_ 9.02.57.12 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-20 21:25:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-24 01:04:06 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-24 01:04:06 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-24 01:04:06 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-20 20:55:47 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-23 02:14:11 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-20 20:55:47 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-23 02:14:11 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2006-12-01 11:56:00 96,256 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 11:54:32 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 11:54:34 548,864 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 11:54:32 626,688 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 13:25:52 1,101,824 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 13:25:56 1,093,120 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 13:25:58 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 13:26:00 57,856 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 13:08:00 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 13:08:00 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 13:08:00 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 13:08:00 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 13:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {43DB925C-936E-4B26-B9EA-DA68F9FC7506} = 203.8.183.1 192.189.54.33
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 12:12:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-24 12:13:25
ComboFix-quarantined-files.txt 2009-01-24 01:13:23
ComboFix2.txt 2009-01-20 22:03:44

Pre-Run: 152,366,784,512 bytes free
Post-Run: 152,362,549,248 bytes free

949 — E O F — 2009-01-14 06:29:15

And here is the new HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:33 PM, on 24/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Bob\Desktop\HiJackThis_v2-02.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{43DB925C-936E-4B26-B9EA-DA68F9FC7506}: NameServer = 203.8.183.1 192.189.54.33
O17 - HKLM\System\CS1\Services\Tcpip\..\{43DB925C-936E-4B26-B9EA-DA68F9FC7506}: NameServer = 203.8.183.1 192.189.54.33
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 4530 bytes

When I was starting the PC it hung just before displaying the login screen (with the mouse pointer on a black background). I powered down and restarted normally.

However, attempts to connect to WhatTheTech web site, either by typing the address in the address bar or from the results of a google search were initially showing Page Not Found and after another reboot were redirecting to the "scanstability" website which tried to start an online scan. I killed that window.

I had to access your instructions from another PC. Transferred them to this PC and applied them.

Now am able to connect to this forum again on this PC.

I await your further instructions.

LDTate

Post #10January 24, 2009, 1:32 AM UTC

Can you run a new Combofix scan while in Normal Mode?

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

kangaroo

Post #11January 24, 2009, 10:34 AM UTC last edited January 24, 2009, 10:38 AM UTC

Hi LDT,

As the previous two attempts to install Recovery Console through ComboFix had failed, I installed it from the WinXP CD before running ComboFix again.

We are still getting the message that ComboFix has expired and it runs in reduced functionality mode. DO we need to download another copy of ComboFix (or worksnow)?

That done, here is the new ComboFix log:

ComboFix 09-01-05.05 - Bob 2009-01-24 20:41:18.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.661 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_ 9.02.57.12 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-20 21:25:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-24 09:15:55 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-24 09:15:55 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-24 09:15:55 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-20 20:55:47 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-24 08:02:44 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-20 20:55:47 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-24 08:02:44 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2006-12-01 11:56:00 96,256 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 11:54:32 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 11:54:34 548,864 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 11:54:32 626,688 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 13:25:52 1,101,824 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 13:25:56 1,093,120 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 13:25:58 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 13:26:00 57,856 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 13:08:00 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 13:08:00 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 13:08:00 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 13:08:00 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 13:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 20:41:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-24 20:42:26
ComboFix-quarantined-files.txt 2009-01-24 09:42:24
ComboFix2.txt 2009-01-20 22:03:44

Pre-Run: 152,343,384,064 bytes free
Post-Run: 152,352,874,496 bytes free

936 — E O F — 2009-01-14 06:29:15

And here is the ComboFix.txt:

ComboFix 09-01-05.05 - Bob 2009-01-24 20:41:18.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.661 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\worksnow.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_ 9.02.57.12 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-20 21:25:53 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-24 09:15:55 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-24 09:15:55 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-20 21:25:53 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-24 09:15:55 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-20 20:55:47 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-24 08:02:44 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-20 20:55:47 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-24 08:02:44 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2006-12-01 11:56:00 96,256 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 11:54:32 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 11:54:34 548,864 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 11:54:32 626,688 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 13:25:52 1,101,824 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 13:25:56 1,093,120 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 13:25:58 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 13:26:00 57,856 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 13:08:00 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 13:08:00 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 13:08:00 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 13:08:00 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 13:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 13:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 13:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-23 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-20 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 20:41:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
Completion time: 2009-01-24 20:42:26
ComboFix-quarantined-files.txt 2009-01-24 09:42:24
ComboFix2.txt 2009-01-20 22:03:44

