Trouble with Malware Defense

View previous topic View next topic Go down

Trouble with Malware Defense

Post by Orsiny on 9th January 2010, 9:14 pm

My computer is infected with the malware Malware Defense; I am being prompted by two separate windows to do download the program and to remove various risks from my PC. It has also left 3 links to pornographic websites on my desktop. When I first noticed the problem, I tried a manual solution by deleting specified files and registry keys, but was unsuccessful. I did try the solution posted on geekpolice using Malwarebytes, but I am unable to open or re-install that program. My normal anti-virus Norton, and Spybot which I also use are likewise non-functional. I was able to install the recommended updates for Adobe and Java but was not able to do anything about the Microsoft updates as Internet Explorer is also reacting strangely; I do, however, have Automatic Updates enabled and so I do not think I am missing important updates. Please Help!
-----
My hi-jack this report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:46:18 PM, on 1/9/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\DOCUME~1\Tedra\LOCALS~1\Temp\settdebugx.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\DOCUME~1\Tedra\LOCALS~1\Temp\wscsvc32.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\DOCUME~1\Tedra\LOCALS~1\Temp\Installer.exe
C:\Documents and Settings\Tedra\Desktop\winlogon.scr
C:\Program Files\Internet Explorer\Iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [settdebugx.exe] C:\DOCUME~1\Tedra\LOCALS~1\Temp\settdebugx.exe
O4 - S-1-5-18 Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - [You must be registered and logged in to see this link.]
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - [You must be registered and logged in to see this link.]
O16 - DPF: {C190FF32-96D0-445F-9F60-5CF288FD3D0F} (ActiveFormX Control) - [You must be registered and logged in to see this link.]
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 13702 bytes

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Belahzur on 9th January 2010, 9:25 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Orsiny on 9th January 2010, 9:43 pm

After I download the application, it won't allow me to open the setup. There's no message, it simply doesn't do anything. When I had tried to download Malwarebytes' Anti Malware using the method advised in the post on Malware Defense, it would not complete installation.

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Origin on 9th January 2010, 9:44 pm

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31523
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Orsiny on 11th January 2010, 6:05 am

I successfully ran combo-fix; here's the log:

ComboFix 10-01-04.01 - Tedra 01/11/2010 0:25.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.647 [GMT -5:00]
Running from: c:\documents and settings\Tedra\Desktop\Combo-Fix.exe
AV: Norton 360 Premier Edition *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 Premier Edition *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Tedra\LOCALS~1\Temp\wscsvc32.exe
c:\documents and settings\All Users\Desktop\nudetube.com.lnk
c:\documents and settings\All Users\Desktop\pornotube.com.lnk
c:\documents and settings\All Users\Desktop\youporn.com.lnk
c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
c:\program files\Malware Defense
c:\recycler\NPROTECT
c:\windows\system32\drivers\H8SRTwwablrdhml.sys
c:\windows\system32\H8SRTjoymqfqmkt.dat
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\H8SRTqlmdoulkbw.dll
c:\windows\system32\H8SRTtabrnsqtjx.dll
c:\windows\system32\H8SRTyonvurdkvt.dll
c:\windows\unins000.dat
c:\windows\unins000.exe
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys


((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-11 05:42 . 2010-01-11 05:42 -------- d-----w- C:\found.000
2010-01-09 20:08 . 2010-01-09 20:08 -------- d-----w- c:\program files\Sun
2010-01-09 12:09 . 2010-01-09 12:09 -------- d---a-w- c:\program files\Norton Support
2010-01-09 07:13 . 2010-01-09 07:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-01-09 06:26 . 2010-01-09 06:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\GlarySoft
2010-01-09 05:52 . 2010-01-09 05:52 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-01-09 05:51 . 2010-01-09 05:51 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-12-25 00:26 . 2009-12-25 00:26 106404 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-15 06:38 . 2009-12-15 06:38 -------- d-----w- c:\documents and settings\Tedra\Application Data\DivX
2009-12-12 19:41 . 2009-11-14 00:49 129784 ------w- c:\windows\system32\pxafs.dll
2009-12-12 19:37 . 2009-12-12 19:40 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-12 19:37 . 2009-12-12 19:41 -------- d-----w- c:\program files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 05:48 . 2006-08-23 06:50 12637 ----a-w- c:\windows\system32\tablet.dat
2010-01-11 04:56 . 2006-08-28 20:21 -------- d-----w- c:\program files\Symantec
2010-01-11 04:56 . 2006-08-11 16:08 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-09 21:34 . 2009-11-06 04:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-09 20:35 . 2006-08-23 06:54 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-09 20:23 . 2006-08-11 13:30 -------- d-----w- c:\program files\Java
2010-01-09 20:08 . 2009-01-09 01:28 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-09 12:46 . 2007-07-25 05:10 -------- d-----w- c:\program files\uTorrent
2010-01-09 12:46 . 2007-07-27 01:35 -------- d-----w- c:\documents and settings\Tedra\Application Data\utorrent
2010-01-07 21:07 . 2009-11-06 04:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-06 04:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 00:49 . 2007-06-21 02:15 -------- d-----w- c:\documents and settings\Tedra\Application Data\LimeWire
2010-01-04 16:48 . 2006-08-20 04:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-04 05:12 . 2006-08-30 15:21 -------- d-----w- c:\program files\Singles
2009-12-25 00:42 . 2006-08-18 19:34 -------- d-----w- c:\documents and settings\Tedra\Application Data\Apple Computer
2009-12-09 08:20 . 2007-11-14 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-07 10:39 . 2009-10-12 00:54 -------- d-----w- c:\documents and settings\Tedra\Application Data\AdobeUM
2009-12-07 04:14 . 2006-08-11 15:35 136944 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-02 05:29 . 2006-08-11 16:23 -------- d-----w- c:\program files\Quicken
2009-11-26 03:15 . 2009-11-26 03:15 -------- d-----w- c:\program files\MSXML 4.0
2009-11-19 16:48 . 2009-12-02 13:10 872960 ----a-w- c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-19 16:48 . 2009-12-02 13:10 43008 ----a-w- c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 16:48 . 2009-12-02 13:10 340480 ----a-w- c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 16:48 . 2009-12-02 13:10 346624 ----a-w- c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-02 16:11 . 2009-11-02 16:11 1318 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\tmp47bb.tmp\cur.scr
2009-10-29 07:45 . 2004-08-04 21:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 01:58 . 2009-10-29 01:58 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-21 05:38 . 2004-08-04 21:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 21:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 21:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 21:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-04-01 02:47 . 2008-09-03 07:33 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2006-12-31 04:09 . 2006-12-31 04:09 22 --sha-w- c:\windows\SMINST\HPCD.sys
2007-08-24 05:37 . 2007-08-24 05:37 56 --sh--r- c:\windows\system32\832E4C26E1.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-26 7561216]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]
"imekrmig"="c:\ime\IMKR\imekrmig.exe" [2001-01-09 44544]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-15 454656]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-17 61952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-10-19 202032]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-09 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hp\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-4 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"L08AXLRD_18267593"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"Corel Painter 8f"=c:\program files\Common Files\Corel\Registration\EN\Registration.exe /title="Corel Painter 8" /date=022108 serial=PF08CTD-9999999-KHN
"Microsoft Works Portfolio"=c:\program files\Microsoft Works\WksSb.exe /AllUsers

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"HostManager"=c:\program files\Common Files\AOL\1155964610\ee\AOLSoftware.exe
"AOLDialer"=c:\program files\Common Files\AOL\ACS\AOLDial.exe
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"QPService"="c:\program files\HP\QuickPlay\QPService.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1155964610\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\HP Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\1155964610\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/31/2007 6:03 PM 24652]
S3 Flash1;Flash1;c:\program files\SP36869\winphlash\FLASH1.sys [3/1/2006 4:54 PM 3456]
.
Contents of the 'Scheduled Tasks' folder

