‎Trojan vundo | DELL Technologies

Start a discussion

UNSOLVED

littlejd23

updated

19 years ago

littlejd23

56 Posts

2419

November 28th, 2007 00:00

Trojan vundo

I think I may have somehow contracted the Trojan vundo virus or possible outerinfo....please help!!

Here is my HiJackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:44:28 PM, on 11/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\mrofinu572.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Insider\Insider.exe
C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\msconfig.exe
C:\Program Files\?ppPatch\n?pdb.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\system32\PdeSrv2.exe
C:\WINDOWS\explorer.exe
C:\HJT\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Uaol] "C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\msconfig.exe" -vt yazb
O4 - HKCU\..\Run: [Eqszcur] "C:\Program Files\?ppPatch\n?pdb.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 9646 bytes

B
Bugbatter
4 Apprentice
•
20487 Posts
443
0
Posted November 28th, 2007 01:00
Welcome. Thank you for using Dell Community Forums.
I am reviewing your log.
In the meantime, you can help me by doing the following:

* Have you have posted this log on another forum? If so, please provide a link to the topic.

* If you are using any cracked software, please remove it.
Definition of cracked software:
http://en.wikipedia.org/wiki/Software_cracking

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log. Please do not do anything else until you get further instructions.

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
Please follow all instructions in sequence, and do not run any fixes or scanners on your own because this may cause conflicts with the tools that I am using.

* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.

* * Please disable realtime monitoring, except for your anti-virus, so it does not interfere while we are fixing your system. Refer to this page for information on disabling any realtime monitoring before we start working on a fix for your problem. That would be your SpywareDoctor and any other realtime monitoring of anti-spyware programs.

Disable Realtime Monitoring

I look forward to your reply.

Message Edited by Bugbatter on 11-27-2007 10:04 PM
L
littlejd23
56 Posts
443
0
Posted November 28th, 2007 22:00
Ok so I've done as you asked and removed any PSP programs and stopped spywaredoctor from running and I ran HiJackThis again...let me know if I did everything right......computer is running really slow so it took a ridiculously long time to get that done. Here ya go...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:51:34 PM, on 11/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Insider\Insider.exe
C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\msconfig.exe
C:\Program Files\?ppPatch\n?pdb.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\system32\PdeSrv2.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\mrofinu.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\HJT\HiJackThis.exe
C:\PROGRA~1\MUSICM~1\Common\COMPON~1\MMCOMP~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C88332017491394661A64DB7C8F0287E55E246220D9E728F9FC17D446BC57D5375FB0FB68AD6
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Insider] C:\Program Files\Insider\Insider.exe
O4 - HKCU\..\Run: [Uaol] "C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\msconfig.exe" -vt yazb
O4 - HKCU\..\Run: [Eqszcur] "C:\Program Files\?ppPatch\n?pdb.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 9669 bytes
B
Bugbatter
4 Apprentice
•
20487 Posts
443
0
Posted November 28th, 2007 23:00
You still have Spyware Doctor in your Running Processes.
To disable Spyware Doctor from running on your system startup:
1. First, disable the OnGuard Tools. This way, when you exit Spyware Doctor, these tools won't stay resident in the background.
2. Click the "Settings" button on the left side.
3. Click the "Startup Settings" link.
4. Uncheck "Run at Windows Startup".
5. Click the "Apply" button.
Exit by a right-click on the "Spyware Doctor" icon in the system tray and choose "Exit".
[To enable Spyware Doctor when you are finished, open the program, Settings>Startup Settings> CHECK "Run at Windows Startup">APPLY
Exit. Reboot.]

To disable PCTools Browser Monitor: If you are running Internet Explorer, click Tools > Manage Add-ons. If PCTools Browser Monitor is on the list, click it & select Disable. You will need to restart your browser after making the change.

Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.

An icon will be created on your desktop. Double-click that icon to launch the program.

If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)

Under "Configuration and Preferences", click the Preferences button.

Click the Scanning Control tab.

Under Scanner Options make sure the following are checked (leave all others unchecked):

Close browsers before scanning.

Scan for tracking cookies.

Terminate memory threats before quarantining.

Click the "Close" button to leave the control center screen.

Back on the main screen, under "Scan for Harmful Software" click Scan your computer.

On the left, make sure you check C:\Fixed Drive.

On the right, under "Complete Scan", choose Perform Complete Scan.

Click "Next" to start the scan. Please be patient while it scans your computer.

