Spyware / Malware / Virus Removal

[Closed] url.adtrgt.com

7 min read

Looking for the outcome? Ask AI

moon_rabbits Topic Starter

Post #1January 26, 2009, 5:54 AM UTC

Sometime over the past 24 hours my computer has been infected with very annoying malware. Every time I go to a new page in Firefox, a new browser window is opened pointing to "url.adtrgt.com," with an error saying "connection reset" or sometimes some random ads. Unfortunately, over six people use this computer on a regular basis and it is more or less impossible for me to figure out who downloaded what in order for this to happen D:

I've seen this problem be addressed here before, but it appears to be machine specific, so I decided to make my own thread. It was recommended in most threads that MalwareBytes be used to remove the infection - unfortunately, MalwareBytes gives me the error "Database cannot be loaded, line 0 (0)." every time I try to run it (even after multiple installs, uninstalls, and reboots). I'm currently running a-sqaured Anti-Malware (which has already found 3 infections, but I think they are even unrelated to this problem ; - ; )

I am running on Windows XP.

Here is my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:43 AM, on 1/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\a-squared Anti-Malware\a2wizard.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\Run: [64437f04] rundll32.exe "C:\WINDOWS\system32\vkcjuskt.dll",b
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: prio.dll nogrdm.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 5695 bytes

Any and all help is appreciated~

jmw3

Post #2January 26, 2009, 5:25 PM UTC

Welcome moon_rabbits

I'm having a look at your log/s now. Please give me a little time to get back to you with instructions.

In the meantime please note the following:

Any recommendations made are for your computer problems only and should NOT be used on any other computer.
Please DO NOT run any scans/tools or other fixes unless I ask you to. This is very important for several reasons. Here are just two of them:
1. The tools that we use are very powerful and can cause >>irreparable damage<< to your computer if not used correctly.
2. Commercial scanners, for the most part can not completely remove some of the more "resistant" infections. This makes it much more difficult to get rid of completely.
If you get stuck or are unsure of something please ask for a further explanation, do not guess.
Continue to respond to this thread until I give you the All Clean!

Thanks

I'd also like to see a list of installed programs so please do this:
Create an Uninstall List

Start HijackThis
Click on the Config button
Click on the Misc Tools button
Click on the Open Uninstall Manager button
Click on the Save list… button and specify where you would like to save this file
When you press the Save button a notepad will open with the contents of that file
Copy and paste the contents of that notepad here in your next reply

moon_rabbits

Post #3January 26, 2009, 6:50 PM UTC

Thank you for the reply!

Here is the uninstall list compiled by HiJackThis:

32 Bit HP CIO Components Installer
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Photoshop CS3
Adobe Setup
Adobe Shockwave Player 11
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Any DVD Converter Professional 3.6.7
Apple Software Update
a-squared Anti-Malware 4.0
Big Green Help
CCleaner (remove only)
Comical 0.8
Command & Conquer
DangerousHSGirls 1.0.10.0
dBpoweramp Music Converter
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Dungeon Siege
DVD-lab PRO 2.3
ESET NOD32 Antivirus
Free eXPert PDF Reader
Free MOV 2 AVI
FrostWire 4.17.2
gBurner
Google Gmail Notifier
Graboid Video 1.3
Graffiti Studio 2.0
Grand Theft Auto
Half-Life Visitors 1.0
Half-Life®
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HP Deskjet F4200 All-In-One Driver 11.0 03
Java™ 6 Update 11
Last.fm 1.5.2.38918
Live 7.0.3
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft DirectX SDK (November 2008)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla ActiveX Control v1.7.12
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 (KB954430)
Nero 9
Nero 9 Trial
neroxml
NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up
Norton Security Scan
Norton Security Scan (Symantec Corporation)
NVIDIA Drivers
OJOsoft Total Video Converter
PDF Settings
Prio v1.9.7
Prism Video Converter
QuickTime
RAD Video Tools
Rayman Gold
Realtek AC'97 Audio
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Sid Meier's Civilization 4
SimCity 4 Deluxe
Skype™ 3.8
SoulSeek Client 156c
Spybot - Search & Destroy
Steam™
Update for Windows XP (KB898461)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
VideoLAN VLC media player 0.8.6d
Winamp
Winamp Remote
Winamp Toolbar for Firefox
Winamp Toolbar for Internet Explorer
WinAVI Video Converter
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinRAR archiver
Zombpocalypse 0.9

jmw3

Post #4January 26, 2009, 7:29 PM UTC

Hi
If I could ask you not to wrap the logs in quote tags. Just copy the contents of the logs directly into your posts.
Thanks

P2P Warning!
IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

FrostWire 4.17.2

Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur.
P2P file sharing used to be fairly safe. That is no longer true. I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.
References for the risk of these programs can be found in these links: http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm
See Clean/Infected P2P Programs here

Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) & any other P2P programs.

Fix HiJackThis Entries

Open HiJackThis
Click on Do a system scan only
Place a checkmark next to these lines(if still present):

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present <<<—– Fix these if you did not set yourself

Close all windows except Hijackthis and click Fix Checked
Click Yes when prompted
Close HijackThis.

Combofix
Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

**IMPORTANT !!! Save ComboFix.exe to your Desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
A guide to do this can be found here
The ones that need to be closed/disabled are:
Eset Nod32 | A-Squared Anti-Malware
Double click on ComboFix.exe & follow the prompts
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply along with a new HijackThis log.

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
Combofix log
New HijackThis log

moon_rabbits

Post #5January 26, 2009, 8:07 PM UTC

Here is the ComboFix log (note: it never prompted me to install the recovery console, but according to this log, it is not installed . . . while I was running ComboFix, though, it did say it was creating a restore point):

ComboFix 09-01-21.04 - Kelly!! ! 2009-01-26 14:49:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.255.76 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Conner\Application Data\EurekaLog
c:\documents and settings\Kelly!! !\Application Data\EurekaLog
c:\windows\adaway.lic
c:\windows\system32\aamkty.dll
c:\windows\system32\bcxipvhi.dll
c:\windows\system32\brxvcigr.dll
c:\windows\system32\ccoqhqgh.dll
c:\windows\system32\dsiyvy.dll
c:\windows\system32\EfOqsBeg.ini
c:\windows\system32\EfOqsBeg.ini2
c:\windows\system32\emctav.dll
c:\windows\system32\fmauvhcr.dll
c:\windows\system32\geBsqOfE.dll
c:\windows\system32\iavyxpso.dll
c:\windows\system32\iifcAQjk.dll
c:\windows\system32\iiffCSmN.dll
c:\windows\system32\ljJbBrQG.dll
c:\windows\system32\mlJApQhE.dll
c:\windows\system32\mofjikeu.dll
c:\windows\system32\NmSCffii.ini
c:\windows\system32\NmSCffii.ini2
c:\windows\system32\nogrdm.dll
c:\windows\system32\oeeblk.dll
c:\windows\system32\oghlvdix.dll
c:\windows\system32\pjxdmt.dll
c:\windows\system32\qufoqufh.dll
c:\windows\system32\ryksjlih.dll
c:\windows\system32\vgxdeche.dll
c:\windows\system32\xgwpfnvx.dll
c:\windows\system32\xqubcvvv.dll
c:\windows\Tasks\lxapkgxk.job

—– BITS: Possible infected sites —–

hxxp://www.graboid.com
.
((((((((((((((((((((((((( Files Created from 2008-12-26 to 2009-01-26 )))))))))))))))))))))))))))))))
.