2010-01-11 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {C190FF32-96D0-445F-9F60-5CF288FD3D0F} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - c:\documents and settings\Tedra\Desktop\HijackThis.exe
AddRemove-LimeWire - c:\program files\LimeWire\uninstall.exe
AddRemove-Spybot - Search & Destroy_is1 - c:\windows\unins000.exe
AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-11 00:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???8f????????@???????@

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3113355611-1452560611-805822321-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(1836)
c:\windows\system32\WININET.dll
c:\windows\system32\tabhook.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Common Files\aolshare\aolshcpy.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\msdtc.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\mqtgsvc.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2010-01-11 00:58:19 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-11 05:57

Pre-Run: 24,400,506,880 bytes free
Post-Run: 24,470,462,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 2B6F1E7E5EDF3EEC0BC1BA929DE1E4C0

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Origin on 11th January 2010, 6:09 am


  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    Folder::
    C:\found.000
    c:\program files\uTorrent
    c:\documents and settings\Tedra\Application Data\utorrent
    c:\documents and settings\Tedra\Application Data\LimeWire

    File::
    c:\windows\system32\832E4C26E1.sys

    Driver::
    Viewpoint Manager Service
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31523
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Orsiny on 11th January 2010, 7:00 am

I've successfully followed the instructions above; here's the new Combo-Fix Log:

ComboFix 10-01-04.01 - Tedra 01/11/2010 1:22.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.551 [GMT -5:00]
Running from: c:\documents and settings\Tedra\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Tedra\Desktop\CFScript.txt
AV: Norton 360 Premier Edition *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 Premier Edition *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FILE ::
"c:\windows\system32\832E4C26E1.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Tedra\Application Data\LimeWire
c:\documents and settings\Tedra\Application Data\LimeWire\412splashfree.png
c:\documents and settings\Tedra\Application Data\LimeWire\414splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\active.mojito
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xul-v2.0b2.4-do-not-remove
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\branding.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\branding.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\classic.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\classic.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\comm.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\comm.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\en-US.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\en-US.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\limewire.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\limewire.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\pippki.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\pippki.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\chrome\toolkit.manifest
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\accessibility-msaa.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\accessibility.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\alerts.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\appshell.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\appstartup.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\auth.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\autocomplete.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\autoconfig.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\caps.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\chardet.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\chrome.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\commandhandler.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\commandlines.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\composer.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\content_base.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\content_html.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\content_htmldoc.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\content_xmldoc.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\content_xslt.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\content_xtf.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\contentprefs.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\cookie.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\directory.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\docshell_base.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_base.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_canvas.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_core.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_css.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_events.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_html.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_json.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_loadsave.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_offline.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_range.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_sidebar.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_storage.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_stylesheets.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_svg.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_traversal.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_views.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_xbl.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_xpath.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\dom_xul.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\downloads.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\editor.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\embed_base.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\extensions.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\exthandler.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\exthelper.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\fastfind.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\FeedProcessor.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\feeds.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\find.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\gfx.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\htmlparser.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\imgicon.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\imglib2.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\inspector.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\intl.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\jar.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\jsconsole-clhandler.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\jsdservice.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\layout_base.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\layout_printing.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\layout_xul.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\layout_xul_tree.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\locale.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\loginmgr.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\lwbrk.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\mimetype.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\mozbrwsr.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\mozfind.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_about.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_cache.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_cookie.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_dns.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_file.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_ftp.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_http.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_res.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_socket.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_strconv.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\necko_viewsource.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsAddonRepository.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsBadCertHandler.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsBlocklistService.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsContentDispatchChooser.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsContentPrefService.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsDefaultCLH.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsDictionary.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsDownloadManagerUI.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsExtensionManager.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsHandlerService.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsHelperAppDlg.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsLivemarkService.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsLoginInfo.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsLoginManager.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsLoginManagerPrompter.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsPostUpdateWin.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsProgressDialog.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsProxyAutoConfig.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsResetPref.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsTaggingService.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsTryToClose.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsUpdateService.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsURLFormatter.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsWebHandlerApp.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsXmlRpcClient.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\nsXULAppInstall.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\oji.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\parentalcontrols.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pipboot.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pipboot.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pipnss.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pipnss.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pippki.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pippki.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\places.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\plugin.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pluginGlue.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\pref.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\prefetch.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\profile.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\proxyObject.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\rdf.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\satchel.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\saxparser.