| I believe I have done this correctly. A few days ago I lost control of the task manager and no telling what else. I was able to solve that. I am still getting warnings about trojans/viruses. Please help!
ComboFix 08-05-12.1 - Darrell 2008-05-13 21:13:10.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2268 [GMT -4:00]
Running from: C:\Documents and Settings\Darrell\Desktop\downloads\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-04-14 to 2008-05-14 )))))))))))))))))))))))))))))))
.
2008-05-13 20:36 . 2008-05-13 21:04 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-13 20:36 . 2008-05-13 20:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-13 20:36 . 2008-05-13 20:36 <DIR> d-------- C:\Documents and Settings\Darrell\Application Data\SUPERAntiSpyware.com
2008-05-13 20:36 . 2008-05-13 20:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-13 20:28 . 2008-05-13 20:28 <DIR> d-------- C:\Program Files\CCleaner
2008-05-13 18:47 . 2008-05-13 18:47 <DIR> d-------- C:\936b66fef8659bca63e78378
2008-05-13 16:34 . 2008-05-13 21:12 <DIR> d--hs---- C:\Documents and Settings\Darrell\Temporary Internet Files
2008-05-12 14:18 . 2008-05-13 21:04 1,024 --ah----- C:\Documents and Settings\Guest\NTUSER.DAT.LOG
2008-05-11 14:39 . 2008-05-11 14:45 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-11 14:10 . 2008-05-11 14:10 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-05-11 14:10 . 2008-05-11 14:10 <DIR> d-------- C:\WINDOWS\system32\en
2008-05-11 14:10 . 2008-05-11 14:10 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-11 14:09 . 2008-05-11 14:10 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-11 14:07 . 2008-05-11 14:07 <DIR> d-------- C:\WINDOWS\EHome
2008-05-11 12:27 . 2008-05-11 12:27 <DIR> d-------- C:\Program Files\Microsoft Games
2008-05-11 12:27 . 2008-05-11 15:14 <DIR> d-------- C:\Program Files\GameSpy Arcade
2008-05-10 17:43 . 2008-05-13 18:00 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-10 17:41 . 2008-05-13 02:30 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-10 17:41 . 2008-05-10 17:41 <DIR> d-------- C:\Program Files\AVG
2008-05-10 17:41 . 2008-05-10 17:41 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-10 17:41 . 2008-05-10 17:41 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-05-10 17:41 . 2008-05-10 17:41 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-10 17:23 . 2008-05-10 17:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-05-10 16:47 . 2008-05-10 17:30 <DIR> d-------- C:\WINDOWS\rnapxs
2008-05-09 18:22 . 2008-05-09 18:22 90,752 --a------ C:\WINDOWS\system32\doaxqbgq.dll
2008-05-09 14:30 . 2008-05-09 14:33 <DIR> d-------- C:\Documents and Settings\Darrell\Application Data\AVGTOOLBAR
2008-05-09 14:17 . 2008-05-10 16:09 376 --a------ C:\WINDOWS\wininit.ini
2008-05-09 14:01 . 2008-05-10 17:23 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-09 13:54 . 2008-05-09 13:54 <DIR> d-------- C:\Documents and Settings\Darrell\Application Data\TmpRecentIcons
2008-05-09 12:43 . 2008-05-09 12:43 90,752 --a------ C:\WINDOWS\system32\arcftidr.dll
2008-05-09 12:38 . 2008-05-09 12:38 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-05-09 12:37 . 2008-05-09 12:37 30,336 --a------ C:\WINDOWS\system32\yayASIaW.dll
2008-05-09 12:37 . 2008-05-09 12:37 30,336 --a------ C:\WINDOWS\system32\urqOeDUK.dll
2008-05-09 12:37 . 2008-05-09 12:37 1 --a------ C:\WINDOWS\system32\kr_done1de
2008-04-26 19:55 . 2008-04-13 20:09 811,064 --a------ C:\WINDOWS\system32\imjp81k.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-13 22:23 --------- d-----w C:\Program Files\WinAce
2008-05-11 19:14 --------- d-----w C:\Program Files\Steam
2008-05-11 19:14 --------- d-----w C:\Program Files\QuickMediaConverter
2008-05-11 19:14 --------- d-----w C:\Program Files\MegaSoundRecorder
2008-05-11 19:14 --------- d-----w C:\Program Files\Everquest
2008-05-11 19:14 --------- d-----w C:\Program Files\Decoder
2008-05-11 19:14 --------- d-----w C:\Documents and Settings\Darrell\Application Data\Ventrilo
2008-05-11 19:14 --------- d-----w C:\Documents and Settings\Darrell\Application Data\Magelo Update
2008-05-11 19:10 --------- d-----w C:\Program Files\Snapshot Viewer
2008-05-11 19:05 --------- d-----w C:\Program Files\Free Window Registry Repair
2008-05-10 22:53 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-05-10 21:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-10 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-14 09:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 09:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 09:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 00:13 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:13 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 19:18 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 19:15 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 18:56 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys
2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
2008-04-13 18:55 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
2008-04-13 18:53 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys
2008-04-13 18:53 36,608 ----a-w C:\WINDOWS\system32\drivers\ip6fw.sys
2008-04-13 18:53 264,832 ----a-w C:\WINDOWS\system32\drivers\http.sys
2008-04-13 18:51 61,824 ----a-w C:\WINDOWS\system32\drivers\nic1394.sys
2008-04-13 18:51 60,800 ----a-w C:\WINDOWS\system32\drivers\arp1394.sys
2008-04-13 18:51 59,904 ----a-w C:\WINDOWS\system32\drivers\atmarpc.sys
2008-04-13 18:51 55,808 ----a-w C:\WINDOWS\system32\drivers\atmlane.sys
2008-04-13 18:51 101,120 ------w C:\WINDOWS\system32\drivers\bthpan.sys
2008-04-13 18:47 25,856 ----a-w C:\WINDOWS\system32\drivers\usbprint.sys
2008-04-13 18:46 61,696 ----a-w C:\WINDOWS\system32\drivers\ohci1394.sys
2008-04-13 18:46 59,136 ------w C:\WINDOWS\system32\drivers\rfcomm.sys
2008-04-13 18:46 53,376 ----a-w C:\WINDOWS\system32\drivers\1394bus.sys
2008-04-13 18:46 37,888 ------w C:\WINDOWS\system32\drivers\bthmodem.sys
2008-04-13 18:46 36,480 ------w C:\WINDOWS\system32\drivers\bthprint.sys
2008-04-13 18:46 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-04-13 18:46 25,600 ------w C:\WINDOWS\system32\drivers\hidbth.sys
2008-04-13 18:46 25,344 ----a-w C:\WINDOWS\system32\drivers\sonydcam.sys
2008-04-13 18:46 18,944 ------w C:\WINDOWS\system32\drivers\bthusb.sys
2008-04-13 18:46 17,024 ------w C:\WINDOWS\system32\drivers\bthenum.sys
2008-04-13 18:46 121,984 ------w C:\WINDOWS\system32\drivers\usbvideo.sys
2008-04-13 18:44 81,664 ----a-w C:\WINDOWS\system32\drivers\videoprt.sys
2008-04-13 18:44 799,744 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
2008-04-13 18:44 20,992 ----a-w C:\WINDOWS\system32\drivers\vga.sys
.
((((((((((((((((((((((((((((( snapshot@2008-05-13_18.15.24.17 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-13 22:12:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-14 01:05:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2008-05-13 22:12:33 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-05-14 01:05:35 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-05-09 18:35:06 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-05-14 01:06:00 16,384 ------w C:\WINDOWS\Temp\Perflib_Perfdata_234.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C545916-1113-40F9-861C-196714D69486}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F4E0757-AC6E-49FF-B771-D71FD0CAD8EE}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8044456F-58EF-43D7-8DC5-A2D6E9B173F2}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
2008-05-10 17:41 2050816 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A4017D9D-AD44-4EE2-8482-4A3682183F92}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3A9074B-1E3C-45D6-9195-604CE2F1D5B8}]
2008-05-09 12:37 30336 --a------ C:\WINDOWS\system32\urqOeDUK.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-05-10 17:41 2050816]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
[HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-05-10 17:41 2050816]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
[HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 14:20 81920]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 14:20 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 18:43 2051096]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 18:57 2095640]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-09 15:25 16859648 C:\WINDOWS\RTHDCPL.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40 155648]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-10 17:41 1177368]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-04-01 02:45:31 784912]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{C3A9074B-1E3C-45D6-9195-604CE2F1D5B8}"= C:\WINDOWS\system32\urqOeDUK.dll [2008-05-09 12:37 30336]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqOeDUK]
urqOeDUK.dll 2008-05-09 12:37 30336 C:\WINDOWS\system32\urqOeDUK.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm
"msacm.l3codec"= l3codecp.acm
"msacm.avis"= ff_acm.acm
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Darrell^Start Menu^Programs^Startup^IMVU.lnk]
backup=C:\WINDOWS\pss\IMVU.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64b5721d]
C:\WINDOWS\system32\kdraqybt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 18:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-06-01 14:32 94208 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 20:12 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmona]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PATHPILOT]
--a------ 2008-01-23 11:47 270336 C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ResChanger 2005]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\Microsoft Games\\Halo Trial\\halo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-10 17:41]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-10 17:41]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-10 17:41]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-10 17:41]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 23:54]
S3 uisp;Motorola USB ICP driver;C:\WINDOWS\system32\Drivers\usbicp.sys []
*Newly Created Service* - CATCHME
*Newly Created Service* - SASDIFSV
.