2009-01-26 14:56 . 2009-01-26 14:56 d——– c:\windows\system32\xircom
2009-01-26 14:56 . 2009-01-26 14:56 d——– c:\program files\microsoft frontpage
2009-01-26 13:52 . 2009-01-26 13:52 121 –ahs—- c:\windows\system32\rgicvxrb.ini
2009-01-26 11:16 . 2009-01-26 11:17 121 –ahs—- c:\windows\system32\ihvpixcb.ini
2009-01-26 10:02 . 2009-01-26 10:03 121 –ahs—- c:\windows\system32\uekijfom.ini
2009-01-26 09:49 . 2009-01-26 09:49 121 –ahs—- c:\windows\system32\hiljskyr.ini
2009-01-26 09:40 . 2009-01-26 09:40 120 –ahs—- c:\windows\system32\rchvuamf.ini
2009-01-26 01:19 . 2009-01-26 01:19 d——– c:\program files\Malwarebytes' Anti-Malware
2009-01-26 01:19 . 2009-01-26 01:19 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-26 01:19 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-26 01:19 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-01-26 00:44 . 2009-01-26 00:44 120 –ahs—- c:\windows\system32\tksujckv.ini
2009-01-26 00:06 . 2009-01-26 00:06 d——– c:\documents and settings\Kelly!! !\Application Data\Malwarebytes
2009-01-25 21:19 . 2009-01-25 21:19 120 –ahs—- c:\windows\system32\ogeumvix.ini
2009-01-25 21:13 . 2009-01-25 21:13 46,198 –a—— c:\windows\system32\hgGaaApO.dll
2009-01-25 21:01 . 2009-01-25 21:01 d——– c:\program files\The Spirit Engine 2
2009-01-25 20:25 . 2009-01-25 20:58 d——– C:\TSE2
2009-01-23 23:46 . 2009-01-23 23:48 d——– c:\windows\uninstall\Half-Life Visitors
2009-01-23 23:46 . 2009-01-23 23:46 d——– c:\windows\uninstall
2009-01-21 21:28 . 2009-01-21 21:28 d——– c:\documents and settings\All Users\Application Data\Launcher
2009-01-21 21:24 . 2009-01-21 21:25 d——– c:\documents and settings\Conner\Application Data\MozillaControl
2009-01-21 21:24 . 2009-01-21 21:24 d——– c:\documents and settings\All Users\Application Data\Graboid Inc
2009-01-21 21:22 . 2009-01-21 21:22 d——– c:\program files\Mozilla ActiveX Control v1.7.12
2009-01-21 21:20 . 2009-01-21 21:22 d——– c:\program files\Graboid
2009-01-20 17:34 . 2009-01-20 17:34 d——– C:\QAF
2009-01-20 10:39 . 2009-01-26 12:46 d——– c:\program files\Soulseek
2009-01-17 20:23 . 2009-01-17 20:23 d——– c:\program files\DangerousHSGirls
2009-01-16 20:08 . 2009-01-16 20:09 d——– c:\program files\Comical
2009-01-15 20:31 . 2009-01-15 20:31 301,974 –a—— C:\sprts.bmp
2009-01-15 20:02 . 2009-01-15 20:02 6,390 –a—— C:\man1.bmp
2009-01-14 09:12 . 2009-01-25 18:24 d——– c:\documents and settings\Daire\Application Data\uTorrent
2009-01-14 09:06 . 2009-01-14 09:06 d——– c:\documents and settings\Daire\Application Data\Nero
2009-01-14 08:26 . 2009-01-14 08:28 d——– c:\documents and settings\Daire\Application Data\eXPert PDF Editor
2009-01-13 16:58 . 2009-01-13 16:58 268 –ah—– C:\sqmdata19.sqm
2009-01-13 16:58 . 2009-01-13 16:58 244 –ah—– C:\sqmnoopt19.sqm
2009-01-13 12:13 . 2009-01-13 12:13 d——– c:\program files\RADVideo
2009-01-13 12:04 . 2009-01-13 12:06 d——– c:\program files\Free MOV 2 AVI
2009-01-13 10:54 . 2009-01-13 10:54 268 –ah—– C:\sqmdata18.sqm
2009-01-13 10:54 . 2009-01-13 10:54 244 –ah—– C:\sqmnoopt18.sqm
2009-01-13 06:47 . 2009-01-13 06:47 268 –ah—– C:\sqmdata17.sqm
2009-01-13 06:47 . 2009-01-13 06:47 244 –ah—– C:\sqmnoopt17.sqm
2009-01-12 10:30 . 2009-01-12 10:30 268 –ah—– C:\sqmdata16.sqm
2009-01-12 10:30 . 2009-01-12 10:30 244 –ah—– C:\sqmnoopt16.sqm
2009-01-12 07:41 . 2009-01-12 07:41 268 –ah—– C:\sqmdata15.sqm
2009-01-12 07:41 . 2009-01-12 07:41 244 –ah—– C:\sqmnoopt15.sqm
2009-01-10 23:13 . 2009-01-10 23:18 d——– c:\program files\Noitu Love 2
2009-01-10 21:14 . 2009-01-10 21:14 d——– c:\program files\Inland Studios
2009-01-10 08:09 . 2009-01-10 08:09 d——– C:\Program1
2009-01-09 07:37 . 2009-01-09 07:37 268 –ah—– C:\sqmdata14.sqm
2009-01-09 07:37 . 2009-01-09 07:37 244 –ah—– C:\sqmnoopt14.sqm
2009-01-08 22:46 . 2009-01-08 22:46 268 –ah—– C:\sqmdata13.sqm
2009-01-08 22:46 . 2009-01-08 22:46 244 –ah—– C:\sqmnoopt13.sqm
2009-01-07 18:55 . 2009-01-07 18:55 d——– C:\Command & Conquer
2009-01-07 14:47 . 2009-01-07 14:47 268 –ah—– C:\sqmdata12.sqm
2009-01-07 14:47 . 2009-01-07 14:47 244 –ah—– C:\sqmnoopt12.sqm
2009-01-06 20:57 . 2009-01-06 20:57 d——– c:\documents and settings\Conner\Application Data\NCH Software
2009-01-06 20:56 . 2009-01-06 20:57 d——– c:\program files\NCH Software
2009-01-06 20:56 . 2009-01-06 20:56 d——– c:\documents and settings\All Users\Application Data\NCH Software
2009-01-06 20:54 . 2009-01-06 20:54 d——– c:\documents and settings\Conner\Application Data\Any DVD Converter Professional
2009-01-06 20:54 . 2009-01-06 20:55 d-a—— c:\documents and settings\All Users\Application Data\TEMP
2009-01-06 20:53 . 2009-01-06 20:54 d——– c:\program files\Any DVD Converter Professional
2009-01-06 20:50 . 2009-01-06 20:50 d——– c:\program files\OJOsoft
2009-01-06 20:50 . 2009-01-06 20:50 d——– c:\program files\Common Files\Common Share
2009-01-06 20:50 . 2008-12-18 13:38 719,872 –a—— c:\windows\system32\devil.dll
2009-01-06 20:50 . 2008-12-18 13:38 351,744 –a—— c:\windows\system32\avisynth.dll
2009-01-06 17:10 . 2009-01-06 17:10 268 –ah—– C:\sqmdata11.sqm
2009-01-06 17:10 . 2009-01-06 17:10 244 –ah—– C:\sqmnoopt11.sqm
2009-01-05 18:00 . 2009-01-05 18:00 d——– C:\Turing 4.1.1
2009-01-05 16:16 . 2009-01-05 16:16 268 –ah—– C:\sqmdata10.sqm
2009-01-05 16:16 . 2009-01-05 16:16 244 –ah—– C:\sqmnoopt10.sqm
2009-01-05 08:39 . 2009-01-05 08:39 268 –ah—– C:\sqmdata09.sqm
2009-01-05 08:39 . 2009-01-05 08:39 244 –ah—– C:\sqmnoopt09.sqm
2009-01-02 16:44 . 2009-01-02 16:44 15,086 –a—— C:\ebaynew.ico
2009-01-02 16:09 . 2009-01-02 16:09 22,158 –a—— C:\napster.ico
2009-01-02 15:46 . 2009-01-02 15:46 17,542 –a—— C:\amazon.ico
2009-01-01 14:57 . 2009-01-01 15:31 d——– c:\documents and settings\Conner\Application Data\codeblocks
2008-12-31 19:22 . 2008-12-31 19:22 1,409 –a—— c:\windows\system32\tmpE7092.FOT
2008-12-31 18:01 . 2008-12-31 18:01 d——– c:\documents and settings\Conner\Application Data\eXPert PDF Editor
2008-12-30 04:11 . 2008-12-30 04:11 d——– c:\documents and settings\Conner\Application Data\skypePM
2008-12-30 04:09 . 2008-12-30 04:58 d——– c:\documents and settings\Conner\Application Data\Skype
2008-12-29 14:52 . 2008-12-29 14:52 d——– c:\documents and settings\All Users\Application Data\FLEXnet
2008-12-29 14:42 . 2008-12-29 14:42 d——– c:\program files\Bonjour
2008-12-29 14:32 . 2008-12-29 14:32 d——– c:\program files\Common Files\Macrovision Shared
2008-12-29 14:31 . 2008-12-29 14:42 d——– c:\program files\Common Files\Adobe
2008-12-27 23:12 . 2008-12-27 23:12 d——– c:\documents and settings\Kelly!! !\Application Data\Ableton
2008-12-27 23:11 . 2008-03-14 13:22 1,060,864 –a—— c:\windows\system32\MFC71.dll
2008-12-27 23:11 . 2008-03-14 13:22 368,640 –a—— c:\windows\system32\ReWire.dll
2008-12-27 23:11 . 2008-03-14 13:22 233,472 –a—— c:\windows\system32\REX Shared Library.dll
2008-12-27 23:11 . 2008-03-14 13:22 3,856 –a—— c:\windows\system32\comcat.dll
2008-12-27 23:09 . 2008-12-27 23:09 d——– c:\program files\Ableton
2008-12-27 23:05 . 2008-12-28 15:03 120,149,333 –a—— C:\Ableton Live - Software Instruments.rar
2008-12-27 00:49 . 2008-12-27 23:11 d——– C:\Ableton Live 7.0.3 [RH]
2008-12-26 20:49 . 2008-12-26 20:49 d——– c:\program files\Ubisoft
2008-12-26 20:47 . 2008-12-26 20:47 d——– c:\windows\UbiSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-26 04:16 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\uTorrent
2009-01-26 01:45 ——— d—–w c:\documents and settings\Conner\Application Data\uTorrent
2009-01-25 16:59 ——— d—–w c:\documents and settings\Conner\Application Data\FrostWire
2009-01-23 23:02 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-01-23 23:00 ——— d—–w c:\program files\Norton Security Scan
2009-01-23 18:31 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\vlc
2009-01-22 02:27 ——— d—–w c:\documents and settings\Conner\Application Data\vlc
2009-01-20 15:52 473 —-a-w c:\program files\Soulseek.lnk
2008-12-29 19:31 ——— d—–w c:\program files\Adobe Photoshop CS3
2008-12-28 04:00 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\codeblocks
2008-12-28 03:12 ——— d—–w c:\program files\CodeBlocks
2008-12-25 02:11 ——— d—–w c:\documents and settings\Conner\Application Data\Nero
2008-12-24 17:02 ——— d—–w c:\documents and settings\Kristy\Application Data\dvdcss
2008-12-24 15:43 ——— d—–w c:\documents and settings\Kristy\Application Data\eXPert PDF Editor
2008-12-23 22:37 ——— d—–w c:\documents and settings\Kristy\Application Data\FrostWire
2008-12-23 17:57 ——— d—–w c:\documents and settings\All Users\Application Data\2DBoy
2008-12-23 17:51 ——— d—–w c:\program files\WorldOfGoo
2008-12-23 17:48 65,231,060 —-a-w C:\WorldOfGooSetup.exe
2008-12-23 16:23 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\Winamp
2008-12-23 07:34 619 —-a-w c:\program files\gr.txt
2008-12-22 16:11 ——— d—–w c:\documents and settings\Conner\Application Data\My Games
2008-12-22 15:58 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-22 15:58 ——— d—–w c:\program files\Firaxis Games
2008-12-22 06:25 ——— d—–w c:\documents and settings\Conner\Application Data\DAEMON Tools
2008-12-21 17:51 ——— d—–w c:\documents and settings\Kristy\Application Data\Winamp
2008-12-21 17:39 ——— d—–w c:\documents and settings\Kristy\Application Data\uTorrent
2008-12-21 02:14 ——— d—–w c:\documents and settings\Conner\Application Data\dvdcss
2008-12-19 22:13 ——— d—–w c:\program files\Dungeon Siege
2008-12-19 19:43 ——— d—–w c:\documents and settings\Conner\Application Data\Winamp
2008-12-16 18:01 ——— d—–w c:\documents and settings\All Users\Application Data\OrbNetworks
2008-12-16 18:00 ——— d—–w c:\program files\Winamp Toolbar
2008-12-16 18:00 ——— d—–w c:\program files\Winamp Remote
2008-12-16 18:00 ——— d—–w c:\program files\Winamp
2008-12-16 18:00 ——— d—–w c:\documents and settings\All Users\Application Data\Winamp Toolbar
2008-12-16 00:20 ——— d—–w c:\documents and settings\Conner\Application Data\DivX
2008-12-14 23:02 ——— d—–w c:\program files\Nickonline
2008-12-14 11:32 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\Nero
2008-12-14 07:25 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\DivX
2008-12-14 06:19 ——— d—–w c:\program files\Common Files\Nero
2008-12-14 06:12 ——— d—–w c:\program files\Nero
2008-12-14 06:11 ——— d—–w c:\program files\Windows Sidebar
2008-12-14 06:08 ——— d—–w c:\documents and settings\All Users\Application Data\Nero
2008-12-13 19:20 ——— d—–w c:\documents and settings\Kristy\Application Data\vlc
2008-12-13 09:36 ——— d—–w c:\program files\Java
2008-12-13 08:01 ——— d—–w c:\program files\MSXML 4.0
2008-12-13 04:36 ——— d—–w c:\documents and settings\Kristy\Application Data\DivX
2008-12-13 04:33 ——— d—–w c:\program files\WinAVI Video Converter
2008-12-13 03:55 ——— d—–w c:\program files\Hewlett-Packard
2008-12-13 03:55 ——— d—–w c:\program files\Common Files\HP
2008-12-13 03:30 ——— d—–w c:\program files\Common Files\Hewlett-Packard
2008-12-13 03:29 ——— d—–w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2008-12-13 03:27 ——— d—–w c:\program files\HP
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-06 20:06 ——— d—–w c:\program files\dBpoweramp
2008-12-06 20:06 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\AccurateRip
2008-12-04 19:59 ——— d—–w c:\documents and settings\All Users\Application Data\Last.fm
2008-12-04 19:57 ——— d—–w c:\program files\Last.fm
2008-12-02 01:07 ——— d—–w c:\documents and settings\Daire\Application Data\codeblocks
2008-11-29 20:51 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\ToadTrip Games Pty Ltd
2008-11-27 05:35 ——— d—–w c:\program files\Skype
2008-11-27 05:35 ——— d—–w c:\program files\Common Files\Skype
2008-11-27 05:35 ——— d—–w c:\documents and settings\All Users\Application Data\Skype
2008-11-27 01:39 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\eXPert PDF Editor
2008-11-20 20:00 119,120 —-a-w c:\windows\dxsdkuninst.exe
2008-11-16 20:17 62,633 —-a-w c:\windows\prio197uninstall.exe
2008-10-28 22:18 17,331,200 —-a-w c:\windows\RTHDCPL.EXE
.