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\shistory.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\spellchecker.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\storage-Legacy.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\storage.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\toolkitprofile.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\transformiix.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\txEXSLTRegExFunctions.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\txmgr.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\txtsvc.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\uconv.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\unicharutil.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\universalchardet.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\update.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\uriloader.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\urlformatter.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\webBrowser_core.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\webbrowserpersist.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\webshell_idls.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\websrvcs.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\widget.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\windowds.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\windowwatcher.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xml-rpc.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xmlextras.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_base.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_components.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_ds.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_io.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_system.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_thread.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpcom_xpti.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpconnect.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xpinstall.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xulapp.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xulapp_setup.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xuldoc.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xultmpl.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\xulutil.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\components\zipwriter.xpt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\crashreporter.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\crashreporter.ini
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\platform.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\autoconfig\prefcalls.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\pref\xulrunner.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userChrome-example.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\profile\chrome\userContent-example.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\profile\localstore.rdf
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userChrome-example.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\chrome\userContent-example.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\defaults\profile\US\localstore.rdf
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\dependentlibs.list
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.aff
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\dictionaries\en-US.dic
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\freebl3.chk
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\freebl3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\greprefs\all.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\greprefs\security-prefs.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\greprefs\xpinstall.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\javaxpcom.jar
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\javaxpcomglue.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\js3250.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\LICENSE
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\debug.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\DownloadUtils.jsm
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\ISO8601DateUtils.jsm
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\JSON.jsm
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\Microformats.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\PluralForm.jsm
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\utils.js
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\modules\XPCOMUtils.jsm
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\mozctl.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\mozctlx.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\MSVCP71.DLL
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\msvcr71.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\nspr4.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\nss3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\nssckbi.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\nssdbm3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\nssutil3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\platform.ini
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\plc4.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\plds4.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\plugins\npnul32.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\README.txt
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\arrow.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\arrowd.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\broken-image.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\charsetalias.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\charsetData.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\contenteditable.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\designmode.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\dtd\mathml.dtd
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\dtd\xhtml11.dtd
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\EditorOverride.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Latin1.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Special.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\entityTables\html40Symbols.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\entityTables\htmlEntityVersions.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\entityTables\mathml20.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\entityTables\transliterate.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfont.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontStandardSymbolsL.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXNonUnicode.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSTIXSize1.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontSymbol.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\fonts\mathfontUnicode.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\forms.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\grabber.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\hiddenWindow.html
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\html.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\html\folder.png
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\langGroups.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\language.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\loading-image.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\mathml.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\quirk.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\svg.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-active.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after-hover.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-column-after.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-active.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before-hover.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-column-before.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-active.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after-hover.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-row-after.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-active.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before-hover.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-add-row-before.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-active.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-remove-column-hover.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-remove-column.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-active.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-remove-row-hover.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\table-remove-row.gif
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\ua.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\viewsource.css
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\res\wincharset.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\smime3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\softokn3.chk
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\softokn3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\sqlite3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\ssl3.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\updater.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\version.properties