Pre-Run: 152,343,384,064 bytes free
Post-Run: 152,352,874,496 bytes free

936 — E O F — 2009-01-14 06:29:15

The PC had a problem browsing to WhatTheTech (but not others) website earlier today but that is not a problem now. We cannot send email just now but I'm sure that is a problem with the ISP's mail server as we are also unable to access it through web mail. Can't call their tech Support now as they close down after 8pm. Everything else seems to working OK.

Thanks for your help so far.

LDTate

Post #12January 24, 2009, 12:50 PM UTC

I think we need the latest version.

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
After the above:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
- Double click on ComboFix.exe & follow the prompts.
  
  Note: Combofix will run without the Recovery Console installed.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

kangaroo

Post #13January 26, 2009, 10:11 AM UTC last edited January 26, 2009, 10:16 AM UTC

Hi LDT,
Please pardon my delay; I was an organiser for our community lunch for Australia Day.

Bad news on Bob's PC problem.

He ran the ComboFix /u and it reproted that ComboFix had been uninstalled.

When he tried to download the fresh copy from the links you provided he got a Page not Found error with all three. He then tried to update his AVG (as this was the sort of behaviour he had found when we started this process) and he couldn't connect to the AVG update server.

I transferred a newly downloaded copy (from link1) of ComboFix to Bob’s PC in a GoToAssist session. He found it won’t run, egg-timer flashes momentarily.

We tried the expired worksnow and it still runs in reduced functionality mode (see logs below); we tried the expired ComboFix and clicked no to run in reduced functionality mode which closed the window and the file was deleted (not in recycle bin).

HJT ran ok (see log below).

Now on Bob’s PC we can’t browse to any of the links for ComboFix, WhatTheTech or connect to the sever to update AVG; very similar to where we started.

Word is ok (I had e-mailed your instructions to Bob in a Word document); his Disk Defragmenter still has the same problem: will open but cannot analyse or defrag.

When Bob re-enabled his AVG Resident Shield after running the above scans, he noted that only "scan for infectable files" was ticked.

Here is the latest worksnow log:

ComboFix 09-01-05.05 - Bob 2009-01-26 18:59:04.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.653 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\Repairs Bob\worksnow.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-12-26 to 2009-01-26 )))))))))))))))))))))))))))))))
.

2009-01-24 21:11 . 2009-01-26 18:23 d——– c:\program files\Citrix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-26 18:59:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\COMRes.dll
.
Completion time: 2009-01-26 19:00:12
ComboFix-quarantined-files.txt 2009-01-26 08:00:10

Pre-Run: 152,647,184,384 bytes free
Post-Run: 152,675,147,776 bytes free

908 — E O F — 2009-01-14 06:29:15

================================================

and the ComboFix.txt

ComboFix 09-01-05.05 - Bob 2009-01-26 18:59:04.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.653 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\Repairs Bob\worksnow.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-12-26 to 2009-01-26 )))))))))))))))))))))))))))))))
.

2009-01-24 21:11 . 2009-01-26 18:23 d——– c:\program files\Citrix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\oembios.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

— Other Services/Drivers In Memory —

*Deregistered* - TDSSserv.sys
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-21 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-26 18:59:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpaxt.sys"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\TDSSpaxt.sys"
"group"="file system"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\COMRes.dll
.
Completion time: 2009-01-26 19:00:12
ComboFix-quarantined-files.txt 2009-01-26 08:00:10

Pre-Run: 152,647,184,384 bytes free
Post-Run: 152,675,147,776 bytes free

908 — E O F — 2009-01-14 06:29:15

=================================================

and the latest HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:50:24 PM, on 26/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Bob\Desktop\HiJackThis_v2-02.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 4265 bytes

Hope you can make something of this perplexing problem.