——- Sigcheck ——-

2001-02-20 13:09 8192 d36a33c21eeed5a6c1daecb7c80a1909 c:\windows\system32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^Kristy^Start Menu^Programs^Startup^FrostWire On Startup.lnk]
path=c:\documents and settings\Kristy\Start Menu\Programs\Startup\FrostWire On Startup.lnk
backup=c:\windows\pss\FrostWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
–a—— 2007-10-18 06:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
–a—— 2005-07-15 16:48 479232 c:\program files\Google\Gmail Notifier\gnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"a2AntiMalware"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Valve\\Steam\\SteamApps\\drconcon\\half-life\\hl.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Documents and Settings\\Conner\\Desktop\\charon\\Charon.exe"=
"c:\\Valve\\Steam\\SteamApps\\drconcon\\opposing force\\hl.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800]
R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]
S1 Start1Driver;Start1Driver; [x]
S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2008-05-03 3584]
S4 Start2Driver;Start2Driver; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-01-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-25 c:\windows\Tasks\Norton Security Scan for Conner.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]

2009-01-26 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 04:42]

2009-01-26 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2008-07-07 04:42]
.
- - - - ORPHANS REMOVED - - - -

BHO-{a675a212-14d4-4bb1-a8fe-e70ee1712806} - c:\windows\system32\aamkty.dll
BHO-{AB6ECEE5-7025-4546-ABF3-752C9C465426} - c:\windows\system32\geBsqOfE.dll
BHO-{FD89BB36-9876-4299-A287-E60BE8EB54D7} - c:\windows\system32\iiffCSmN.dll
MSConfigStartUp-64437f04 - c:\windows\system32\vkcjuskt.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kelly!! !\Application Data\Mozilla\Firefox\Profiles\8q5azdzk.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-26 14:59:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-01-26 15:03:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-26 20:03:43

Pre-Run: 83,487,203,328 bytes free
Post-Run: 83,752,120,320 bytes free

343 — E O F — 2009-01-15 12:40:26

And the HiJackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:07:22 PM, on 1/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 4780 bytes

jmw3

Post #6January 27, 2009, 12:27 PM UTC

View Hidden Files & Folders Windows XP
To view Hidden Files & Folders do the following:
Click Start
Open My Computer
Select the Tools menu and click Folder Options
Select the View Tab
Under the Hidden files and folders heading select Show hidden files and folders
Uncheck the Hide protected operating system files (recommended) option
Click Yes to confirm
Click OK

Upload Files for Scanning
Go to VirSCAN or VirusTotal
(Just use one or the other. No need to use both.)

If you use VirSCAN click Browse
In the File Upload box that opens navigate to c:\windows\system32\CTFMON.EXE, & double click on CTFMON.EXE
Then click Upload
Wait for scans to finish then copy & paste the results into your next reply

If you use VirusTotal click Browse
In the Choose File box that opens navigate to c:\windows\system32\CTFMON.EXE, & double click on CTFMON.EXE
Then click Send File
Wait for scans to finish then copy & paste the results into your next reply

Fix HiJackThis Entries

Open HiJackThis
Click on Do a system scan only
Place a checkmark next to these lines(if still present):

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)

Close all windows except Hijackthis and click Fix Checked
Click Yes when prompted
Close HijackThis.

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

File::
c:\windows\system32\rgicvxrb.ini
c:\windows\system32\ihvpixcb.ini
c:\windows\system32\uekijfom.ini
c:\windows\system32\hiljskyr.ini
c:\windows\system32\rchvuamf.ini
c:\windows\system32\tksujckv.ini
c:\windows\system32\ogeumvix.ini
c:\windows\system32\hgGaaApO.dll
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\sqmdata18.sqm
C:\sqmnoopt18.sqm
C:\sqmdata17.sqm
C:\sqmnoopt17.sqm
C:\sqmdata16.sqm
C:\sqmnoopt16.sqm
C:\sqmdata15.sqm
C:\sqmnoopt15.sqm
C:\sqmdata14.sqm
C:\sqmnoopt14.sqm
C:\sqmdata13.sqm
C:\sqmnoopt13.sqm
C:\sqmdata12.sqm
C:\sqmnoopt12.sqm
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
C:\sqmdata09.sqm
C:\sqmnoopt09.sqm

DirLook::
C:\TSE2
C:\QAF
C:\Program1

Folder::
c:\documents and settings\Kelly!! !\Application Data\uTorrent
c:\documents and settings\Conner\Application Data\uTorrent
c:\documents and settings\Conner\Application Data\FrostWire
c:\documents and settings\Kristy\Application Data\uTorrent

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Kristy^Start Menu^Programs^Startup^FrostWire On Startup.lnk]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=-

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
Results from either VirSCAN or VirusTotal
Combofix log
New HijackThis log
Let me know how the com puter is running / problems

moon_rabbits

Post #7January 28, 2009, 2:03 AM UTC

VirusTotal log:

File CTFMON.EXE received on 01.10.2009 00:41:48 (CET)
Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.09 -
AhnLab-V3 2009.1.10.0 2009.01.09 -
AntiVir 7.9.0.54 2009.01.09 -
Authentium 5.1.0.4 2009.01.10 -
Avast 4.8.1281.0 2009.01.09 -
AVG 8.0.0.229 2009.01.09 -
BitDefender 7.2 2009.01.10 -
CAT-QuickHeal 10.00 2009.01.09 -
ClamAV 0.94.1 2009.01.09 -
Comodo 905 2009.01.09 -
DrWeb 4.44.0.09170 2009.01.09 -
eSafe 7.0.17.0 2009.01.08 -
eTrust-Vet 31.6.6301 2009.01.10 -
F-Prot 4.4.4.56 2009.01.09 -
F-Secure 8.0.14470.0 2009.01.09 -
Fortinet 3.117.0.0 2009.01.09 -
GData 19 2009.01.10 -
Ikarus T3.1.1.45.0 2009.01.09 -
K7AntiVirus 7.10.584 2009.01.09 -
Kaspersky 7.0.0.125 2009.01.10 -
McAfee 5490 2009.01.09 -
McAfee+Artemis 5490 2009.01.09 -
Microsoft 1.4205 2009.01.10 -
NOD32 3755 2009.01.09 -
Norman 5.99.02 2009.01.09 -
Panda 9.4.3.3 2009.01.09 -
PCTools 4.4.2.0 2009.01.09 -
Prevx1 V2 2009.01.10 -
Rising 21.11.42.00 2009.01.09 -
SecureWeb-Gateway 6.7.6 2009.01.10 -
Sophos 4.37.0 2009.01.09 -
Sunbelt 3.2.1831.2 2009.01.09 -
TheHacker [removed].215 2009.01.09 -
TrendMicro 8.700.0.1004 2009.01.09 -
VBA32 3.12.8.10 2009.01.09 -
ViRobot 2009.1.9.1552 2009.01.09 -
VirusBuster 4.5.11.0 2009.01.09 -
Additional information
File size: 8192 bytes
MD5…: d36a33c21eeed5a6c1daecb7c80a1909
SHA1..: 562c0f7ec2b2305d98fa2e632a39107f194076ab
SHA256: bbb6d8024b233084a7515780d149cabfd39be3e8cd824d42dc4e57a646516b07
SHA512: 15a6e1010a5ec060e85c9d032811a38f60395de5f0c9d0de8a654a7fdc08243a
b755efd5f9c8e92b6779ee3c717cd861039e4392b09a5eebffb8c27116f8f684

ssdeep: 96:zBAehIo68hsi5qtZfGou4Hn2MpiDEVw0imKQ2Qb5FdD8+SNqBleltEWfcCHpW
8e:+SgGoYMp6EK0imp3dI+SNyelGWbpW

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4014e4
timedatestamp…..: 0x3a92dcfd (Tue Feb 20 21:09:17 2001)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1306 0x1400 6.01 63bb1c2ff11834d9cfb735f6fa857059
.data 0x3000 0x130 0x200 0.87 2afbed0338487ae823a432632ef60431
.rsrc 0x4000 0x5c8 0x600 3.37 c34d8697ac3fed4e79f71cb233e9faa1