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xpcom.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xpcshell.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xpicleanup.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xpidl.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xpt_dump.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xpt_link.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xul.dll
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xulrunner-stub.exe
c:\documents and settings\Tedra\Application Data\LimeWire\browser\xulrunner\xulrunner.exe
c:\documents and settings\Tedra\Application Data\LimeWire\certificate\limewire.keystore
c:\documents and settings\Tedra\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Tedra\Application Data\LimeWire\data.ser
c:\documents and settings\Tedra\Application Data\LimeWire\downloads.dat
c:\documents and settings\Tedra\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Tedra\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Tedra\Application Data\LimeWire\filters.props
c:\documents and settings\Tedra\Application Data\LimeWire\gnutella.net
c:\documents and settings\Tedra\Application Data\LimeWire\installation.props
c:\documents and settings\Tedra\Application Data\LimeWire\library.dat
c:\documents and settings\Tedra\Application Data\LimeWire\library5.dat
c:\documents and settings\Tedra\Application Data\LimeWire\limewire.props
c:\documents and settings\Tedra\Application Data\LimeWire\mojito.props
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\.autoreg
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_001_
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_002_
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_003_
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\_CACHE_MAP_
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\325A1218d01
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\4C9319BBd01
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\7BCC79A5d01
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\7BD6A121d01
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\AE98BDEDd01
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\Cache\BAFF9A9Bd01
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\cert8.db
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\compreg.dat
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\cookies.sqlite
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\downloads.sqlite
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\extensions.cache
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\extensions.ini
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\history.dat
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\key3.db
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\permissions.sqlite
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\places.sqlite-journal
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\places.sqlite
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\pluginreg.dat
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\prefs.js
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\secmod.db
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\XPC.mfl
c:\documents and settings\Tedra\Application Data\LimeWire\mozilla-profile\xpti.dat
c:\documents and settings\Tedra\Application Data\LimeWire\promotion\promodb.backup
c:\documents and settings\Tedra\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\Tedra\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\Tedra\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\Tedra\Application Data\LimeWire\pub1.key
c:\documents and settings\Tedra\Application Data\LimeWire\public.key
c:\documents and settings\Tedra\Application Data\LimeWire\questions.props
c:\documents and settings\Tedra\Application Data\LimeWire\responses.cache
c:\documents and settings\Tedra\Application Data\LimeWire\secureMessage.key
c:\documents and settings\Tedra\Application Data\LimeWire\simpp.xml
c:\documents and settings\Tedra\Application Data\LimeWire\spam.dat
c:\documents and settings\Tedra\Application Data\LimeWire\tables.props
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme.lwtp
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\01_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\02_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\03_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\04_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\05_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\chat.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\dir_closed.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\dir_open.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\forward_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\forward_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\kill.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\kill_on.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\lime.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\logo.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\notsearching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\pause_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\pause_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\play_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\play_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\question.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\rewind_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\rewind_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\searching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\splash.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\stop_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\stop_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\theme.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\black_theme\warning.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme.lwtp
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\01_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\02_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\03_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\04_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\05_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\chat.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\dir_closed.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\dir_open.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\forward_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\forward_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\kill.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\logo.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\notsearching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\pause_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\pause_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\play_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\play_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\question.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\rewind_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\rewind_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\search.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\searching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\splash.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\stop_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\stop_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\theme.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\classic_theme\warning.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme.lwtp
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\01_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\02_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\03_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\04_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\05_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\chat.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\dir_closed.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\dir_open.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\forward_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\forward_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\kill.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\kill_on.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\lime.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\logo.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\notsearching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\pause_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\pause_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\play_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\play_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\question.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\rewind_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\rewind_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\searching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\splash.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\stop_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\stop_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\theme.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewire_theme\warning.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme.lwtp