Would downloading worksnow.exe from the original link you gave earlier in your responses give us an updated copy? If so, I can download it and take it to Bob on a CD as I did with the first lot.

We tried to rename worksnow.exe to ComboFix.exe but got an error message that we couldn't do that.

LDTate

Post #14January 26, 2009, 12:47 PM UTC

If you want to download it to a working PC to a thumb drive.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Once on the thumb drive, rename Combofix.exe to Combofix.com.

Now try it.

kangaroo

Post #15January 27, 2009, 4:35 AM UTC

Hi LDT,

This morning Bob tried to start his PC; the first 5 attempts he saw the bot screen for Recovery Console and XP Home and then just a black screen (it wouldn't go to the login screen. I believe each time he tapped enter or clicked on the XP Home option. The sixth attempt, he just let the delay run and he went into Windows OK.

He then got a rush of blood and thought he'd try ComboFix again from his desktop, the new version I had transferred to him last night. This time it ran so he called me and I thought the best thing to do was to complete the execution of ComboFix as I wasn't sure what it might do if we said it was not to continue. It reported that AVG was running and I had him turn off the Resident Sheild at that point and ComboFix continued.

As his ISP's email server was again off-line, I connected a GoToAssist session and transferred the ComboFix logs to my PC and had him run a HiJackThis and I also got that log.

I checked that he was able to access the first of the three links in your last post (went to the Run | Save | Cancel dialog for ComboFix.exe but then cancelled rather than confuse versions at this point. I hope this was the right thing to do.

He is still unable to access WhatTheTech web pages or the AVG update server.

Here is the ComboFix log:

ComboFix 09-01-21.04 - Bob 2009-01-27 11:42:39.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.699 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\work.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1cs.jb
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1dg.19
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1gc.1k
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1o8.1m2
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1r0.2l
c:\documents and settings\LocalService\Application Data\sysproc64
c:\documents and settings\LocalService\Application Data\sysproc64\sysproc32.sys
c:\documents and settings\NetworkService\Application Data\sysproc64
c:\documents and settings\NetworkService\Application Data\sysproc64\sysproc32.sys
c:\windows\system32\7Jv5vJhh.exe.a_a
c:\windows\system32\drivers\TDSSpaxt.sys
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_TDSSserv.sys
——-\Legacy_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2008-12-27 to 2009-01-27 )))))))))))))))))))))))))))))))
.

2009-01-26 19:06 . 2009-01-27 11:30 d——– C:\ComboFix
2009-01-26 18:58 . 2009-01-26 19:00 d——– C:\worksnow
2009-01-24 21:11 . 2009-01-26 18:23 d——– c:\program files\Citrix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-26_18.59.30.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-30 21:00:00 28,672 —-a-w c:\windows\NIRCMD.exe
+ 2000-08-30 21:00:00 29,696 —-a-w c:\windows\NIRCMD.exe
- 2009-01-26 06:11:20 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-27 00:30:18 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-26 06:11:20 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-27 00:30:18 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-26 03:55:40 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-26 23:43:12 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-26 03:55:40 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-26 23:43:12 383,254 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-27 11:43:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\COMRes.dll
.
Completion time: 2009-01-27 11:45:05
ComboFix-quarantined-files.txt 2009-01-27 00:45:04

Pre-Run: 152,669,585,408 bytes free
Post-Run: 152,673,918,976 bytes free

935 — E O F — 2009-01-14 06:29:15

================================================

Here is the ComboFix.txt file:

ComboFix 09-01-21.04 - Bob 2009-01-27 11:42:39.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.699 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\work.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1cs.jb
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1dg.19
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1gc.1k
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1o8.1m2
c:\documents and settings\Bob\Local Settings\Temporary Internet Files\s1r0.2l
c:\documents and settings\LocalService\Application Data\sysproc64
c:\documents and settings\LocalService\Application Data\sysproc64\sysproc32.sys
c:\documents and settings\NetworkService\Application Data\sysproc64
c:\documents and settings\NetworkService\Application Data\sysproc64\sysproc32.sys
c:\windows\system32\7Jv5vJhh.exe.a_a
c:\windows\system32\drivers\TDSSpaxt.sys
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_TDSSserv.sys
——-\Legacy_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2008-12-27 to 2009-01-27 )))))))))))))))))))))))))))))))
.