( 5 imports )
> ADVAPI32.dll: RegSetValueExA, RegCreateKeyA, RegCreateKeyExA, RegOpenKeyExA, RegDeleteValueA, RegCloseKey
> KERNEL32.dll: GetVersionExA, GetACP, GetProcAddress, GetModuleHandleA, CloseHandle, ExitProcess, GetCommandLineA, GetStartupInfoA, ResetEvent, lstrcmpiA, FreeLibrary, LoadLibraryA, GetWindowsDirectoryA, CreateEventA, LocalFree, LocalAlloc, DeleteCriticalSection, InitializeCriticalSection
> USER32.dll: EnumWindows, GetClassNameA, FindWindowA, SetWindowPos, PostMessageA, KillTimer, PeekMessageA, MsgWaitForMultipleObjects, TranslateMessage, DispatchMessageA, SetTimer, LoadCursorA, RegisterClassExA, DefWindowProcA, PostQuitMessage, CreateWindowExA, GetSystemMetrics
> MSCTF.dll: TF_UninitSystem, TF_CreateCicLoadMutex, TF_InvalidAssemblyListCache, TF_PostAllThreadMsg, TF_InitSystem
> MSUTB.dll: ClosePopupTipbar, GetPopupTipbar

( 0 exports )

ThreatExpert info: target="_blank">http://www.threatexpert.com/report.aspx?md5=d36a33c21eeed5a6c1daecb7c80a1909
CWSandbox info: target="_blank">http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=d36a33c21eeed5a6c1daecb7c80a1909

Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.09 -
AhnLab-V3 2009.1.10.0 2009.01.09 -
AntiVir 7.9.0.54 2009.01.09 -
Authentium 5.1.0.4 2009.01.10 -
Avast 4.8.1281.0 2009.01.09 -
AVG 8.0.0.229 2009.01.09 -
BitDefender 7.2 2009.01.10 -
CAT-QuickHeal 10.00 2009.01.09 -
ClamAV 0.94.1 2009.01.09 -
Comodo 905 2009.01.09 -
DrWeb 4.44.0.09170 2009.01.09 -
eSafe 7.0.17.0 2009.01.08 -
eTrust-Vet 31.6.6301 2009.01.10 -
F-Prot 4.4.4.56 2009.01.09 -
F-Secure 8.0.14470.0 2009.01.09 -
Fortinet 3.117.0.0 2009.01.09 -
GData 19 2009.01.10 -
Ikarus T3.1.1.45.0 2009.01.09 -
K7AntiVirus 7.10.584 2009.01.09 -
Kaspersky 7.0.0.125 2009.01.10 -
McAfee 5490 2009.01.09 -
McAfee+Artemis 5490 2009.01.09 -
Microsoft 1.4205 2009.01.10 -
NOD32 3755 2009.01.09 -
Norman 5.99.02 2009.01.09 -
Panda 9.4.3.3 2009.01.09 -
PCTools 4.4.2.0 2009.01.09 -
Prevx1 V2 2009.01.10 -
Rising 21.11.42.00 2009.01.09 -
SecureWeb-Gateway 6.7.6 2009.01.10 -
Sophos 4.37.0 2009.01.09 -
Sunbelt 3.2.1831.2 2009.01.09 -
TheHacker [removed].215 2009.01.09 -
TrendMicro 8.700.0.1004 2009.01.09 -
VBA32 3.12.8.10 2009.01.09 -
ViRobot 2009.1.9.1552 2009.01.09 -
VirusBuster 4.5.11.0 2009.01.09 -

Additional information
File size: 8192 bytes
MD5…: d36a33c21eeed5a6c1daecb7c80a1909
SHA1..: 562c0f7ec2b2305d98fa2e632a39107f194076ab
SHA256: bbb6d8024b233084a7515780d149cabfd39be3e8cd824d42dc4e57a646516b07
SHA512: 15a6e1010a5ec060e85c9d032811a38f60395de5f0c9d0de8a654a7fdc08243a
b755efd5f9c8e92b6779ee3c717cd861039e4392b09a5eebffb8c27116f8f684

ssdeep: 96:zBAehIo68hsi5qtZfGou4Hn2MpiDEVw0imKQ2Qb5FdD8+SNqBleltEWfcCHpW
8e:+SgGoYMp6EK0imp3dI+SNyelGWbpW

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4014e4
timedatestamp…..: 0x3a92dcfd (Tue Feb 20 21:09:17 2001)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1306 0x1400 6.01 63bb1c2ff11834d9cfb735f6fa857059
.data 0x3000 0x130 0x200 0.87 2afbed0338487ae823a432632ef60431
.rsrc 0x4000 0x5c8 0x600 3.37 c34d8697ac3fed4e79f71cb233e9faa1

( 5 imports )
> ADVAPI32.dll: RegSetValueExA, RegCreateKeyA, RegCreateKeyExA, RegOpenKeyExA, RegDeleteValueA, RegCloseKey
> KERNEL32.dll: GetVersionExA, GetACP, GetProcAddress, GetModuleHandleA, CloseHandle, ExitProcess, GetCommandLineA, GetStartupInfoA, ResetEvent, lstrcmpiA, FreeLibrary, LoadLibraryA, GetWindowsDirectoryA, CreateEventA, LocalFree, LocalAlloc, DeleteCriticalSection, InitializeCriticalSection
> USER32.dll: EnumWindows, GetClassNameA, FindWindowA, SetWindowPos, PostMessageA, KillTimer, PeekMessageA, MsgWaitForMultipleObjects, TranslateMessage, DispatchMessageA, SetTimer, LoadCursorA, RegisterClassExA, DefWindowProcA, PostQuitMessage, CreateWindowExA, GetSystemMetrics
> MSCTF.dll: TF_UninitSystem, TF_CreateCicLoadMutex, TF_InvalidAssemblyListCache, TF_PostAllThreadMsg, TF_InitSystem
> MSUTB.dll: ClosePopupTipbar, GetPopupTipbar

( 0 exports )

ThreatExpert info: target="_blank">http://www.threatexpert.com/report.aspx?md5=d36a33c21eeed5a6c1daecb7c80a1909
CWSandbox info: target="_blank">http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=d36a33c21eeed5a6c1daecb7c80a1909

ComboFix log:
ComboFix 09-01-21.04 - Kelly!! ! 2009-01-27 20:51:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.255.59 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kelly!! !\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmdata17.sqm
C:\sqmdata18.sqm
C:\sqmdata19.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\sqmnoopt19.sqm
c:\windows\system32\hgGaaApO.dll
c:\windows\system32\hiljskyr.ini
c:\windows\system32\ihvpixcb.ini
c:\windows\system32\ogeumvix.ini
c:\windows\system32\rchvuamf.ini
c:\windows\system32\rgicvxrb.ini
c:\windows\system32\tksujckv.ini
c:\windows\system32\uekijfom.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Conner\Application Data\FrostWire
c:\documents and settings\Conner\Application Data\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
c:\documents and settings\Conner\Application Data\FrostWire\checkandupdate.txt
c:\documents and settings\Conner\Application Data\FrostWire\createtimes.cache
c:\documents and settings\Conner\Application Data\FrostWire\downloads.dat
c:\documents and settings\Conner\Application Data\FrostWire\fileurns.bak
c:\documents and settings\Conner\Application Data\FrostWire\fileurns.cache
c:\documents and settings\Conner\Application Data\FrostWire\filters.props
c:\documents and settings\Conner\Application Data\FrostWire\frostwire.props
c:\documents and settings\Conner\Application Data\FrostWire\gnutella.net
c:\documents and settings\Conner\Application Data\FrostWire\installation.props
c:\documents and settings\Conner\Application Data\FrostWire\intent.props
c:\documents and settings\Conner\Application Data\FrostWire\library.dat
c:\documents and settings\Conner\Application Data\FrostWire\mojito.props
c:\documents and settings\Conner\Application Data\FrostWire\questions.props
c:\documents and settings\Conner\Application Data\FrostWire\responses.cache
c:\documents and settings\Conner\Application Data\FrostWire\simpp.xml
c:\documents and settings\Conner\Application Data\FrostWire\spam.dat
c:\documents and settings\Conner\Application Data\FrostWire\tables.props
c:\documents and settings\Conner\Application Data\FrostWire\themes\frostwirePro_theme.fwtp
c:\documents and settings\Conner\Application Data\FrostWire\themes\frostwirePro_theme\theme.txt
c:\documents and settings\Conner\Application Data\FrostWire\themes\frostwirePro_theme\version.txt
c:\documents and settings\Conner\Application Data\FrostWire\ttrees.cache
c:\documents and settings\Conner\Application Data\FrostWire\ttroot.cache
c:\documents and settings\Conner\Application Data\FrostWire\version.xml
c:\documents and settings\Conner\Application Data\FrostWire\xml\data\audio.sxml2
c:\documents and settings\Conner\Application Data\uTorrent
c:\documents and settings\Conner\Application Data\uTorrent\Ani Difranco.1.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Ani Difranco.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Baader Brains - The Complete Unfinished Works of The Young Tigers.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Björk.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Cypress_Hill-Playlist-The_Very_Best_Of_Cypress_Hill-2008-XXL.torrent
c:\documents and settings\Conner\Application Data\uTorrent\dht.dat
c:\documents and settings\Conner\Application Data\uTorrent\dht.dat.old
c:\documents and settings\Conner\Application Data\uTorrent\Enchanted[2007]DvDrip[Eng]-FXG.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Horton.Hears.A.Who![2008]DvDrip-aXXo.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Jefferson Airplane.torrent
c:\documents and settings\Conner\Application Data\uTorrent\Nirvana - Best of.torrent
c:\documents and settings\Conner\Application Data\uTorrent\QAF.torrent
c:\documents and settings\Conner\Application Data\uTorrent\resume.dat
c:\documents and settings\Conner\Application Data\uTorrent\resume.dat.old
c:\documents and settings\Conner\Application Data\uTorrent\rss.dat
c:\documents and settings\Conner\Application Data\uTorrent\rss.dat.old
c:\documents and settings\Conner\Application Data\uTorrent\settings.dat
c:\documents and settings\Conner\Application Data\uTorrent\settings.dat.old
c:\documents and settings\Conner\Application Data\uTorrent\Spirit Engine 2.torrent
c:\documents and settings\Conner\Application Data\uTorrent\The Weather Underground.XviD.avi.torrent
c:\documents and settings\Conner\Application Data\uTorrent\The.Family.Stone[2005]DvDrip[Eng]-aXXo.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\A Charlie Brown Christmas DVDRip.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Ableton Live - Software Instruments.rar.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Baader Brains - The Complete Unfinished Works of The Young Tigers.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Blonde Redhead.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\dht.dat
c:\documents and settings\Kelly!! !\Application Data\uTorrent\dht.dat.old
c:\documents and settings\Kelly!! !\Application Data\uTorrent\DVDlab PRO 2.33 [CSI][h33t].torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Elf[2003]XviD-eXtasy.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Enigma - The Cross Of Changes.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\FRANKMUSIK - FRANKISUM EP.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Generals and Zero Hour.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\hellboy-mignola & others.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\How the Grinch Stole Christmas[1966]DVDrip[FS]Eng.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Microsoft Office 2007 Ultimate + Crack [NEW] [h33t] [MAMBO04].torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Passion Pit - Chunk of Change.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Portishead.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Potemkin City Limits.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Propagandhi-Potemkin_City_Limits-2005-XRI.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Propagandhi.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Propaghandi.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\resume.dat
c:\documents and settings\Kelly!! !\Application Data\uTorrent\resume.dat.old
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Revolutionary.Road.DVDSCR.XviD-ORC.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\rss.dat
c:\documents and settings\Kelly!! !\Application Data\uTorrent\rss.dat.old
c:\documents and settings\Kelly!! !\Application Data\uTorrent\settings.dat
c:\documents and settings\Kelly!! !\Application Data\uTorrent\settings.dat.old
c:\documents and settings\Kelly!! !\Application Data\uTorrent\Severed head of state.torrent
c:\documents and settings\Kelly!! !\Application Data\uTorrent\WinAVI Video Converter 8.0 with working key.torrent
c:\documents and settings\Kristy\Application Data\uTorrent
c:\documents and settings\Kristy\Application Data\uTorrent\Bing Crosby - White Christmas.torrent
c:\documents and settings\Kristy\Application Data\uTorrent\civ4.iso.torrent
c:\documents and settings\Kristy\Application Data\uTorrent\David Bowie Bing Crosby Little drummer boy.torrent
c:\documents and settings\Kristy\Application Data\uTorrent\dht.dat
c:\documents and settings\Kristy\Application Data\uTorrent\dht.dat.old
c:\documents and settings\Kristy\Application Data\uTorrent\resume.dat
c:\documents and settings\Kristy\Application Data\uTorrent\resume.dat.old
c:\documents and settings\Kristy\Application Data\uTorrent\rss.dat
c:\documents and settings\Kristy\Application Data\uTorrent\rss.dat.old
c:\documents and settings\Kristy\Application Data\uTorrent\settings.dat
c:\documents and settings\Kristy\Application Data\uTorrent\settings.dat.old
c:\documents and settings\Kristy\Application Data\uTorrent\WinAVI Video Converter.torrent
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmdata17.sqm
C:\sqmdata18.sqm
C:\sqmdata19.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\sqmnoopt19.sqm
c:\windows\system32\hgGaaApO.dll
c:\windows\system32\hiljskyr.ini
c:\windows\system32\ihvpixcb.ini
c:\windows\system32\ogeumvix.ini
c:\windows\system32\rchvuamf.ini
c:\windows\system32\rgicvxrb.ini
c:\windows\system32\tksujckv.ini
c:\windows\system32\uekijfom.ini