Contents of the 'Scheduled Tasks' folder
"2007-06-05 23:53:45 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2008-05-14 01:08:37 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-05-13 21:13:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-13 21:14:06
ComboFix-quarantined-files.txt 2008-05-14 01:14:03
ComboFix2.txt 2008-05-14 01:11:15
ComboFix3.txt 2008-05-13 22:15:35
Pre-Run: 44,911,726,592 bytes free
Post-Run: 44,898,508,800 bytes free
280 --- E O F --- 2008-05-13 22:37:16
Logfile of HijackThis v1.99.1
Scan saved at 9:16:42 PM, on 5/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Darrell\Desktop\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.insightbb.com/~c.tilly/doj.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3C545916-1113-40F9-861C-196714D69486} - (no file) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - {4F4E0757-AC6E-49FF-B771-D71FD0CAD8EE} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {8044456F-58EF-43D7-8DC5-A2D6E9B173F2} - (no file) O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: (no name) - {A4017D9D-AD44-4EE2-8482-4A3682183F92} - (no file) O2 - BHO: (no name) - {C3A9074B-1E3C-45D6-9195-604CE2F1D5B8} - C:\WINDOWS\system32\urqOeDUK.dll O3 - Toolbar: (no name) - {59EC7E90-81DE-40EC-B1EB-93E3CA3AD395} - (no file) O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Darrell\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cabO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194130302156O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cabO16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll O20 - Winlogon Notify: urqOeDUK - C:\WINDOWS\SYSTEM32\urqOeDUK.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O21 - SSODL: mpfanvqg - {2D7BC40F-859F-4EDE-BB3D-0CFCC2E27EE2} - (no file) O21 - SSODL: vbksrofa - {470C143D-A894-4C91-ABA6-279703CD40F1} - (no file) O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Generated 05/13/2008 at 08:57 PM
Application Version : 4.0.1154
Core Rules Database Version : 3460
Trace Rules Database Version: 1451
Scan type : Complete Scan
Total Scan Time : 00:18:16
Memory items scanned : 448
Memory threats detected : 0
Registry items scanned : 5040
Registry threats detected : 0
File items scanned : 20323
File threats detected : 104
Adware.Tracking Cookie
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfkishc5wcq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wbkycmdzwkq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@www.findpsychic[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjliokdpmbp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6walyogcjgdo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkoohajoap.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjmygldjmbp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfmigmazclo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjliapdzcep.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkyepcpedo.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjk4ekczscp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@networkcommunications.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlyshczgep.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlouicpmkp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@www.apartmentfinder[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgkyuhajkgp.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wflooocjekp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfk4skdjgkp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgkighajecq.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlycidzigp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfmisnczwfp.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjliwmajglq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfk4wjdzigo.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6whkowhczshp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlyandpgfq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wflisodpeho.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlielc5ebq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgk4qmdjkho.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@counter.auctionworks[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkyshd5oaq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlokodzgdq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfkywgczwao.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfk4cidjgkp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfl4qmcjmhp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@cpocommerceinc.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@imrworldwide[2].txt
C:\Documents and Settings\Guest\Cookies\guest@teenadvice.about[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wakykkazclp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@www.xctrk[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wclyemd5adp.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@ad.adnetinteractive[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgmiajdpgeq.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgkoegdjiho.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@findpsychic[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkogpajahp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjliukcpcgp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@jivaxosahuy.tripod[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfliwpdzwko.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@ads.cartoonnetwork[2].txt
C:\Documents and Settings\Guest\Cookies\guest@www.dealtime[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wbkoujajklo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkoepdpsco.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@ehg-ltdcommodities.hitbox[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjnyejc5ghp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wflogjdzeeo.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjnyqlcjako.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgkoandjifp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjk4wodzkep.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjl4qocpwbo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjnyoldpmbo.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjk4kjdzibp.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlyqiczcho.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wckycod5acq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfkisld5clp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjmicicpaep.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlicicjkho.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjl4ojazofo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlikmajigo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlisiajcfo.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@ge.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6whmyslajkap.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjnyokc5cbp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgmyuhcjohp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@precisionclick[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjk4wmdpeao.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjloalc5sgq.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wgk4qjdzoeo.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wakyamajcbp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@www.googleadservices[6].txt
C:\Documents and Settings\Guest\Cookies\guest@www.googleadservices[5].txt
C:\Documents and Settings\Guest\Cookies\guest@www.googleadservices[3].txt
C:\Documents and Settings\Guest\Cookies\guest@www.googleadservices[2].txt
C:\Documents and Settings\Guest\Cookies\guest@www.googleadservices[1].txt
C:\Documents and Settings\Guest\Cookies\guest@ads.awesomehouseparty[1].txt
C:\Documents and Settings\Guest\Cookies\guest@meijer.122.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@server.iad.liveperson[1].txt
C:\Documents and Settings\Guest\Cookies\guest@ehg-wabiseek.hitbox[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkoskcpckp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wbloqiazagp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@server.iad.liveperson[3].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjl4wmazmcp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@paypal.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkygnazklp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjlykhc5klq.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@media1.break[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfl4giczafp.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wfk4smczkgo.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjnyqnajwfp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjk4knd5kgq.stats.esomniture[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjkyemd5gkp.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@ehg-newegg.hitbox[1].txt
C:\Documents and Settings\Guest\Cookies\guest@e-2dj6wjnyqmd5gco.stats.esomniture[2].txt
C:\Documents and Settings\Guest\Cookies\guest@rotator.dex.adjuggler[1].txt
Trojan.Unknown Origin
C:\WINDOWS\SYSTEM32\CTFMONB.BMP
| 
|