2009-01-26 19:06 . 2009-01-27 11:30 d——– C:\ComboFix
2009-01-26 18:58 . 2009-01-26 19:00 d——– C:\worksnow
2009-01-24 21:11 . 2009-01-26 18:23 d——– c:\program files\Citrix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 04:30 ——— d—–w c:\documents and settings\Bob\Application Data\AVG7
2009-01-22 21:00 ——— d—–w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-21 00:36 ——— d—–w c:\documents and settings\All Users\Application Data\avg7
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2007-09-03 02:51 771,449 —-a-w c:\program files\tubely_setup.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-26_18.59.30.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-30 21:00:00 28,672 —-a-w c:\windows\NIRCMD.exe
+ 2000-08-30 21:00:00 29,696 —-a-w c:\windows\NIRCMD.exe
- 2009-01-26 06:11:20 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-27 00:30:18 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-26 06:11:20 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-27 00:30:18 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-26 03:55:40 53,608 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-26 23:43:12 53,608 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-26 03:55:40 383,254 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-26 23:43:12 383,254 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-10-19 590848]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 c:\windows\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-06-06 c:\windows\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-28 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-25 218496]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\At1.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At10.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At100.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At101.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At102.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At103.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At104.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At105.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At106.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At107.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At108.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At109.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At11.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At110.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At111.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At112.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At113.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At114.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At115.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At116.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At117.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At118.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At119.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At12.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At120.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At121.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At122.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At123.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At124.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At125.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At126.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At127.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At128.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At129.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At13.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At130.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At131.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At132.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At133.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At134.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At135.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At136.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At137.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At138.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At139.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At14.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At140.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At141.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At142.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At143.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At144.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At145.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At146.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At147.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At148.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At149.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At15.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At150.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At151.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At152.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At153.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At154.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At155.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At156.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At157.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At158.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At159.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At16.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At160.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At161.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At162.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At163.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At164.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At165.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At166.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-12 c:\windows\Tasks\At167.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At168.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At169.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At17.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At170.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At171.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At172.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At173.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At174.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At175.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At176.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At177.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At178.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At179.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At18.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At180.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At181.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At182.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At183.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At184.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At185.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At186.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At187.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At188.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At189.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At19.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At190.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At191.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At192.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At193.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At194.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At195.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At196.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At197.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At198.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At199.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At2.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At20.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At200.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At201.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At202.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At203.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At204.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At205.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At206.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At207.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At208.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At209.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At21.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At210.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At211.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At212.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At213.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At214.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At215.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-19 c:\windows\Tasks\At216.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At217.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At218.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At219.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At22.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At220.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At221.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At222.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At223.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At224.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At225.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At226.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At227.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At228.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At229.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At23.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At230.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At231.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At232.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At233.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At234.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At235.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At236.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At237.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At238.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At239.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At24.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At240.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At241.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At242.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At243.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At244.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At245.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At246.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At247.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At248.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At249.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At25.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At250.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At251.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At252.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At253.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At254.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At255.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At256.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At257.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At258.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At259.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At26.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At260.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At261.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At262.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At263.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-22 c:\windows\Tasks\At264.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At265.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At266.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At267.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At268.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At269.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At27.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At270.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At271.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At272.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At273.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At274.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At275.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At276.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At277.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At278.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At279.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At28.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At280.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At281.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At282.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At283.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At284.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At285.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At286.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At287.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-06 c:\windows\Tasks\At288.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At289.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At29.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At290.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At291.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At292.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At293.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At294.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At295.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At296.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At297.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At298.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At299.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At3.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At30.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At300.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At301.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At302.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At303.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At304.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At305.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At306.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At307.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At308.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At309.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At31.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At310.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At311.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-11 c:\windows\Tasks\At312.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At313.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At314.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At315.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At316.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At317.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At318.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At319.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At32.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At320.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At321.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At322.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At323.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At324.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At325.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At326.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At327.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At328.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At329.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At33.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At330.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At331.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At332.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At333.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At334.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At335.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-16 c:\windows\Tasks\At336.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At337.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At338.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At339.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At34.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At340.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At341.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At342.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At343.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At344.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At345.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At346.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At347.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At348.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At349.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At35.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At350.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At351.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At352.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At353.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At354.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At355.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At356.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At357.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At358.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At359.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At36.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At360.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At361.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At362.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At363.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At364.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At365.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At366.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At367.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At368.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At369.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At37.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At370.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At371.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At372.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At373.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At374.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At375.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At376.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At377.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At378.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At379.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At38.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At380.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At381.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At382.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At383.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-17 c:\windows\Tasks\At384.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At385.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At386.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At387.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At388.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At389.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At39.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At390.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At391.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At392.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At393.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At394.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At395.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At396.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At397.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At398.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At399.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At4.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At40.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At400.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At401.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At402.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At403.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At404.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At405.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At406.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At407.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-19 c:\windows\Tasks\At408.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At41.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At42.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At43.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At44.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At45.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At46.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At47.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At48.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At49.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At5.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At50.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At51.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At52.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At53.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At54.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At55.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At56.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At57.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At58.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At59.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At6.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At60.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At61.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At62.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At63.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At64.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At65.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At66.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At67.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At68.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At69.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-02 c:\windows\Tasks\At7.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At70.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At71.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At72.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At73.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At74.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At75.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At76.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-12 c:\windows\Tasks\At77.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At78.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-06 c:\windows\Tasks\At79.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At8.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-07 c:\windows\Tasks\At80.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At81.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At82.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At83.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-27 c:\windows\Tasks\At84.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At85.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At86.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At87.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At88.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-18 c:\windows\Tasks\At89.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-22 c:\windows\Tasks\At9.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-25 c:\windows\Tasks\At90.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-26 c:\windows\Tasks\At91.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At92.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-13 c:\windows\Tasks\At93.job
- c:\windows\system32\7Jv5vJhh.exe []