.
((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-28 )))))))))))))))))))))))))))))))
.

2009-01-26 14:56 . 2009-01-26 14:56 d——– c:\windows\system32\xircom
2009-01-26 14:56 . 2009-01-26 14:56 d——– c:\program files\microsoft frontpage
2009-01-26 01:19 . 2009-01-26 01:19 d——– c:\program files\Malwarebytes' Anti-Malware
2009-01-26 01:19 . 2009-01-26 01:19 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-26 01:19 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-26 01:19 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-01-26 00:06 . 2009-01-26 00:06 d——– c:\documents and settings\Kelly!! !\Application Data\Malwarebytes
2009-01-25 21:01 . 2009-01-25 21:01 d——– c:\program files\The Spirit Engine 2
2009-01-25 20:25 . 2009-01-25 20:58 d——– C:\TSE2
2009-01-23 23:46 . 2009-01-23 23:48 d——– c:\windows\uninstall\Half-Life Visitors
2009-01-23 23:46 . 2009-01-23 23:46 d——– c:\windows\uninstall
2009-01-21 21:28 . 2009-01-21 21:28 d——– c:\documents and settings\All Users\Application Data\Launcher
2009-01-21 21:24 . 2009-01-21 21:25 d——– c:\documents and settings\Conner\Application Data\MozillaControl
2009-01-21 21:24 . 2009-01-21 21:24 d——– c:\documents and settings\All Users\Application Data\Graboid Inc
2009-01-21 21:22 . 2009-01-21 21:22 d——– c:\program files\Mozilla ActiveX Control v1.7.12
2009-01-21 21:20 . 2009-01-21 21:22 d——– c:\program files\Graboid
2009-01-20 17:34 . 2009-01-20 17:34 d——– C:\QAF
2009-01-20 10:39 . 2009-01-27 15:17 d——– c:\program files\Soulseek
2009-01-17 20:23 . 2009-01-17 20:23 d——– c:\program files\DangerousHSGirls
2009-01-16 20:08 . 2009-01-16 20:09 d——– c:\program files\Comical
2009-01-15 20:31 . 2009-01-15 20:31 301,974 –a—— C:\sprts.bmp
2009-01-15 20:02 . 2009-01-15 20:02 6,390 –a—— C:\man1.bmp
2009-01-14 09:12 . 2009-01-25 18:24 d——– c:\documents and settings\Daire\Application Data\uTorrent
2009-01-14 09:06 . 2009-01-14 09:06 d——– c:\documents and settings\Daire\Application Data\Nero
2009-01-14 08:26 . 2009-01-14 08:28 d——– c:\documents and settings\Daire\Application Data\eXPert PDF Editor
2009-01-13 12:13 . 2009-01-13 12:13 d——– c:\program files\RADVideo
2009-01-13 12:04 . 2009-01-13 12:06 d——– c:\program files\Free MOV 2 AVI
2009-01-10 23:13 . 2009-01-10 23:18 d——– c:\program files\Noitu Love 2
2009-01-10 21:14 . 2009-01-10 21:14 d——– c:\program files\Inland Studios
2009-01-10 08:09 . 2009-01-10 08:09 d——– C:\Program1
2009-01-07 18:55 . 2009-01-07 18:55 d——– C:\Command & Conquer
2009-01-06 20:57 . 2009-01-06 20:57 d——– c:\documents and settings\Conner\Application Data\NCH Software
2009-01-06 20:56 . 2009-01-06 20:57 d——– c:\program files\NCH Software
2009-01-06 20:56 . 2009-01-06 20:56 d——– c:\documents and settings\All Users\Application Data\NCH Software
2009-01-06 20:54 . 2009-01-06 20:54 d——– c:\documents and settings\Conner\Application Data\Any DVD Converter Professional
2009-01-06 20:54 . 2009-01-06 20:55 d-a—— c:\documents and settings\All Users\Application Data\TEMP
2009-01-06 20:53 . 2009-01-06 20:54 d——– c:\program files\Any DVD Converter Professional
2009-01-06 20:50 . 2009-01-06 20:50 d——– c:\program files\OJOsoft
2009-01-06 20:50 . 2009-01-06 20:50 d——– c:\program files\Common Files\Common Share
2009-01-06 20:50 . 2008-12-18 13:38 719,872 –a—— c:\windows\system32\devil.dll
2009-01-06 20:50 . 2008-12-18 13:38 351,744 –a—— c:\windows\system32\avisynth.dll
2009-01-05 18:00 . 2009-01-05 18:00 d——– C:\Turing 4.1.1
2009-01-02 16:44 . 2009-01-02 16:44 15,086 –a—— C:\ebaynew.ico
2009-01-02 16:09 . 2009-01-02 16:09 22,158 –a—— C:\napster.ico
2009-01-02 15:46 . 2009-01-02 15:46 17,542 –a—— C:\amazon.ico
2009-01-01 14:57 . 2009-01-01 15:31 d——– c:\documents and settings\Conner\Application Data\codeblocks
2008-12-31 19:22 . 2008-12-31 19:22 1,409 –a—— c:\windows\system32\tmpE7092.FOT
2008-12-31 18:01 . 2008-12-31 18:01 d——– c:\documents and settings\Conner\Application Data\eXPert PDF Editor
2008-12-30 04:11 . 2008-12-30 04:11 d——– c:\documents and settings\Conner\Application Data\skypePM
2008-12-30 04:09 . 2008-12-30 04:58 d——– c:\documents and settings\Conner\Application Data\Skype
2008-12-29 14:52 . 2008-12-29 14:52 d——– c:\documents and settings\All Users\Application Data\FLEXnet
2008-12-29 14:42 . 2008-12-29 14:42 d——– c:\program files\Bonjour
2008-12-29 14:32 . 2008-12-29 14:32 d——– c:\program files\Common Files\Macrovision Shared
2008-12-29 14:31 . 2008-12-29 14:42 d——– c:\program files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 23:02 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-01-23 23:00 ——— d—–w c:\program files\Norton Security Scan
2009-01-23 18:31 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\vlc
2009-01-22 02:27 ——— d—–w c:\documents and settings\Conner\Application Data\vlc
2009-01-20 15:52 473 —-a-w c:\program files\Soulseek.lnk
2008-12-29 19:31 ——— d—–w c:\program files\Adobe Photoshop CS3
2008-12-28 04:12 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\Ableton
2008-12-28 04:09 ——— d—–w c:\program files\Ableton
2008-12-28 04:00 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\codeblocks
2008-12-28 03:12 ——— d—–w c:\program files\CodeBlocks
2008-12-27 01:49 ——— d—–w c:\program files\Ubisoft
2008-12-25 02:11 ——— d—–w c:\documents and settings\Conner\Application Data\Nero
2008-12-24 17:02 ——— d—–w c:\documents and settings\Kristy\Application Data\dvdcss
2008-12-24 15:43 ——— d—–w c:\documents and settings\Kristy\Application Data\eXPert PDF Editor
2008-12-23 22:37 ——— d—–w c:\documents and settings\Kristy\Application Data\FrostWire
2008-12-23 17:57 ——— d—–w c:\documents and settings\All Users\Application Data\2DBoy
2008-12-23 17:51 ——— d—–w c:\program files\WorldOfGoo
2008-12-23 17:48 65,231,060 —-a-w C:\WorldOfGooSetup.exe
2008-12-23 16:23 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\Winamp
2008-12-23 07:34 619 —-a-w c:\program files\gr.txt
2008-12-22 16:11 ——— d—–w c:\documents and settings\Conner\Application Data\My Games
2008-12-22 15:58 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-22 15:58 ——— d—–w c:\program files\Firaxis Games
2008-12-22 06:25 ——— d—–w c:\documents and settings\Conner\Application Data\DAEMON Tools
2008-12-21 17:51 ——— d—–w c:\documents and settings\Kristy\Application Data\Winamp
2008-12-21 02:14 ——— d—–w c:\documents and settings\Conner\Application Data\dvdcss
2008-12-19 22:13 ——— d—–w c:\program files\Dungeon Siege
2008-12-19 19:43 ——— d—–w c:\documents and settings\Conner\Application Data\Winamp
2008-12-16 18:01 ——— d—–w c:\documents and settings\All Users\Application Data\OrbNetworks
2008-12-16 18:00 ——— d—–w c:\program files\Winamp Toolbar
2008-12-16 18:00 ——— d—–w c:\program files\Winamp Remote
2008-12-16 18:00 ——— d—–w c:\program files\Winamp
2008-12-16 18:00 ——— d—–w c:\documents and settings\All Users\Application Data\Winamp Toolbar
2008-12-16 00:20 ——— d—–w c:\documents and settings\Conner\Application Data\DivX
2008-12-14 23:02 ——— d—–w c:\program files\Nickonline
2008-12-14 11:32 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\Nero
2008-12-14 07:25 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\DivX
2008-12-14 06:19 ——— d—–w c:\program files\Common Files\Nero
2008-12-14 06:12 ——— d—–w c:\program files\Nero
2008-12-14 06:11 ——— d—–w c:\program files\Windows Sidebar
2008-12-14 06:08 ——— d—–w c:\documents and settings\All Users\Application Data\Nero
2008-12-13 19:20 ——— d—–w c:\documents and settings\Kristy\Application Data\vlc
2008-12-13 09:36 ——— d—–w c:\program files\Java
2008-12-13 08:01 ——— d—–w c:\program files\MSXML 4.0
2008-12-13 04:36 ——— d—–w c:\documents and settings\Kristy\Application Data\DivX
2008-12-13 04:33 ——— d—–w c:\program files\WinAVI Video Converter
2008-12-13 03:55 ——— d—–w c:\program files\Hewlett-Packard
2008-12-13 03:55 ——— d—–w c:\program files\Common Files\HP
2008-12-13 03:30 ——— d—–w c:\program files\Common Files\Hewlett-Packard
2008-12-13 03:29 ——— d—–w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2008-12-13 03:27 ——— d—–w c:\program files\HP
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-06 20:06 ——— d—–w c:\program files\dBpoweramp
2008-12-06 20:06 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\AccurateRip
2008-12-04 19:59 ——— d—–w c:\documents and settings\All Users\Application Data\Last.fm
2008-12-04 19:57 ——— d—–w c:\program files\Last.fm
2008-12-02 01:07 ——— d—–w c:\documents and settings\Daire\Application Data\codeblocks
2008-11-29 20:51 ——— d—–w c:\documents and settings\Kelly!! !\Application Data\ToadTrip Games Pty Ltd
2008-11-20 20:00 119,120 —-a-w c:\windows\dxsdkuninst.exe
2008-11-16 20:17 62,633 —-a-w c:\windows\prio197uninstall.exe
2008-10-28 22:18 17,331,200 —-a-w c:\windows\RTHDCPL.EXE
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\Program1 —-

2009-01-10 19:21 0 –a—— c:\program1\EA GAMES\Command and Conquer Generals\StateChanged.txt
2009-01-10 19:21 0 –a—— c:\program1\EA GAMES\Command and Conquer Generals\QMPerf.txt
2009-01-10 19:21 0 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Ping.txt
2009-01-10 19:21 0 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Perf.txt
2009-01-10 08:14 99394 –a—— c:\program1\EA GAMES\Uninstal.exe
2004-02-28 05:04 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\6 Alternativ nycklar.reg
2004-02-28 05:03 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\5 Alternativ nycklar.reg
2004-02-28 05:03 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\4 Alternativ nycklar.reg
2004-02-28 05:03 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\3 Alternativ nycklar.reg
2004-02-28 05:02 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\2 Alternativ nycklar.reg
2004-02-28 04:58 41966 –a—— c:\program1\EA GAMES\Install.iip
2004-02-28 01:48 98304 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\generals2.exe
2004-02-28 01:48 6426624 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\game.dat
2004-02-27 10:05 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\1Alternativ nycklar.reg
2004-02-27 10:03 1898 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Register nycklar.reg
2004-01-27 12:06 56 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Generals2.dat
2004-01-27 12:06 56 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Generals.dat
2004-01-25 08:45 56 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Generals.dat
2003-12-18 07:49 6483968 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\game original 1.2.dat
2003-12-18 07:46 18759222 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\INIZH.big
2003-12-16 10:17 56085 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\patch.doc
2003-12-16 10:15 3325 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\launcher.txt
2003-12-02 11:25 38864980 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MapsZH.big
2003-11-24 07:14 9769029 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\WorldBuilder.exe
2003-11-21 07:35 80472332 -ra—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\EnglishZH.big
2003-11-17 11:02 8493653 -ra—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\WindowZH.big
2003-11-17 11:02 121431 -ra—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\PatchZH.big
2003-10-08 03:34 6885376 –a—— c:\program1\EA GAMES\Command and Conquer Generals\WorldBuilder.exe
2003-10-08 03:34 23554152 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\Maps.big
2003-10-08 03:34 1440056 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\Install_Final.bmp
2003-09-29 11:02 86528 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\Patch.doc
2003-09-29 11:00 1462590 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\Patch.big
2003-09-29 07:51 22554 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\Launcher.txt
2003-09-24 08:35 5664768 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\game.dat
2003-09-24 08:35 5664768 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\game Original 1.7.dat
2003-09-24 04:13 7962700 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\Window.big
2003-09-24 04:13 7607479 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\INI.big
2003-09-24 04:13 2774948 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\English.big
2003-08-30 15:59 41472 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\DrvMgt.dll
2003-08-30 15:59 308276 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\00000000.256
2003-08-30 15:59 153720 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\00000000.016
2003-08-30 15:59 12400 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\SECDRV.SYS
2003-08-30 15:58 2696872 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\W3DEnglishZH.big
2003-08-30 15:53 996 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\ShadersZH.big
2003-08-30 15:53 787464 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\GensecZH.big
2003-08-30 15:53 6174552 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\SpeechZH.big
2003-08-30 15:53 34741916 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MusicZH.big
2003-08-30 15:49 254275694 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\SpeechEnglishZH.big
2003-08-30 15:48 23965542 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\AudioZH.big
2003-08-30 15:46 58326522 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\AudioEnglishZH.big
2003-08-30 15:43 222753036 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\TexturesZH.big
2003-08-30 15:42 189741064 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\W3DZH.big
2003-08-30 15:41 8660432 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\TerrainZH.big
2003-08-30 14:39 976268 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\generals original.exe
2003-08-30 14:38 93696 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssdsp.flt
2003-08-30 14:38 83456 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssa3d.m3d
2003-08-30 14:38 80896 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssdx7.m3d
2003-08-30 14:38 786724 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Music.big
2003-08-30 14:38 70656 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssds3d.m3d
2003-08-30 14:38 68743 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Scripts\Scripts.ini
2003-08-30 14:38 67072 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\msssoft.m3d
2003-08-30 14:38 519168 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\P2XDLL.DLL
2003-08-30 14:38 39604 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\launcher.bmp
2003-08-30 14:38 354816 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssrsx.m3d
2003-08-30 14:38 349696 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\mss32.dll
2003-08-30 14:38 267 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\generals2.lcf
2003-08-30 14:38 267 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\generals.lcf
2003-08-30 14:38 25398 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\langdata.dat
2003-08-30 14:38 2272629 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Scripts\SkirmishScripts.scb
2003-08-30 14:38 21630 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\GeneralsZH.ico
2003-08-30 14:38 21630 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Generals.ico
2003-08-30 14:38 197120 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssvoice.asi
2003-08-30 14:38 185344 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\patchw32.dll
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust31.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust30.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust29.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust28.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust27.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust26.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust25.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust24.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust23.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust22.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust21.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust20.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust19.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust18.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust17.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust16.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust15.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust14.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust13.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust12.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust11.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust10.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust09.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust08.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust07.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust06.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust05.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust04.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust03.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust02.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust01.tga
2003-08-30 14:38 16428 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\WaterPlane\caust00.tga
2003-08-30 14:38 163088 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\dbghelp.dll
2003-08-30 14:38 125952 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\mssmp3.asi
2003-08-30 14:38 122880 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\patchget.dat
2003-08-30 14:38 10381 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Scripts\MultiplayerScripts.scb
2003-08-30 14:38 103424 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\MSS\msseax.m3d
2003-08-30 14:37 310128 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Movies\VS_small.bik
2003-08-30 14:37 149700 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Movies\GC_Background.bik
2003-08-30 14:35 24121 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\readme.txt
2003-08-30 14:35 23891876 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\sizzle_review.bik
2003-08-30 14:35 23077588 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_USA01_0.bik
2003-08-30 14:35 20291044 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_USA05_0.bik
2003-08-30 14:35 18456064 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_GLA05_0.bik
2003-08-30 14:35 17220424 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\sizzle_review640.bik
2003-08-30 14:35 16062316 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_USA04_0.bik
2003-08-30 14:35 15983780 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_USA02_0.bik
2003-08-30 14:35 13706924 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_USA03_0.bik
2003-08-30 14:35 105810 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\Readme.doc
2003-08-30 14:35 105810 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\readme.doc
2003-08-30 14:34 9412 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCRemoteChg.ani
2003-08-30 14:34 892 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCNoAction_S.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCScroll7.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCScroll6.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCScroll5.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCScroll4.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccscroll3.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccscroll2.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccscroll1.ani
2003-08-30 14:34 888 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccscroll0.ani
2003-08-30 14:34 886 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCNoKnife.ani
2003-08-30 14:34 886 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCNoBomb.ani
2003-08-30 14:34 886 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCNoAction.ani
2003-08-30 14:34 884 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccpointer.ani
2003-08-30 14:34 882 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCStop.ani
2003-08-30 14:34 8634 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCTimedChg.ani
2003-08-30 14:34 8634 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCHostile2.ani
2003-08-30 14:34 839924 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\EA_LOGO640.BIK
2003-08-30 14:34 7896 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCCashHack.ani
2003-08-30 14:34 7078 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCPlaceBeacon.ani
2003-08-30 14:34 6398 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccattack.ani
2003-08-30 14:34 6388 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCSelect.ani
2003-08-30 14:34 6358 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCFriendly_S.ani
2003-08-30 14:34 6344 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCFriendly.ani
2003-08-30 14:34 5644 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCAttMov.ani
2003-08-30 14:34 5640 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCRepair.ani
2003-08-30 14:34 5638 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\sccmove.ani
2003-08-30 14:34 4744 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCTNTAttack.ani
2003-08-30 14:34 4064 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCRallyPnt.ani
2003-08-30 14:34 3966 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCKnifeAttack.ani
2003-08-30 14:34 346988 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_BossGen_inv_000.bik
2003-08-30 14:34 346964 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_BossGen_000.bik
2003-08-30 14:34 346844 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_NukeGen_inv_000.bik
2003-08-30 14:34 346824 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_TankGen_inv_000.bik
2003-08-30 14:34 346788 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_NukeGen_000.bik
2003-08-30 14:34 346780 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_StealthGen_000.bik
2003-08-30 14:34 346760 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_SuperGen_inv_000.bik
2003-08-30 14:34 346720 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_LaserGen_000.bik
2003-08-30 14:34 346716 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_SuperGen_000.bik
2003-08-30 14:34 346692 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_TankGen_000.bik
2003-08-30 14:34 346660 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_InfantryGen_000.bik
2003-08-30 14:34 346644 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_InfantryGen_inv_000.bik
2003-08-30 14:34 346576 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_StealthGen_inv_000.bik
2003-08-30 14:34 346496 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_AirGen_000.bik
2003-08-30 14:34 346212 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_ThraxGen_inv_000.bik
2003-08-30 14:34 346204 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_DemolGen_000.bik
2003-08-30 14:34 346196 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_DemolGen_inv_000.bik
2003-08-30 14:34 346192 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_ThraxGen_000.bik
2003-08-30 14:34 3270 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCHostile.ani
2003-08-30 14:34 25792 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCHostile3.ani
2003-08-30 14:34 2478 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCHeal.ani
2003-08-30 14:34 2446 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCEnter_S.ani
2003-08-30 14:34 2440 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCEnter.ani
2003-08-30 14:34 2436 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCExit.ani
2003-08-30 14:34 18455164 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_China01_0.bik
2003-08-30 14:34 17970 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCResumeC.ani
2003-08-30 14:34 1682 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCWaypoint_S.ani
2003-08-30 14:34 1682 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCNoEntry_S.ani
2003-08-30 14:34 1680 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCPlace.ani
2003-08-30 14:34 1676 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCWaypoint.ani
2003-08-30 14:34 1676 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCNoEntry.ani
2003-08-30 14:34 1674 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCHostile_S.ani
2003-08-30 14:34 1672 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCSell.ani
2003-08-30 14:34 1670 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCAttMov_S.ani
2003-08-30 14:34 1668 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCRallyPnt_S.ani
2003-08-30 14:34 1666 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCAttack_S.ani
2003-08-30 14:34 1664 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCMove_S.ani
2003-08-30 14:34 16527788 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_China04_0.bik
2003-08-30 14:34 16460 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCSDIUplink.ani
2003-08-30 14:34 16460 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCOutrange.ani
2003-08-30 14:34 1632 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCSpyDrone.ani
2003-08-30 14:34 1616 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCGuard.ani
2003-08-30 14:34 1596884 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\EA_LOGO.BIK
2003-08-30 14:34 15937612 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_China05_0.bik
2003-08-30 14:34 15636 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\Cursors\SCCSniper.ani
2003-08-30 14:34 15558184 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_GLA03_0.bik
2003-08-30 14:34 15523480 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_GLA01_0.bik
2003-08-30 14:34 152152 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_LaserGen_inv_000.bik
2003-08-30 14:34 151536 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\Comp_AirGen_inv_000.bik
2003-08-30 14:34 14858580 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_China03_0.bik
2003-08-30 14:34 1440056 -ra—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Install_Final.bmp
2003-08-30 14:34 13984196 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_GLA02_0.bik
2003-08-30 14:34 13278492 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_GLA04_0.bik
2003-08-30 14:34 13208784 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Data\English\Movies\MD_China02_0.bik
2003-08-30 14:20 358963 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\BINKW32.DLL
2003-08-30 14:16 86016 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\Command and Conquer Generals Zero Hour_uninst.exe
2003-08-30 14:16 69632 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\go_ez.exe
2003-08-30 14:16 626688 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\Command and Conquer Generals Zero Hour_EZ.exe
2003-08-30 14:16 507358 -ra—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\en-us_eahelp.hlp
2003-08-30 14:16 442368 –a—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\Command and Conquer Generals Zero Hour_eReg.exe
2003-08-30 14:16 1219622 -ra—— c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\support\en-uk_eahelp.hlp
2003-04-09 12:32 113152 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Generals.exe
2003-01-17 05:28 308276 –a—— c:\program1\EA GAMES\Command and Conquer Generals\00000000.256
2003-01-17 05:28 23552 –a—— c:\program1\EA GAMES\Command and Conquer Generals\DrvMgt.dll
2003-01-17 05:28 153716 –a—— c:\program1\EA GAMES\Command and Conquer Generals\00000000.016
2003-01-17 05:28 12464 –a—— c:\program1\EA GAMES\Command and Conquer Generals\SECDRV.SYS
2003-01-15 11:28 81482 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\support\Readme.doc
2003-01-15 11:28 81482 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\readme.doc
2003-01-15 11:28 14706 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\support\readme.txt
2003-01-14 10:46 500484 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\support\en-us_eahelp.hlp
2003-01-12 21:50 122880 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\patchget.dat
2003-01-12 12:33 787464 –a—— c:\program1\EA GAMES\Command and Conquer Generals\gensec.big
2003-01-12 12:33 158818808 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Music.big
2003-01-12 12:33 13479230 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Speech.big
2003-01-12 12:33 1200 –a—— c:\program1\EA GAMES\Command and Conquer Generals\shaders.big
2003-01-12 12:32 269104188 –a—— c:\program1\EA GAMES\Command and Conquer Generals\SpeechEnglish.big
2003-01-12 12:32 127940044 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Audio.big
2003-01-12 12:31 333031108 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Textures.big
2003-01-12 12:31 104744592 –a—— c:\program1\EA GAMES\Command and Conquer Generals\AudioEnglish.big
2003-01-12 12:30 184549391 –a—— c:\program1\EA GAMES\Command and Conquer Generals\W3D.big
2003-01-12 12:29 48342856 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Terrain.big
2003-01-12 11:21 9497308 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\Training_Final_00s.bik
2003-01-12 11:21 9484920 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA02_Final_00s.bik
2003-01-12 11:21 9466124 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA07_Final_00s.bik
2003-01-12 11:21 9440016 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA01_Final_00s.bik
2003-01-12 11:21 9420052 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA08_Final_00s.bik
2003-01-12 11:21 9416664 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA04_Final_00s.bik
2003-01-12 11:21 93696 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssdsp.flt
2003-01-12 11:21 9358748 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA03_Final_00s.bik
2003-01-12 11:21 9258892 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA06_Final_00s.bik
2003-01-12 11:21 893854 –a—— c:\program1\EA GAMES\Command and Conquer Generals\generals original.exe
2003-01-12 11:21 83456 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssa3d.m3d
2003-01-12 11:21 80896 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssdx7.m3d
2003-01-12 11:21 70656 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssds3d.m3d
2003-01-12 11:21 6915 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Scripts\MultiplayerScripts.scb
2003-01-12 11:21 67072 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\msssoft.m3d
2003-01-12 11:21 519168 –a—— c:\program1\EA GAMES\Command and Conquer Generals\P2XDLL.DLL
2003-01-12 11:21 467525 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Scripts\SkirmishScripts.scb
2003-01-12 11:21 39608 –a—— c:\program1\EA GAMES\Command and Conquer Generals\launcher.bmp
2003-01-12 11:21 354816 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssrsx.m3d
2003-01-12 11:21 349696 –a—— c:\program1\EA GAMES\Command and Conquer Generals\mss32.dll
2003-01-12 11:21 25398 –a—— c:\program1\EA GAMES\Command and Conquer Generals\langdata.dat
2003-01-12 11:21 21630 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Generals.ico
2003-01-12 11:21 20857148 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA_end.bik
2003-01-12 11:21 197120 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssvoice.asi
2003-01-12 11:21 185344 –a—— c:\program1\EA GAMES\Command and Conquer Generals\patchw32.dll
2003-01-12 11:21 18464604 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA_end.bik
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust31.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust30.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust29.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust28.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust27.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust26.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust25.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust24.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust23.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust22.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust21.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust20.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust19.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust18.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust17.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust16.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust15.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust14.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust13.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust12.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust11.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust10.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust09.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust08.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust07.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust06.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust05.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust04.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust03.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust02.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust01.tga
2003-01-12 11:21 16428 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\WaterPlane\caust00.tga
2003-01-12 11:21 163088 –a—— c:\program1\EA GAMES\Command and Conquer Generals\dbghelp.dll
2003-01-12 11:21 15464260 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\USA_end640.bik
2003-01-12 11:21 144 –a—— c:\program1\EA GAMES\Command and Conquer Generals\generals.lcf
2003-01-12 11:21 14030116 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA_end640.bik
2003-01-12 11:21 125952 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\mssmp3.asi
2003-01-12 11:21 103424 –a—— c:\program1\EA GAMES\Command and Conquer Generals\MSS\msseax.m3d
2003-01-12 11:20 9484312 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China06_Final_00s.bik
2003-01-12 11:20 9480224 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China07_Final_00s.bik
2003-01-12 11:20 9479028 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA04_Final_00s.bik
2003-01-12 11:20 9476400 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA05_Final_00s.bik
2003-01-12 11:20 9466800 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China03_Final_00s.bik
2003-01-12 11:20 9462664 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China01_Final_00s.bik
2003-01-12 11:20 9454488 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA08_Final_00s.bik
2003-01-12 11:20 9434596 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA02_Final_00s.bik
2003-01-12 11:20 9434164 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China05_Final_00s.bik
2003-01-12 11:20 9416184 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China02_Final_00s.bik
2003-01-12 11:20 9412 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCRemoteChg.ani
2003-01-12 11:20 9380716 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA01_Final_00s.bik
2003-01-12 11:20 9380596 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA06_Final_00s.bik
2003-01-12 11:20 9366612 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA03_Final_00s.bik
2003-01-12 11:20 9314264 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\GLA07_Final_00s.bik
2003-01-12 11:20 9304904 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\China04_Final_00s.bik
2003-01-12 11:20 892 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCNoAction_S.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCScroll7.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCScroll6.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCScroll5.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCScroll4.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccscroll3.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccscroll2.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccscroll1.ani
2003-01-12 11:20 888 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccscroll0.ani
2003-01-12 11:20 886 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCNoKnife.ani
2003-01-12 11:20 886 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCNoBomb.ani
2003-01-12 11:20 886 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCNoAction.ani
2003-01-12 11:20 884 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccpointer.ani
2003-01-12 11:20 882 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCStop.ani
2003-01-12 11:20 8634 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCTimedChg.ani
2003-01-12 11:20 8634 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCHostile2.ani
2003-01-12 11:20 839924 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\english\Movies\EA_LOGO640.BIK
2003-01-12 11:20 7896 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCCashHack.ani
2003-01-12 11:20 7078 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCPlaceBeacon.ani
2003-01-12 11:20 6398 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccattack.ani
2003-01-12 11:20 6388 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCSelect.ani
2003-01-12 11:20 6358 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCFriendly_S.ani
2003-01-12 11:20 6344 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCFriendly.ani
2003-01-12 11:20 5644 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCAttMov.ani
2003-01-12 11:20 5640 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCRepair.ani
2003-01-12 11:20 5638 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\sccmove.ani
2003-01-12 11:20 4744 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCTNTAttack.ani
2003-01-12 11:20 4064 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCRallyPnt.ani
2003-01-12 11:20 3966 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCKnifeAttack.ani
2003-01-12 11:20 3270 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCHostile.ani
2003-01-12 11:20 25792 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCHostile3.ani
2003-01-12 11:20 2478 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCHeal.ani
2003-01-12 11:20 2446 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCEnter_S.ani
2003-01-12 11:20 2440 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCEnter.ani
2003-01-12 11:20 2436 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCExit.ani
2003-01-12 11:20 21096880 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\CHINA_end.bik
2003-01-12 11:20 19887184 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\english\Movies\sizzle_review.bik
2003-01-12 11:20 17970 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCResumeC.ani
2003-01-12 11:20 1682 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCWaypoint_S.ani
2003-01-12 11:20 1682 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCNoEntry_S.ani
2003-01-12 11:20 1680 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCPlace.ani
2003-01-12 11:20 1676 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCWaypoint.ani
2003-01-12 11:20 1676 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCNoEntry.ani
2003-01-12 11:20 1674 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCHostile_S.ani
2003-01-12 11:20 1672 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCSell.ani
2003-01-12 11:20 1670 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCAttMov_S.ani
2003-01-12 11:20 1668 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCRallyPnt_S.ani
2003-01-12 11:20 1666 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCAttack_S.ani
2003-01-12 11:20 1664 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCMove_S.ani
2003-01-12 11:20 16460 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCSDIUplink.ani
2003-01-12 11:20 16460 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCOutrange.ani
2003-01-12 11:20 1632 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCSpyDrone.ani
2003-01-12 11:20 1616 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCGuard.ani
2003-01-12 11:20 16030972 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Movies\CHINA_end640.bik
2003-01-12 11:20 1596884 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\english\Movies\EA_LOGO.BIK
2003-01-12 11:20 15636 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\Cursors\SCCSniper.ani
2003-01-12 11:20 15345648 –a—— c:\program1\EA GAMES\Command and Conquer Generals\Data\english\Movies\sizzle_review640.bik
2003-01-12 11:17 358963 –a—— c:\program1\EA GAMES\Command and Conquer Generals\BINKW32.DLL
2003-01-12 11:17 356352 –a—— c:\program1\EA GAMES\Command and Conquer Generals\BrowserEngine.dll
2003-01-12 11:15 86016 –a—— c:\program1\EA GAMES\Command and Conquer Generals\support\Generals_uninst.exe
2003-01-12 11:15 782336 –a—— c:\program1\EA GAMES\Command and Conquer Generals\support\Generals_eReg.exe
2003-01-12 11:15 622592 –a—— c:\program1\EA GAMES\Command and Conquer Generals\support\Command and Conquer Generals_EZ.exe
2003-01-12 11:15 1219622 -ra—— c:\program1\EA GAMES\Command and Conquer Generals\support\en-uk_eahelp.hlp
2003-01-12 08:13 69632 –a—— c:\program1\EA GAMES\Command and Conquer Generals\support\go_ez.exe
c:\program1\EA GAMES\Command & Conquer Generals\Zero Hour\Genväg till generals.lnk

—- Directory of C:\QAF —-

2009-01-25 11:10 368480256 –a—— c:\qaf\season4\Queer as Folk - 406.avi
2009-01-25 10:21 555255800 –a—— c:\qaf\season4\Queer as Folk - 401.mpg
2009-01-25 10:21 369215488 –a—— c:\qaf\season4\Queer as Folk - 410.avi
2009-01-25 10:21 368627712 –a—— c:\qaf\season4\Queer as Folk - 412.avi
2009-01-25 10:21 367525888 –a—— c:\qaf\season4\Queer as Folk - 407.avi
2009-01-25 10:21 367378432 –a—— c:\qaf\season4\Queer as Folk - 413.avi
2009-01-25 10:21 366714880 –a—— c:\qaf\season4\Queer as Folk - 408.avi
2009-01-25 10:21 366587904 –a—— c:\qaf\season4\Queer as Folk - 405.avi
2009-01-25 10:21 366358528 –a—— c:\qaf\season4\Queer as Folk - 409.avi
2009-01-25 10:20 364912640 –a—— c:\qaf\season4\Queer as Folk - 414.avi
2009-01-25 10:19 529681460 –a—— c:\qaf\season4\Queer as Folk - 402.mpg
2009-01-25 10:19 363798528 –a—— c:\qaf\season4\Queer as Folk - 404.avi
2009-01-25 10:15 368939008 –a—— c:\qaf\season4\Queer as Folk - 411.avi
2009-01-22 00:08 438566912 –a—— c:\qaf\season4\Queer as Folk - 403.mpg
2009-01-20 20:33 5297912 –a—— c:\qaf\~uTorrentPartFile_58DBDF531.dat

—- Directory of C:\TSE2 —-

2009-01-25 20:46 217492130 –a—— c:\tse2\TSE2 Installer v104.exe

——- Sigcheck ——-

2001-02-20 13:09 8192 d36a33c21eeed5a6c1daecb7c80a1909 c:\windows\system32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 c:\windows\RTHDCPL.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
–a—— 2007-10-18 06:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
–a—— 2005-07-15 16:48 479232 c:\program files\Google\Gmail Notifier\gnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"a2AntiMalware"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Valve\\Steam\\SteamApps\\drconcon\\half-life\\hl.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Documents and Settings\\Conner\\Desktop\\charon\\Charon.exe"=
"c:\\Valve\\Steam\\SteamApps\\drconcon\\opposing force\\hl.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800]
R4 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]
S1 Start1Driver;Start1Driver; [x]
S4 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2008-05-03 3584]
S4 Start2Driver;Start2Driver; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-01-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-25 c:\windows\Tasks\Norton Security Scan for Conner.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]

2009-01-27 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 04:42]

2009-01-27 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2008-07-07 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kelly!! !\Application Data\Mozilla\Firefox\Profiles\8q5azdzk.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-27 20:54:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-27 20:57:13
ComboFix-quarantined-files.txt 2009-01-28 01:57:10
ComboFix2.txt 2009-01-26 20:03:49

Pre-Run: 83,619,274,752 bytes free
Post-Run: 83,608,702,976 bytes free

798 — E O F — 2009-01-15 12:40:26

HiJackThis Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:14 PM, on 1/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-21-1606980848-789336058-1801674531-1003\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Bilbo')
O4 - HKUS\S-1-5-21-1606980848-789336058-1801674531-1003\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User 'Bilbo')
O4 - HKUS\S-1-5-21-1606980848-789336058-1801674531-1003\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun (User 'Bilbo')
O4 - HKUS\S-1-5-21-1606980848-789336058-1801674531-1003\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h (User 'Bilbo')
O4 - HKUS\S-1-5-21-1606980848-789336058-1801674531-1003\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background (User 'Bilbo')
O4 - HKUS\S-1-5-21-1606980848-789336058-1801674531-1003\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5" -"http://www.shockwave.com/contentPlay/shockwave.jsp?id=inklink&dwin=1&memberStatus=SignedInStandard&brand=" (User 'Bilbo')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 5768 bytes

The computer is running well (enough) - I've stopped experiencing the url.adtrgt.com popups.

Thank you very much for the help !!~

jmw3

Post #8January 28, 2009, 8:57 AM UTC

Hi
Looking good.

ATF Cleaner
Download ATF Cleaner here by Atribune.
Double-click ATF-Cleaner.exe to run the program
Under Main choose: Select All
Click the Empty Selected button
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button
NOTE: If you would like to keep your saved passwords, please click No at the prompt
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button
NOTE: If you would like to keep your saved passwords, please click No at the prompt
Click Exit on the Main menu to close the program.

Kaspersky Online Scan
Do an online scan with >Kaspersky Online Scanner<

Read through the requirements and privacy statement and click on Accept button
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run
When the downloads have finished, click on Settings
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan
Once the scan is complete, it will display the results. Click on View Scan Report
You will see a list of infected items there. Click on Save Report As…
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button
Please post this log in your next reply

To post in next reply:
Kaspersky Scan log
New HijackThis log

jmw3

Post #9February 2, 2009, 3:50 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] url.adtrgt.com

✨ Ask AI

Ask AI