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\01_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\02_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\03_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\04_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\05_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\chat.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\dir_closed.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\dir_open.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\forward_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\forward_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\kill.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\kill_on.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\lime.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\logo.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\lw_logo.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\notsearching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\pause_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\pause_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\play_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\play_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\question.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\rewind_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\rewind_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\searching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\splash.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\stop_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\stop_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\theme.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\version.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\limewirePro_theme\warning.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme.lwtp
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\01_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\02_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\03_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\04_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\05_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\chat.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\forward_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\forward_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\kill.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\kill_on.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\logo.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\notsearching.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\pause_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\pause_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\play_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\play_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\question.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\rewind_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\rewind_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\searching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\splash.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\stop_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\stop_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\theme.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\other_theme\warning.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme.lwtp
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\01_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\02_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\03_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\04_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\05_star.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\chat.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\forward_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\kill.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\kill_on.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\logo.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\notsearching.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\pause_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\play_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\play_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\question.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\searching.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\splash.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\splashpro.png
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\stop_up.gif
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\theme.txt
c:\documents and settings\Tedra\Application Data\LimeWire\themes\windows_theme\warning.gif
c:\documents and settings\Tedra\Application Data\LimeWire\ttdata.cache
c:\documents and settings\Tedra\Application Data\LimeWire\ttree.cache
c:\documents and settings\Tedra\Application Data\LimeWire\ttrees.cache
c:\documents and settings\Tedra\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Tedra\Application Data\LimeWire\update.xml
c:\documents and settings\Tedra\Application Data\LimeWire\version.key
c:\documents and settings\Tedra\Application Data\LimeWire\version.xml
c:\documents and settings\Tedra\Application Data\LimeWire\versions.props
c:\documents and settings\Tedra\Application Data\LimeWire\xml\data\audio.sxml2
c:\documents and settings\Tedra\Application Data\LimeWire\xml\data\audio.sxml3
c:\documents and settings\Tedra\Application Data\LimeWire\xml\data\delete_me
c:\documents and settings\Tedra\Application Data\LimeWire\xml\misc\application.gif
c:\documents and settings\Tedra\Application Data\LimeWire\xml\misc\audio.gif
c:\documents and settings\Tedra\Application Data\LimeWire\xml\misc\document.gif
c:\documents and settings\Tedra\Application Data\LimeWire\xml\misc\image.gif
c:\documents and settings\Tedra\Application Data\LimeWire\xml\misc\video.gif
c:\documents and settings\Tedra\Application Data\LimeWire\xml\schemas\application.xsd
c:\documents and settings\Tedra\Application Data\LimeWire\xml\schemas\audio.xsd
c:\documents and settings\Tedra\Application Data\LimeWire\xml\schemas\document.xsd
c:\documents and settings\Tedra\Application Data\LimeWire\xml\schemas\image.xsd
c:\documents and settings\Tedra\Application Data\LimeWire\xml\schemas\video.xsd
c:\documents and settings\Tedra\Application Data\utorrent
c:\documents and settings\Tedra\Application Data\utorrent\[1999.12.02] Happy Bivouac.torrent
c:\documents and settings\Tedra\Application Data\utorrent\[HorribleSubs] Kurogane no Linebarrel - 23 [480p].mkv.torrent
c:\documents and settings\Tedra\Application Data\utorrent\[Nipponsei] Michiko to Hatchin OST Chapter 1.zip.torrent
c:\documents and settings\Tedra\Application Data\utorrent\[Nipponsei] Michiko to Hatchin OST Chapter 2.zip.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Adobe CS4 Master Collection - Shadeyman.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Adobe Dreamweaver CS4.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Adobe Illustrator CS4 [CLEAN] [blaze69].7z.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Adobe Indesign Cs4.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Adobe Photoshop CS4 Extended.torrent
c:\documents and settings\Tedra\Application Data\utorrent\ALI PROJECT.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Aras Musik 1.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Bokurano_ch44-47[MS].torrent
c:\documents and settings\Tedra\Application Data\utorrent\Bokurano_ch48-52[MS].torrent
c:\documents and settings\Tedra\Application Data\utorrent\dht.dat
c:\documents and settings\Tedra\Application Data\utorrent\dht.dat.old
c:\documents and settings\Tedra\Application Data\utorrent\DJ Rafi Raf - Mixfilez Vol.16.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Dream.torrent
c:\documents and settings\Tedra\Application Data\utorrent\FFTA2 OST.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Friend-Chingoo.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Gakuen Alice 16 [ADTRW].mkv.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Grave.of.the.fireflies.DVDRip.XviD-flourIsh.torrent
c:\documents and settings\Tedra\Application Data\utorrent\I've Sound ???? ??? - ??64?.torrent
c:\documents and settings\Tedra\Application Data\utorrent\LimeWire PRO 4.18.8.torrent
c:\documents and settings\Tedra\Application Data\utorrent\LimeWire PRO v5.1.4 Final By ChattChitto.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Mahjongg Master Deluxe.rar.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Microsoft Office 2003 Frontpage.iso.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Mugen no Juunin OST.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Pans_Labyrinth_(El_Laberinto_del_Fauno)-OST-READ_NFO-2006-SNAP.torrent
c:\documents and settings\Tedra\Application Data\utorrent\QuarkXPress.Passport.v7.02.[MULTiLANGUAGE]HubBaZ-06.rar.torrent
c:\documents and settings\Tedra\Application Data\utorrent\resume.dat
c:\documents and settings\Tedra\Application Data\utorrent\resume.dat.old
c:\documents and settings\Tedra\Application Data\utorrent\RosettaStone_Installer_Disk.iso.torrent
c:\documents and settings\Tedra\Application Data\utorrent\RS_Ital_I_and_II_DVD.iso.torrent
c:\documents and settings\Tedra\Application Data\utorrent\rss.dat
c:\documents and settings\Tedra\Application Data\utorrent\rss.dat.old
c:\documents and settings\Tedra\Application Data\utorrent\settings.dat
c:\documents and settings\Tedra\Application Data\utorrent\settings.dat.old
c:\documents and settings\Tedra\Application Data\utorrent\Susumu Hirasawa.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Sword of the Stranger mkv h264.torrent
c:\documents and settings\Tedra\Application Data\utorrent\The Blueprint 3.torrent
c:\documents and settings\Tedra\Application Data\utorrent\The Joy Luck Club.torrent
c:\documents and settings\Tedra\Application Data\utorrent\Thirst.2009.LiMiTED.SUBBED.DVDRip.XviD-NODLABS.torrent
c:\documents and settings\Tedra\Application Data\utorrent\utorrent.lng
c:\documents and settings\Tedra\Application Data\utorrent\VTC.Adobe.Illustrator.CS3-CFE[[You must be registered and logged in to see this link.]
C:\found.000
c:\found.000\file0000.chk
c:\program files\uTorrent
c:\windows\system32\832E4C26E1.sys