After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".

Make sure everything has a checkmark next to it and click "Next".

A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.

If asked if you want to reboot, click "Yes".

To retrieve the removal information after reboot, launch SUPERAntispyware again.

Click Preferences, then click the Statistics/Logs tab.

Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.

Please copy and paste the Scan Log results in your next reply with all other requested logs.

Click Close to exit the program.

1. Please download Combofix from here:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the link is case sensitive
Save ComboFix to the desktop. **Note: It is important that it is saved directly to, and run from your desktop**

In the event you already have Combofix, please delete it as this is a new version.
* Close any open browsers. Disconnect from the internet.
* Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

2. Double click ComboFix.exe and follow the prompts.
You will temporarily lose the Desktop while the scan is running. Once the scan is done your Desktop will return to normal.

3. When finished, it will produce a log for you. Post that log in your next reply along with a fresh HijackThis log and the log from Super AntiSpyware.

Notes:
* Do not mouseclick ComboFix's window while it's running. That may cause it to stall.
* ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
* Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open task-manager > use the processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

* Don't forget to enable your anti-virus before coming back online to post your logs.

The above instructions have been created specifically for this user. If you are not this user, do NOT follow these directions.
L
littlejd23
56 Posts
691
0
Posted November 30th, 2007 00:00

C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.domainsuite[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.sextasya[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adultfriendfinder[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@tour.jugfuers[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@pornsickle[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@worldsexmate[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.myyearbook[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.levelclick[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@primeclickz[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@its-sexy-time[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@angleinteractive.directtrack[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@momspornvideo[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.planetofsex[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[13].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads3.blastro[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[27].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@videoegg.adbureau[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads2.k8l[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@url[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[31].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@main[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@go[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@protect.spyguardpro[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@lynxtrack[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@upspiral[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@revenuesense[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adserver.easyad[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.teenycinema[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ad.contentmedianetwork[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@date.ventivmedia[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjlycgc5ihp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@clicksor[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@mediatraffic[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@67.15.239[3].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ad.outerinfoads[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@toseeka[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads4.think-adz[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adultobserver[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.associatedcontent[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@directtrack[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@counter.surfcounters[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@indiads[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@1071661528[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@banner[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@trafficmp[2].txt
C:\Documents and Settings\LocalService\Cookies\system@login.tracking101[2].txt

Adware.180solutions/ZangoSearch
HKCR\AppId\{D28CD14C-50BE-4CFA-951E-B37F25DA3472}

Adware.ClickSpring/Outer Info Network
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#Publisher
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#HelpLink
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#InstallLocation
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#NoModify
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#NoRepair
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#DisplayVersion
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#DisplayIcon
C:\Program Files\Outerinfo\FF\chrome.manifest
C:\Program Files\Outerinfo\FF\components\FF.dll
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\Outerinfo\FF\components
C:\Program Files\Outerinfo\FF\install.rdf
C:\Program Files\Outerinfo\FF
C:\Program Files\Outerinfo\Terms.rtf
C:\Program Files\Outerinfo
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo

Adware.Web Buying
HKU\.DEFAULT\Software\WebBuying
HKU\S-1-5-21-945656231-3985598331-1503749785-1005\Software\WebBuying
HKU\S-1-5-18\Software\WebBuying

Trojan.Downloader-Gen/RetAd
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#runner1 [ C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C88332017491394661A64DB7C8F0287E55E246220D9E728F9FC17D446BC57D5375FB0FB68AD6 ]

Adware.E404 Helper/Hij
C:\Program Files\E404 Helper\e404.v1.dll
C:\Program Files\E404 Helper

Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DOCUMENTS AND SETTINGS\JENNIFER DORSETT\LOCAL SETTINGS\TEMP\WINVSNET.EXE

Adware.ClickSpring/Yazzle
C:\PROGRAM FILES\COMMON FILES\YAZZLE1281OINADMIN.EXE
C:\PROGRAM FILES\COMMON FILES\YAZZLE1281OINUNINSTALLER.EXE
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1549OINADMIN.EXE.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1549OINUNINSTALLER.EXE.VIR

Adware.k8l
C:\PROGRAM FILES\MOVIE MAKER\PROFSYFSYWUEWU.HTML

Malware.Installer-Pkg/Gen
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{26D2C2C3-CF14-4ED7-B1FC-0BE64AFBA3B3}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{6B6A7665-DB48-4762-AB5D-BEEB9E1CD7FA}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{C2D8F0E2-6978-4409-8351-BA8785DA11EE}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{D1A6F3FD-7B40-443F-8767-BADB25A0D222}.EXE

Malware.Ultimate Defender
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\UCLEANER_SETUP.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP254\A0109340.EXE

Adware.WebBuying Assistant-Installer
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WEB BUYING\V1.8.5\WBUNINST.EXE.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP247\A0108020.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP248\A0108096.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP254\A0109332.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP265\A0114947.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP269\A0115947.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP269\A0115948.EXE
C:\WINDOWS\WBUN.EXE
L
littlejd23
56 Posts
443
0
Posted November 30th, 2007 00:00
New HiJackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:30:42 PM, on 11/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PdeSrv2.exe
C:\HJT\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: 0 - {7D9E16DC-C193-43D1-3B8A-E4AAE9EB31CF} - C:\Program Files\Movie Maker\lavuqadux.dll (file missing)
O2 - BHO: {b7144c5b-8948-4159-1504-14f5bbea9ce7} - {7ec9aebb-5f41-4051-9514-8498b5c4417b} - C:\WINDOWS\system32\teycspjk.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\mamvfxqa.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\mamvfxqa.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [8c679427] rundll32.exe "C:\WINDOWS\system32\fvkcmdlw.dll",b
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Eqszcur] "C:\Program Files\?ppPatch\n?pdb.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: mamvfxqa - C:\WINDOWS\SYSTEM32\mamvfxqa.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 10089 bytes
L
littlejd23
56 Posts
443
0
Posted November 30th, 2007 00:00

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/29/2007 at 00:20 AM

Application Version : 3.9.1008

Core Rules Database Version : 3352
Trace Rules Database Version: 1351

Scan type       : Complete Scan
Total Scan Time : 03:02:06

Memory items scanned      : 617
Memory threats detected   : 5
Registry items scanned    : 5924
Registry threats detected : 65
File items scanned        : 57664
File threats detected     : 352

Adware.Vundo-Variant/Small
C:\WINDOWS\SYSTEM32\YAYYVUT.DLL
C:\WINDOWS\SYSTEM32\YAYYVUT.DLL
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\yayyvut
C:\WINDOWS\SYSTEM32\GEBXVST.DLL
C:\WINDOWS\SYSTEM32\JKKKJKI.DLL

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\MLJJJ.DLL
C:\WINDOWS\SYSTEM32\MLJJJ.DLL
HKLM\Software\Classes\CLSID\{941B8942-33D7-4D2A-8FFA-0892A968AC9C}
HKCR\CLSID\{941B8942-33D7-4D2A-8FFA-0892A968AC9C}
HKCR\CLSID\{941B8942-33D7-4D2A-8FFA-0892A968AC9C}\InprocServer32
HKCR\CLSID\{941B8942-33D7-4D2A-8FFA-0892A968AC9C}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{941B8942-33D7-4D2A-8FFA-0892A968AC9C}

Trojan.Downloader-Gen/Insider
C:\PROGRAM FILES\INSIDER\INSIDER.EXE
C:\PROGRAM FILES\INSIDER\INSIDER.EXE
[Insider] C:\PROGRAM FILES\INSIDER\INSIDER.EXE

Adware.ClickSpring-Variant
C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\MSCONFIG.EXE
C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\MSCONFIG.EXE
[Uaol] C:\DOCUME~1\JENNIF~1\APPLIC~1\CROSOF~1.NET\MSCONFIG.EXE
C:\DOCUMENTS AND SETTINGS\JENNIFER DORSETT\APPLICATION DATA\CROSOF~1.NET\MSCONFIG.EXE

Adware.ClickSpring/Resident
C:\PROGRA~1\PPPATC~1\NPDB~1.EXE
C:\PROGRA~1\PPPATC~1\NPDB~1.EXE

Trojan.Downloader-Gen/MROFIN
[runner1] C:\WINDOWS\MROFINU572.EXE
C:\WINDOWS\MROFINU572.EXE

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}
HKCR\CLSID\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}
HKCR\CLSID\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}\InprocServer32
HKCR\CLSID\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}
HKCR\CLSID\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}

MyWay Search Assistant Computers
HKLM\Software\Classes\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32
HKCR\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32#ThreadingModel
HKCR\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\Programmable
C:\PROGRAM FILES\MYWAYSA\SRCHASDE\DESRCAS.DLL
HKLM\Software\Classes\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32#ThreadingModel
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\Programmable
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks#{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKU\S-1-5-21-945656231-3985598331-1503749785-1005\Software\Microsoft\Internet Explorer\URLSearchHooks#{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks#{4D25F926-B9FE-4682-BF72-8AB8210D6D75}

Unclassified.Unknown Origin
HKLM\Software\Classes\CLSID\{901568F2-88E0-43EE-A8E8-C911272D7362}
HKCR\CLSID\{901568F2-88E0-43EE-A8E8-C911272D7362}
HKCR\CLSID\{901568F2-88E0-43EE-A8E8-C911272D7362}
HKCR\CLSID\{901568F2-88E0-43EE-A8E8-C911272D7362}\InProcServer32
HKCR\CLSID\{901568F2-88E0-43EE-A8E8-C911272D7362}\InProcServer32#ThreadingModel
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\HOKEWOC4444.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{901568F2-88E0-43EE-A8E8-C911272D7362}
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\HOKEWOC555077.DLL
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\HOKEWOC83122.DLL
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\WINDOWS MEDIA PLAYER\HOKEWOC4444.DLL.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP248\A0108133.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP255\A0111416.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP265\A0114973.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP269\A0115946.DLL
L
littlejd23
56 Posts
691
0
Posted November 30th, 2007 00:00
Trace.Known Threat Sources
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\41M3WPYV\index3i1[1].htm
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\41M3WPYV\718f466754402ac597de014577627f96[1].zip
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\E7TQIKFM\scan.bar[1].gif
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\MFWROV8R\mrofinu[1].zip
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\OPEFC9YZ\4e51764f761ae09c14e873232d26919b[1].zip
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\OPEFC9YZ\8154ff2675af1b6e0677560871425153[1].zip
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\8DURK9UN\ack[1].htm
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\8DURK9UN\solution.2[1].gif
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\0PELSHID\c1f5cc94a30f082054f3a00e6655462d[1].zip
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\MFWROV8R\ack[1].htm
C:\Documents and Settings\Jennifer Dorsett\Local Settings\Temporary Internet Files\Content.IE5\E7TQIKFM\f4d28682d186cc6beb75f106d133f489[1].zip
L
littlejd23
56 Posts
443
0
Posted November 30th, 2007 00:00
ComboFix log:

ComboFix 07-11-08.1 - Jennifer Dorsett 2007-11-07 22:46:23.1 - NTFSx86
Running from: C:\Documents and Settings\Jennifer Dorsett\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jennifer Dorsett\Application Data\WinTouch
C:\Documents and Settings\Jennifer Dorsett\My Documents\FNTS~1
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Startup\TA_Start.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Startup\think-adz.lnk
C:\Program Files\3269.exe
C:\Program Files\asembl~1
C:\Program Files\Common Files\Yazzle1549OinAdmin.exe
C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\Movie Maker\lavuqadux.dll
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\ucleaner_setup.exe
C:\Program Files\Ultimate Cleaner
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.5\wbuninst.exe
C:\Program Files\web buying\v1.8.5\webbuying.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\avp.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\Casino.ico
C:\WINDOWS\Free Online Dating.ico
C:\WINDOWS\mgrs.exe
C:\WINDOWS\Spyware Remover.ico
C:\WINDOWS\system32\a13
C:\WINDOWS\system32\a13\rarndrll2.exe
C:\WINDOWS\system32\awvtt.dll
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\dwdsrngt.exe
C:\WINDOWS\system32\e2
C:\WINDOWS\system32\e2\caws83122.exe
C:\WINDOWS\system32\g1
C:\WINDOWS\system32\hphlfgm.dll
C:\WINDOWS\system32\i8
C:\WINDOWS\system32\i8\taldrvr11.exe
C:\WINDOWS\system32\ldcore.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\nnnlifd.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\ttvwa.bak2
C:\WINDOWS\system32\ttvwa.ini
C:\WINDOWS\system32\winbue32.dll
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\x22
C:\WINDOWS\system32\x22\wr31drs.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\TTC-4444.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CORE
-------\LEGACY_NETWORK_MONITOR
-------\core

(((((((((((((((((((((((((   Files Created from 2007-10-08 to 2007-11-08 )))))))))))))))))))))))))))))))
.

2007-11-07 22:36 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-07 19:57 d-------- C:\HJT
2007-11-07 19:40 79,936 --a------ C:\WINDOWS\system32\lkqmboan.dll
2007-11-07 18:53 79,936 --a------ C:\WINDOWS\system32\cguuunme.dll
2007-11-04 13:33 78,912 --a------ C:\WINDOWS\system32\xbrwguqh.dll
2007-11-01 18:03 d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
2007-11-01 17:33 d-------- C:\Program Files\E404 Helper
2007-11-01 17:32 9,728 --a------ C:\Program Files\hlpsrv.exe
2007-10-31 19:16 d-------- C:\WINDOWS\system32\Mz02r
2007-10-31 19:16 35,840 --a------ C:\WINDOWS\mrofinu1000106.exe
2007-10-31 19:16 34,816 --a------ C:\WINDOWS\system32\xxyawwt.dll
2007-10-31 19:15 d--hs---- C:\WINDOWS\SmVubmlmZXIgRG9yc2V0dA
2007-10-31 19:14 d-------- C:\WINDOWS\system32\Mz08r
2007-10-31 19:14 d-------- C:\Temp\mZOr
2007-10-31 19:14 d-------- C:\Temp
2007-10-28 18:25 d-------- C:\Documents and Settings\Jennifer Dorsett\Application Data\Move Networks
2007-10-27 15:08 d-------- C:\Program Files\MSECache
2007-10-09 17:20 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 03:00 --------- d-----w C:\Program Files\Plaxo
2007-11-04 17:30 --------- d-----w C:\Program Files\dslifestyle
2007-11-02 03:07 --------- d-----w C:\Program Files\Sonic
2007-11-01 00:14 166,945 ----a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2007-11-01 00:14 166,945 ----a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2007-09-04 22:21 53,248 -c--a-w C:\WINDOWS\PalmDevC.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61CDE83F-9B84-45AC-B43E-325EECC186AF}]
2007-08-02 08:43 282624 --a------ C:\Program Files\Windows Media Player\hokewoc4444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c5a5a0b4-e778-4b33-8331-5b47101a7e28}]
2007-11-07 19:40 79936 --a------ C:\WINDOWS\system32\lkqmboan.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 17:33]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-07-20 00:09]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-07-20 00:06]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-07-20 00:10]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 18:48]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 18:24]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-11-23 00:21]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-08 20:20]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 20:20]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2005-08-30 17:30]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2005-08-31 12:06]
"HostManager"="C:\Program Files\Common Files\AOL\1135517850\ee\AOLSoftware.exe" [2006-09-25 19:52]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 07:50]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 17:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 18:05]
"{79-94-48-88-ZN}"="c:\windows\system32\kodsrngr.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2005-08-15 20:38]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"PlaxoUpdate"="C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe" [2006-11-16 11:42]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-12-13 15:13]
"AIM"="C:\Program Files\AIM\aim.exe" [2005-06-02 01:34]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-11-23 00:18:29]
dlbcserv.lnk - C:\Program Files\Dell Photo Printer 720\dlbcserv.exe [2006-05-23 20:39:39]
HotSync Manager.lnk - C:\Program Files\Palm\Hotsync.exe [2004-06-09 13:27:34]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 12:59:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvtt.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-08-11 20:21:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-07 23:14:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-07 23:19:05 - machine was rebooted
.
--- E O F ---
L
littlejd23
56 Posts
691
0
Posted November 30th, 2007 00:00

C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.domainsuite[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.sextasya[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adultfriendfinder[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@tour.jugfuers[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@pornsickle[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@worldsexmate[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.myyearbook[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.levelclick[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@primeclickz[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@its-sexy-time[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@angleinteractive.directtrack[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@momspornvideo[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.planetofsex[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[13].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads3.blastro[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[27].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@videoegg.adbureau[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads2.k8l[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@url[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[31].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@main[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@go[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@protect.spyguardpro[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@lynxtrack[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@upspiral[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@revenuesense[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adserver.easyad[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.teenycinema[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ad.contentmedianetwork[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@date.ventivmedia[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjlycgc5ihp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@clicksor[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@mediatraffic[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@67.15.239[3].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ad.outerinfoads[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@toseeka[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads4.think-adz[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adultobserver[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.associatedcontent[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@directtrack[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@counter.surfcounters[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@indiads[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@1071661528[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@banner[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@trafficmp[2].txt
C:\Documents and Settings\LocalService\Cookies\system@login.tracking101[2].txt

Adware.180solutions/ZangoSearch
HKCR\AppId\{D28CD14C-50BE-4CFA-951E-B37F25DA3472}

Adware.ClickSpring/Outer Info Network
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#Publisher
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#HelpLink
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#InstallLocation
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#NoModify
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#NoRepair
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#DisplayVersion
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo#DisplayIcon
C:\Program Files\Outerinfo\FF\chrome.manifest
C:\Program Files\Outerinfo\FF\components\FF.dll
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\Outerinfo\FF\components
C:\Program Files\Outerinfo\FF\install.rdf
C:\Program Files\Outerinfo\FF
C:\Program Files\Outerinfo\Terms.rtf
C:\Program Files\Outerinfo
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\Jennifer Dorsett\Start Menu\Programs\Outerinfo

Adware.Web Buying
HKU\.DEFAULT\Software\WebBuying
HKU\S-1-5-21-945656231-3985598331-1503749785-1005\Software\WebBuying
HKU\S-1-5-18\Software\WebBuying

Trojan.Downloader-Gen/RetAd
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#runner1 [ C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C88332017491394661A64DB7C8F0287E55E246220D9E728F9FC17D446BC57D5375FB0FB68AD6 ]

Adware.E404 Helper/Hij
C:\Program Files\E404 Helper\e404.v1.dll
C:\Program Files\E404 Helper

Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DOCUMENTS AND SETTINGS\JENNIFER DORSETT\LOCAL SETTINGS\TEMP\WINVSNET.EXE

Adware.ClickSpring/Yazzle
C:\PROGRAM FILES\COMMON FILES\YAZZLE1281OINADMIN.EXE
C:\PROGRAM FILES\COMMON FILES\YAZZLE1281OINUNINSTALLER.EXE
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1549OINADMIN.EXE.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\YAZZLE1549OINUNINSTALLER.EXE.VIR
L
littlejd23
56 Posts
443
0
Posted November 30th, 2007 00:00

C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.nexxx[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.ticketsnow2[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.cnn[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@st[11].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.gimmesex[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@revsci[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@s[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ad[3].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.notbadsex[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@cgi-bin[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@mass.advertarium.com[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@hurricanedigitalmedia[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@click.nichepromotion[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.monster[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@click.porngurus[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@regalinteractive[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.glispa[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.clickmanage[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.dafreexxxmovies[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@getMessage[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wflyqid5chp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@seventeen[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wfkokoc5igq.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@partner2profit[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@media.hotels[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@host-d.oddcast[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.scat-toplist[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@m1.webstats4u[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adopt.specificclick[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adultadworld[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@toplist[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjnyojczkcq.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.xxxvogue[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@pooltracker[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@creview.adbureau[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@tase[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjnygidzggp.stats.esomniture[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@statsgold[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adserver[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@mb[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.realtechnetwork[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.comprabanner[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjlyqhcjkep.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.allaboutvision[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.tripod.lycos.co[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adv.webmd[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@qnsr[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.expedia[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.incentaclick[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjliajdpkbp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@webstats.cincinnatibell[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@clickbank[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@icc.intellisrv[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@roiservice[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjnygidjkbp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@vhost.oddcast[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ukps[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjkoulcjggp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.xctrk[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@jugfuers[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjliuoazmkp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@tracking.foxnews[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@devart.adbureau[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adinterax[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjnyoldpmbo.stats.esomniture[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@partypoker[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@rotator.adjuggler[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@184906[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@kanoodle[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.cocoaporn[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@yfdmedia[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.as4x.tmcs.ticketmaster[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@webtracking.touchclarity[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@99505684[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.admedia365[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@8220461[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@hornypharaoh[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.pubmatic[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wgmisnd5aap.stats.esomniture[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@ads.ihispano[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@cracksmokingshirts[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@e-2dj6wjlocpdzabp.stats.esomniture[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@www.xxxthumbs4free[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@cpvfeed[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@popularscreensavers[2].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@adultrated[1].txt
C:\Documents and Settings\Jennifer Dorsett\Cookies\jennifer dorsett@easy-hit-counters[1].txt

Trojan vundo

Dell Support Resources

Latest Solutions

Clarity on possible scam of free computers paying shipping only

I need QHD display full panel for Dell latitude e7470

Optiplex 790 Dead after Processor Upgrade

gem authorization desktop and laptop

sample post