2009-01-24 c:\windows\Tasks\At94.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-11 c:\windows\Tasks\At95.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-16 c:\windows\Tasks\At96.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At97.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-24 c:\windows\Tasks\At98.job
- c:\windows\system32\7Jv5vJhh.exe []

2008-12-07 c:\windows\Tasks\At99.job
- c:\windows\system32\7Jv5vJhh.exe []
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://au.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-27 11:43:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\COMRes.dll
.
Completion time: 2009-01-27 11:45:05
ComboFix-quarantined-files.txt 2009-01-27 00:45:04

Pre-Run: 152,669,585,408 bytes free
Post-Run: 152,673,918,976 bytes free

935 — E O F — 2009-01-14 06:29:15

=====================================================

And here is the latest HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:31:57 PM, on 27/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Citrix\GoToAssist Express Customer\136\g2ax_service.exe
C:\Program Files\Citrix\GoToAssist Express Customer\136\g2ax_comm_customer.exe
C:\Program Files\Citrix\GoToAssist Express Customer\136\g2ax_system_customer.exe
C:\Program Files\Citrix\GoToAssist Express Customer\136\g2ax_user_customer.exe
C:\Documents and Settings\Bob\Desktop\HiJackThis_v2-02.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: GoToAssist Express Customer - C:\Program Files\Citrix\GoToAssist Express Customer\136\g2ax_winlogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: GoToAssist Express Customer - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist Express Customer\136\g2ax_service.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 4421 bytes

============================================

Again, I'm sorry that Bob jumped in and ran a ComboFix without your instruction to do so. I've emphasised to him that we are only to do steps under your instructions. Specifically, I have told him not to run an AVG scan or do anything else to try to clean up infections without specific instructions from you.

Where to now?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] No access on infected PC

✨ Ask AI

Ask AI