.

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Orsiny on 11th January 2010, 7:01 am

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_VIEWPOINT_MANAGER_SERVICE
-------\Service_Viewpoint Manager Service


((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-11 05:07 . 2010-01-11 05:58 -------- d-----w- C:\Combo-Fix
2010-01-09 20:08 . 2010-01-09 20:08 -------- d-----w- c:\program files\Sun
2010-01-09 12:09 . 2010-01-09 12:09 -------- d---a-w- c:\program files\Norton Support
2010-01-09 07:13 . 2010-01-09 07:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-01-09 06:26 . 2010-01-09 06:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\GlarySoft
2010-01-09 05:52 . 2010-01-09 05:52 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-01-09 05:51 . 2010-01-09 05:51 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-12-25 00:26 . 2009-12-25 00:26 106404 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-15 06:38 . 2009-12-15 06:38 -------- d-----w- c:\documents and settings\Tedra\Application Data\DivX
2009-12-12 19:41 . 2009-11-14 00:49 129784 ------w- c:\windows\system32\pxafs.dll
2009-12-12 19:37 . 2009-12-12 19:40 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-12 19:37 . 2009-12-12 19:41 -------- d-----w- c:\program files\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 06:36 . 2006-08-23 06:50 12637 ----a-w- c:\windows\system32\tablet.dat
2010-01-11 04:56 . 2006-08-28 20:21 -------- d-----w- c:\program files\Symantec
2010-01-11 04:56 . 2006-08-11 16:08 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-09 21:34 . 2009-11-06 04:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-09 20:35 . 2006-08-23 06:54 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-09 20:23 . 2006-08-11 13:30 -------- d-----w- c:\program files\Java
2010-01-09 20:08 . 2009-01-09 01:28 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-07 21:07 . 2009-11-06 04:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-06 04:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 16:48 . 2006-08-20 04:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-04 05:12 . 2006-08-30 15:21 -------- d-----w- c:\program files\Singles
2009-12-25 00:42 . 2006-08-18 19:34 -------- d-----w- c:\documents and settings\Tedra\Application Data\Apple Computer
2009-12-09 08:20 . 2007-11-14 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-07 10:39 . 2009-10-12 00:54 -------- d-----w- c:\documents and settings\Tedra\Application Data\AdobeUM
2009-12-07 04:14 . 2006-08-11 15:35 136944 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-02 05:29 . 2006-08-11 16:23 -------- d-----w- c:\program files\Quicken
2009-11-26 03:15 . 2009-11-26 03:15 -------- d-----w- c:\program files\MSXML 4.0
2009-11-14 00:47 . 2009-11-14 00:47 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-10-29 07:45 . 2004-08-04 21:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 21:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 21:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 21:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 21:00 270336 ----a-w- c:\windows\system32\oakley.dll
2009-04-01 02:47 . 2008-09-03 07:33 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2006-12-31 04:09 . 2006-12-31 04:09 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-26 7561216]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]
"imekrmig"="c:\ime\IMKR\imekrmig.exe" [2001-01-09 44544]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-15 454656]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-17 61952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-10-19 202032]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-09 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hp\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-4 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"L08AXLRD_18267593"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2008 DVD\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"Corel Painter 8f"=c:\program files\Common Files\Corel\Registration\EN\Registration.exe /title="Corel Painter 8" /date=022108 serial=PF08CTD-9999999-KHN
"Microsoft Works Portfolio"=c:\program files\Microsoft Works\WksSb.exe /AllUsers

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"HostManager"=c:\program files\Common Files\AOL\1155964610\ee\AOLSoftware.exe
"AOLDialer"=c:\program files\Common Files\AOL\ACS\AOLDial.exe
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"QPService"="c:\program files\HP\QuickPlay\QPService.exe"
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1155964610\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\HP Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\1155964610\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

S3 Flash1;Flash1;c:\program files\SP36869\winphlash\FLASH1.sys [3/1/2006 4:54 PM 3456]
.
Contents of the 'Scheduled Tasks' folder

2010-01-11 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {C190FF32-96D0-445F-9F60-5CF288FD3D0F} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\Tedra\Application Data\Mozilla\Firefox\Profiles\tlwuta94.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-11 01:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???8f????????@???????@

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3113355611-1452560611-805822321-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(964)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3204)
c:\windows\system32\WININET.dll
c:\windows\system32\tabhook.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Common Files\aolshare\aolshcpy.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\mqtgsvc.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2010-01-11 01:46:25 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-11 06:46
ComboFix2.txt 2010-01-11 05:58

Pre-Run: 24,485,306,368 bytes free
Post-Run: 24,428,462,080 bytes free

- - End Of File - - 22DF763157B3F420E28496BF717E6D19

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Origin on 11th January 2010, 7:02 am

You should be able to run Malwarebytes now:

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31523
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Orsiny on 11th January 2010, 7:35 am

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.44
Database version: 3539
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/11/2010 2:21:55 AM
mbam-log-2010-01-11 (02-21-55).txt

Scan type: Quick Scan
Objects scanned: 130821
Time elapsed: 7 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Tedra\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Defense.lnk (Rogue.MalwareDefense) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tedra\desktop\winlogon.scr (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Belahzur on 11th January 2010, 11:33 am

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Orsiny on 11th January 2010, 5:45 pm

Big Grin I'm happy to report that everything seems to be working fine! Many thanks to Belahzur and Origin for all your help! From now on I'll try to take some extra precautions to save myself a night of hair-pulling and cold sweats...

Orsiny
Novice
Novice

Posts Posts : 7
Joined Joined : 2010-01-09
OS OS : Windows XP Professional
Points Points : 25363
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Trouble with Malware Defense

Post by Belahzur on 11th January 2010, 8:55 pm

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum