PCTech Forums

by **trifty** » Mon Dec 03, 2007 11:15 am

hi there .. erm .. ive been trying to find a solution but to no avail ....i usualy play CS on my pc .. sometimes an application errors comes out for svchost .. now sometimes when i play warcraft this error comes out "intruction at 0x500497d9 referenced memory at 0x1349e000 press ok to terminate the program or cancel to debug" i cant even play any games now .. i hav 1.4gb of ram .nvidia gforce5500 .. amd sempron 3000+ processor .. plz someone savE me !!!

by **Gecko** » Mon Dec 03, 2007 1:24 pm

Hello trifty, and welcome to our forums.

Lets see if we can get more information about your errors.

Go to Start > Control panel > Administrative tools > Event viewer > look in the system section.

You are looking for any red , double click on the icon.
Click inside the 'Description' section then highlight the text and copy and paste it into notepad.
At the bottom of the event window check 'words' and then copy and paste that text also
Then past it all into your reply to this thread.

If you don't show any errors in the event viewer then:
Go to Start > Control Panel > System > Advanced tab > Startup and Recovery section
Settings button > System Failure section > check the box 'Write an event to the system log'

by **trifty** » Tue Dec 04, 2007 12:29 am

okay .. ty gecko for replying .. erm there are many errors..these are the errors..there are many errors mostly called "schedule" and so i have posted some of it here ..

The At72.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At72.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At24.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At71.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At47.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At70.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
The At46.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At22.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The At69.job command failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The DNS Client service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The description for Event ID ( 6161 ) in Source ( Print ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Microsoft Word - Document1, Windows XP User, Canon iP1700, NT EMF 1.008, 131072, 22140, 3, 0, \\WINDOWS-ATMV7N8, 13 (0xd), .

The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The DNS Client service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

by **trifty** » Tue Dec 04, 2007 12:31 am

i do not understand what you mean by "check words" could please explain ? ty . =)

by **trifty** » Tue Dec 04, 2007 12:33 am

The device, \Device\CdRom1, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

An error was detected on device \Device\CdRom1 during a paging operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

by **Gecko** » Tue Dec 04, 2007 2:47 am

trifty,

You have a Trojan "DwnLdr-GXF" infection and most likely other spyware too.
I can help you clean your system of this trojan and the spyware.

Please download HijackThis http://downloads.malwareremoval.com/hijackthis.zip and save it to your desktop.

To extract HijackThis:

1. Right-click your file HijackThis.zip and from the menu select "Extract All".
2. The Extraction Wizard Window will appear, Click "Next".
3. Click Browse and navigate to "C:\" or the "C:\Program Files" and click "Create A New Folder" and call it "HJT" or "HijackThis" or whatever that is easy to remember and then click OK.
4. Click the Extract button.
5. Close the HijackThis.zip dialogue box.

Now double-click on hijackthis.exe and when the window opens, Press the Scan now and save a logfile button and then when it is done, copy and paste the contents of the notepad it opens as a reply to this post.

by **trifty** » Tue Dec 04, 2007 4:09 am

ok ty gecko =) i will try it now

by **trifty** » Tue Dec 04, 2007 4:11 am

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:10:03 AM, on 12/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\valve\steam\steam.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\AeriaGames\DOMO\_domopatch.exe
C:\Documents and Settings\Windows XP User\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/intl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 74.71.225.89:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 84.55.71.135 nprotect.battlelands.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\tmp3.tmp.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {c0ff4252-1b8e-43a0-b18c-da1f6b8623ac} - C:\WINDOWS\system32\mgm32r.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\en-us\msntb.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [msnsyslog] C:\WINDOWS\msnlogm.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\pmljhg.dll",forkonce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O15 - Trusted Zone: http://doa.cube-asia.com
O15 - Trusted Zone: http://www.doa.cube-asia.com
O16 - DPF: {20050325-D35A-4233-926E-2E801AE25949} (NMJPStarter15 Class) - http://www.netmarble.jp/_common/cab/NMStarterJP6.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-MY/a-U ... E_UNO1.cab
O16 - DPF: {6FC19219-C47E-4880-9A79-D218A1C374F9} (NMJTransX Control) - http://file.netmarble.jp/Control/NMJTransX.cab
O16 - DPF: {98164EE5-3C94-4844-841D-2B740D4EFB5E} - http://www.elecard.com/AXConverter/EOnl ... r_Demo.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedow ... in9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedow ... n10USA.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C80DF5D3-01DA-4D23-B570-524257FEBF62}: NameServer = 202.188.0.133,202.188.1.5
O20 - AppInit_DLLs:
O20 - Winlogon Notify: mgm32r - C:\WINDOWS\SYSTEM32\mgm32r.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

--
End of file - 9800 bytes

by **Gecko** » Tue Dec 04, 2007 1:40 pm

Hello trifty,

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

Please download to your desktop.

Double click combofix.exe and follow the prompts.
Combofix will take several minutes to run and your system will reboot to finish.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

by **trifty** » Wed Dec 05, 2007 2:21 am

ty gecko for replying again =D .. here is the log by combofix

ComboFix 07-12-02.7 - Windows XP User 2007-12-05 9:07:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.621 [GMT 8:00]
Running from: C:\Documents and Settings\Windows XP User\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\BHO
C:\Program Files\BHO\bho.dat
C:\Program Files\BHO\er.dat
C:\Program Files\internet explorer\iekey.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\ddabxx.dll
C:\WINDOWS\ghjlmp.ini
C:\WINDOWS\msnimport.exe
C:\WINDOWS\pmljhg.dll
C:\WINDOWS\system32\mgm32r.dll
C:\WINDOWS\system32\tmp1C.tmp.dll
C:\WINDOWS\system32\tmp26.tmp.dll
C:\WINDOWS\system32\tmp27.tmp.dll
C:\WINDOWS\system32\tmp2D.tmp.dll
C:\WINDOWS\system32\tmp2F.tmp.dll
C:\WINDOWS\system32\tmp49.tmp.dll
C:\WINDOWS\system32\tmp5.tmp.dll
C:\WINDOWS\system32\tmp5A.tmp.dll
C:\WINDOWS\system32\tmp9.tmp.dll
C:\WINDOWS\WebAssist.dll
C:\WINDOWS\xhelper.dll
C:\WINDOWS\xmlhelper.dll
C:\WINDOWS\xxbadd.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 )))))))))))))))))))))))))))))))
.

2007-12-04 12:33 . 2007-12-04 12:33 <DIR> d-------- C:\Documents and Settings\Windows XP User\debug
2007-12-04 12:19 . 2007-12-04 12:33 <DIR> d-------- C:\Program Files\Conquer 2.0
2007-12-03 17:49 . 2007-12-03 17:49 268 --ah----- C:\sqmdata08.sqm
2007-12-03 17:49 . 2007-12-03 17:49 244 --ah----- C:\sqmnoopt08.sqm
2007-12-02 18:21 . 2007-12-02 18:21 <DIR> d-------- C:\Program Files\ffdshow
2007-12-02 18:21 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-12-02 18:21 . 2007-11-28 23:38 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-12-02 18:21 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-12-01 16:04 . 2007-12-01 16:10 25,382,879 --a------ C:\smap.tmp1
2007-12-01 16:04 . 2007-12-01 16:10 14,729,183 --a------ C:\smsk.tmp1
2007-11-27 22:24 . 2007-11-27 22:24 <DIR> d-------- C:\Documents and Settings\Windows XP User\Application Data\Axara
2007-11-27 22:21 . 2007-11-27 22:21 <DIR> d-------- C:\Program Files\Common Files\Axara
2007-11-27 22:21 . 2003-05-21 23:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2007-11-27 22:21 . 2002-08-20 00:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-11-27 22:21 . 2003-05-21 23:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
2007-11-27 22:21 . 2003-05-21 23:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
2007-11-27 22:21 . 2007-05-07 11:30 73,728 --a------ C:\WINDOWS\system32\mslh264dsfilter.ax
2007-11-27 22:21 . 2003-05-21 23:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-27 22:20 . 2007-11-27 22:21 <DIR> d-------- C:\Program Files\Axara
2007-11-27 22:20 . 2004-02-04 21:11 81,920 --a------ C:\WINDOWS\system32\AC3ACM.acm
2007-11-27 22:20 . 2004-09-06 16:06 53,248 --a------ C:\WINDOWS\system32\xvid.ax
2007-11-27 22:20 . 2003-05-21 23:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
2007-11-27 22:20 . 2000-03-14 20:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
2007-11-26 17:45 . 2007-11-26 17:47 <DIR> d-------- C:\Program Files\Total Video Converter
2007-11-24 09:46 . 2007-11-24 09:51 <DIR> d-------- C:\My Music
2007-11-23 12:15 . 2007-11-23 12:15 <DIR> d-------- C:\Documents and Settings\Windows XP User\dwhelper
2007-11-23 12:03 . 2007-11-23 12:05 <DIR> d-------- C:\Documents and Settings\Windows XP User\Application Data\Orbit
2007-11-19 18:59 . 2007-11-19 18:59 <DIR> d-------- C:\Program Files\MAIET
2007-11-16 10:38 . 2007-12-01 11:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-16 10:38 . 2007-11-16 10:38 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-16 07:55 . 2007-11-16 07:55 <DIR> d-------- C:\Program Files\NHN USA
2007-11-16 07:55 . 2007-09-27 12:08 692,224 --a------ C:\WINDOWS\system32\ijjiSetup.exe
2007-11-16 07:55 . 2007-06-21 18:59 58,776 --a------ C:\WINDOWS\system32\ijjiPlugin2.dll
2007-11-14 18:45 . 2007-11-14 18:45 <DIR> d-------- C:\ijji
2007-11-14 18:45 . 2007-11-16 15:55 <DIR> d--h----- C:\Documents and Settings\Windows XP User\Application Data\ijjigame
2007-11-14 09:08 . 2007-11-14 09:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\IJJIGame
2007-11-13 20:35 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-11-13 20:35 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-11-13 20:35 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-11-13 20:35 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-11-13 20:35 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-11-13 20:35 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-11-13 20:35 . 2007-05-31 19:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-11-13 20:35 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-11-13 20:35 . 2007-05-31 19:29 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-11-12 14:40 . 2007-11-12 14:47 <DIR> d-------- C:\Program Files\Axialis
2007-11-11 22:19 . 2007-11-13 20:11 319 --a------ C:\WINDOWS\game.ini
2007-11-11 21:52 . 2007-11-11 21:52 <DIR> d-------- C:\Program Files\Activision
2007-11-08 18:00 . 2007-12-03 23:05 <DIR> d-------- C:\OutputFolder
2007-11-06 17:51 . 2007-11-06 20:10 <DIR> d-------- C:\Documents and Settings\Windows XP User\Application Data\Uniblue
2007-11-05 11:06 . 2007-11-05 11:06 268 --ah----- C:\sqmdata07.sqm
2007-11-05 11:06 . 2007-11-05 11:06 244 --ah----- C:\sqmnoopt07.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 04:45 --------- d-----w C:\Program Files\FlashGet
2007-12-04 04:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-03 00:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Firefly Studios
2007-11-30 00:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2007-11-27 04:08 --------- d-----w C:\Program Files\Allok Video to 3GP Converter
2007-11-21 01:40 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\AVG7
2007-11-11 14:20 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 10:21 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\Moyea
2007-11-06 10:17 --------- d-----w C:\Program Files\Moyea
2007-10-27 10:59 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\dvdcss
2007-10-27 10:22 --------- d-----w C:\Program Files\CyberLink
2007-10-20 02:43 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\Eltima Software
2007-10-13 09:54 --------- d-----w C:\Program Files\Universal Shield 4.1
2007-10-08 01:45 --------- d-----w C:\Program Files\LimeWire
2007-10-01 00:07 729,088 ----a-w C:\WINDOWS\iun6002.exe
2007-04-07 23:40 604 -c-ha-w C:\Program Files\STLL Notifier
2006-10-31 00:22 81,920 -c--a-w C:\Documents and Settings\Windows XP User\Application Data\ezpinst.exe
2006-10-31 00:22 47,360 -c--a-w C:\Documents and Settings\Windows XP User\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c--a-w 81,920 2005-08-11 07:30:30 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

-c--a-w 249,856 2005-08-11 07:30:30 C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe

-c--a-w 59,040 2006-04-13 05:20:52 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe

-c--a-w 406,016 2007-02-04 02:14:01 C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe

-c--a-w 503,808 2004-06-27 07:38:58 C:\Program Files\Multimedia Combo Set\bak\MouseDrv.exe

-c--a-w 233,472 2005-08-02 14:50:00 C:\Program Files\Multimedia Combo Set\bak\PS2USBKbdDrv.exe

-c--a-w 282,624 2007-02-16 02:54:04 C:\Program Files\QuickTime\bak\qttask.exe

-c--a-w 100,056 2006-08-10 11:41:19 C:\Program Files\SymNetDrv\bak\SNDMon.exe

-c--a-w 15,360 2004-08-03 16:56:50 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-03 16:56:50 C:\WINDOWS\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:56]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-07-23 20:13]
"Steam"="c:\valve\steam\steam.exe" [2007-11-30 07:54]
"ares"="C:\Program Files\Ares\Ares.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-26 09:41]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-10-05 22:11]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-26 09:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Windows XP User^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Windows XP User\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 00:56 15360 --a------ C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
C:\Program Files\DAP\DAP.EXE /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
C:\Program Files\ICQLite\ICQLite.exe -minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMprocess]
C:\Program Files\Instant Messenger Names\IM-svr.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InfoData]
rundll32.exe C:\WINDOWS\iihebc.dll,realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark_X79-55]
C:\WINDOWS\system32\lsasss.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnsyslog]
C:\WINDOWS\msnlogm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 --a--c--- C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-10-12 03:10 49263 --a--c--- C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WireLessKeyboard ]
C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WireLessMouse ]
C:\Program Files\Multimedia Combo Set\MouseDrv.exe

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
S3 cusbohcn;cusbohcn;\??\C:\DOCUME~1\WINDOW~1\LOCALS~1\Temp\cusbohcn.sys
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys
S3 npkycryp;npkycryp;\??\C:\Program Files\Gravity\RO\npkycryp.sys
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
S3 XDva008;XDva008;\??\C:\WINDOWS\system32\XDva008.sys
S3 XDva012;XDva012;\??\C:\WINDOWS\system32\XDva012.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e569a90-3a9e-11dc-b6c6-001349aa913f}]
\Shell\Auto\command - MicrosoftPowerPoint.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e900224c-5b9c-11db-b44e-0013d3a269e6}]
\Shell\AutoRun\command - ie.exe
\Shell\explore\Command - ie.exe
\Shell\open\Command - ie.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-02 23:41:36 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-02 16:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 01:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 02:00:00 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 03:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 04:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 05:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-02 06:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-02 07:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-02 08:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-02 09:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 10:00:00 C:\WINDOWS\Tasks\At19.job"
"2007-11-24 17:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 11:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 12:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 13:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 14:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 15:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-02 16:00:00 C:\WINDOWS\Tasks\At25.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-24 17:00:00 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 18:00:00 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 19:00:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 20:00:00 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 18:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-11-12 21:00:00 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 22:00:00 C:\WINDOWS\Tasks\At31.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 23:00:00 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 00:00:00 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 01:00:00 C:\WINDOWS\Tasks\At34.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 02:00:00 C:\WINDOWS\Tasks\At35.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 03:00:00 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 04:00:00 C:\WINDOWS\Tasks\At37.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 05:00:00 C:\WINDOWS\Tasks\At38.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-02 06:00:00 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-11-12 19:00:00 C:\WINDOWS\Tasks\At4.job"
"2007-12-02 07:00:00 C:\WINDOWS\Tasks\At40.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-02 08:00:00 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-02 09:00:00 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 10:00:00 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 11:00:00 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 12:00:00 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 13:00:00 C:\WINDOWS\Tasks\At46.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 14:00:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-04 15:00:00 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\system32\FXR6xXAv.exe
"2007-12-02 16:00:00 C:\WINDOWS\Tasks\At49.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 20:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-11-24 17:00:00 C:\WINDOWS\Tasks\At50.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 18:00:00 C:\WINDOWS\Tasks\At51.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 19:00:00 C:\WINDOWS\Tasks\At52.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 20:00:00 C:\WINDOWS\Tasks\At53.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 21:00:00 C:\WINDOWS\Tasks\At54.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 22:00:00 C:\WINDOWS\Tasks\At55.job"
"2007-11-12 23:00:00 C:\WINDOWS\Tasks\At56.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 00:00:00 C:\WINDOWS\Tasks\At57.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 01:00:00 C:\WINDOWS\Tasks\At58.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 02:00:00 C:\WINDOWS\Tasks\At59.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 21:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 03:00:00 C:\WINDOWS\Tasks\At60.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 04:00:00 C:\WINDOWS\Tasks\At61.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 05:00:00 C:\WINDOWS\Tasks\At62.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-02 06:00:00 C:\WINDOWS\Tasks\At63.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-02 07:00:00 C:\WINDOWS\Tasks\At64.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-02 08:00:00 C:\WINDOWS\Tasks\At65.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-02 09:00:00 C:\WINDOWS\Tasks\At66.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 10:00:00 C:\WINDOWS\Tasks\At67.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 11:00:00 C:\WINDOWS\Tasks\At68.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 12:00:00 C:\WINDOWS\Tasks\At69.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-11-12 22:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-04 13:00:00 C:\WINDOWS\Tasks\At70.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 14:00:00 C:\WINDOWS\Tasks\At71.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-04 15:00:00 C:\WINDOWS\Tasks\At72.job"
- C:\WINDOWS\system32\w0w1l4eV.exe
"2007-12-02 16:01:51 C:\WINDOWS\Tasks\At73.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-24 17:03:00 C:\WINDOWS\Tasks\At74.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-12 18:03:00 C:\WINDOWS\Tasks\At75.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-12 19:03:00 C:\WINDOWS\Tasks\At76.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-12 20:03:00 C:\WINDOWS\Tasks\At77.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-12 21:03:00 C:\WINDOWS\Tasks\At78.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-12 22:03:00 C:\WINDOWS\Tasks\At79.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-11-12 23:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-11-12 23:03:00 C:\WINDOWS\Tasks\At80.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 00:01:49 C:\WINDOWS\Tasks\At81.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 01:03:00 C:\WINDOWS\Tasks\At82.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 02:03:00 C:\WINDOWS\Tasks\At83.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 03:02:26 C:\WINDOWS\Tasks\At84.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 04:03:00 C:\WINDOWS\Tasks\At85.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 05:03:00 C:\WINDOWS\Tasks\At86.job"

s
!×.
\- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-02 06:01:00 C:\WINDOWS\Tasks\At87.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-02 07:01:02 C:\WINDOWS\Tasks\At88.job"
"2007-12-02 08:01:00 C:\WINDOWS\Tasks\At89.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 00:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\Ve87JMY4.exe
"2007-12-02 09:01:00 C:\WINDOWS\Tasks\At90.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 10:01:50 C:\WINDOWS\Tasks\At91.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 11:01:00 C:\WINDOWS\Tasks\At92.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 12:01:00 C:\WINDOWS\Tasks\At93.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 13:01:47 C:\WINDOWS\Tasks\At94.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 14:01:00 C:\WINDOWS\Tasks\At95.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-04 15:01:00 C:\WINDOWS\Tasks\At96.job"
- C:\WINDOWS\system32\t3YgDTwF.exe
"2007-12-05 01:18:08 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-26 09:51:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-11-06 09:51:19 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 09:15:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-05 9:19:59 - machine was rebooted
.
--- E O F ---

by **Gecko** » Wed Dec 05, 2007 1:07 pm

by **trifty** » Thu Dec 06, 2007 12:45 am

COMBOFIX LOG

ComboFix 07-12-02.7 - Windows XP User 2007-12-06 7:30:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.646 [GMT 8:00]
Running from: C:\Documents and Settings\Windows XP User\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Windows XP User\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\iihebc.dll
C:\WINDOWS\system32\FXR6xXAv.exe
C:\WINDOWS\system32\ijjiPlugin2.dll
C:\WINDOWS\system32\ijjiSetup.exe
C:\WINDOWS\system32\t3YgDTwF.exe
C:\WINDOWS\system32\Ve87JMY4.exe
C:\WINDOWS\system32\w0w1l4eV.exe
C:\WINDOWS\Tasks\At1.job"
C:\WINDOWS\Tasks\At10.job"
C:\WINDOWS\Tasks\At11.job"
C:\WINDOWS\Tasks\At12.job"
C:\WINDOWS\Tasks\At13.job"
C:\WINDOWS\Tasks\At14.job"
C:\WINDOWS\Tasks\At15.job"
C:\WINDOWS\Tasks\At16.job"
C:\WINDOWS\Tasks\At17.job"
C:\WINDOWS\Tasks\At18.job"
C:\WINDOWS\Tasks\At19.job"
C:\WINDOWS\Tasks\At2.job"
C:\WINDOWS\Tasks\At20.job"
C:\WINDOWS\Tasks\At21.job"
C:\WINDOWS\Tasks\At22.job"
C:\WINDOWS\Tasks\At23.job"
C:\WINDOWS\Tasks\At24.job"
C:\WINDOWS\Tasks\At25.job"
C:\WINDOWS\Tasks\At26.job"
C:\WINDOWS\Tasks\At27.job"
C:\WINDOWS\Tasks\At28.job"
C:\WINDOWS\Tasks\At29.job"
C:\WINDOWS\Tasks\At3.job"
C:\WINDOWS\Tasks\At30.job"
C:\WINDOWS\Tasks\At31.job"
C:\WINDOWS\Tasks\At32.job"
C:\WINDOWS\Tasks\At33.job"
C:\WINDOWS\Tasks\At34.job"
C:\WINDOWS\Tasks\At35.job"
C:\WINDOWS\Tasks\At36.job"
C:\WINDOWS\Tasks\At37.job"
C:\WINDOWS\Tasks\At38.job"
C:\WINDOWS\Tasks\At39.job"
C:\WINDOWS\Tasks\At4.job"
C:\WINDOWS\Tasks\At40.job"
C:\WINDOWS\Tasks\At41.job"
C:\WINDOWS\Tasks\At42.job"
C:\WINDOWS\Tasks\At43.job"
C:\WINDOWS\Tasks\At44.job"
C:\WINDOWS\Tasks\At45.job"
C:\WINDOWS\Tasks\At46.job"
C:\WINDOWS\Tasks\At47.job"
C:\WINDOWS\Tasks\At48.job"
C:\WINDOWS\Tasks\At49.job"
C:\WINDOWS\Tasks\At5.job"
C:\WINDOWS\Tasks\At50.job"
C:\WINDOWS\Tasks\At51.job"
C:\WINDOWS\Tasks\At52.job"
C:\WINDOWS\Tasks\At53.job"
C:\WINDOWS\Tasks\At54.job"
C:\WINDOWS\Tasks\At55.job"
C:\WINDOWS\Tasks\At56.job"
C:\WINDOWS\Tasks\At57.job"
C:\WINDOWS\Tasks\At58.job"
C:\WINDOWS\Tasks\At59.job"
C:\WINDOWS\Tasks\At6.job"
C:\WINDOWS\Tasks\At60.job"
C:\WINDOWS\Tasks\At61.job"
C:\WINDOWS\Tasks\At62.job"
C:\WINDOWS\Tasks\At63.job"
C:\WINDOWS\Tasks\At64.job"
C:\WINDOWS\Tasks\At65.job"
C:\WINDOWS\Tasks\At66.job"
C:\WINDOWS\Tasks\At67.job"
C:\WINDOWS\Tasks\At68.job"
C:\WINDOWS\Tasks\At69.job"
C:\WINDOWS\Tasks\At7.job"
C:\WINDOWS\Tasks\At70.job"
C:\WINDOWS\Tasks\At71.job"
C:\WINDOWS\Tasks\At72.job"
C:\WINDOWS\Tasks\At73.job"
C:\WINDOWS\Tasks\At74.job"
C:\WINDOWS\Tasks\At75.job"
C:\WINDOWS\Tasks\At76.job"
C:\WINDOWS\Tasks\At77.job"
C:\WINDOWS\Tasks\At78.job"
C:\WINDOWS\Tasks\At79.job"
C:\WINDOWS\Tasks\At8.job"
C:\WINDOWS\Tasks\At80.job"
C:\WINDOWS\Tasks\At81.job"
C:\WINDOWS\Tasks\At82.job"
C:\WINDOWS\Tasks\At83.job"
C:\WINDOWS\Tasks\At84.job"
C:\WINDOWS\Tasks\At85.job"
C:\WINDOWS\Tasks\At86.job"
C:\WINDOWS\Tasks\At87.job"
C:\WINDOWS\Tasks\At88.job"
C:\WINDOWS\Tasks\At89.job"
C:\WINDOWS\Tasks\At9.job"
C:\WINDOWS\Tasks\At90.job"
C:\WINDOWS\Tasks\At91.job"
C:\WINDOWS\Tasks\At92.job"
C:\WINDOWS\Tasks\At93.job"
C:\WINDOWS\Tasks\At94.job"
C:\WINDOWS\Tasks\At95.job"
C:\WINDOWS\Tasks\At96.job"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ijji
C:\ijji\ENGLISH\binkw32.dll
C:\ijji\ENGLISH\dbghelp.dll
C:\ijji\ENGLISH\gdiplus.dll.zip
C:\ijji\ENGLISH\Gunz\BAReport.exe
C:\ijji\ENGLISH\Gunz\config.xml
C:\ijji\ENGLISH\Gunz\dbghelp.dll
C:\ijji\ENGLISH\Gunz\fmod.dll
C:\ijji\ENGLISH\Gunz\GameGuard.des
C:\ijji\ENGLISH\Gunz\GameGuard\category.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\daily.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\GameGuard.des
C:\ijji\ENGLISH\Gunz\GameGuard\GameGuard.ver
C:\ijji\ENGLISH\Gunz\GameGuard\GameMon.des
C:\ijji\ENGLISH\Gunz\GameGuard\ggscan.des
C:\ijji\ENGLISH\Gunz\GameGuard\GunzUS.ini
C:\ijji\ENGLISH\Gunz\GameGuard\npgg.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npgg9x.des
C:\ijji\ENGLISH\Gunz\GameGuard\npggNT.des
C:\ijji\ENGLISH\Gunz\GameGuard\npgl.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npgm.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npgmup.des
C:\ijji\ENGLISH\Gunz\GameGuard\npgmup.des.new
C:\ijji\ENGLISH\Gunz\GameGuard\npgmup.erl
C:\ijji\ENGLISH\Gunz\GameGuard\npsc.des
C:\ijji\ENGLISH\Gunz\GameGuard\npsc.erl
C:\ijji\ENGLISH\Gunz\GameGuard\Splash.jpg
C:\ijji\ENGLISH\Gunz\GameGuard\teas.dll
C:\ijji\ENGLISH\Gunz\GameGuard\teas.tls
C:\ijji\ENGLISH\Gunz\GameGuard\teasbase.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\teasname.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\TeCtrl.dll
C:\ijji\ENGLISH\Gunz\GameGuard\TyAv32.dll
C:\ijji\ENGLISH\Gunz\GameGuard\tyavd.tsf
C:\ijji\ENGLISH\Gunz\GameGuard\tyavn.tsf
C:\ijji\ENGLISH\Gunz\gdiplus.dll
C:\ijji\ENGLISH\Gunz\Gunz.dmp
C:\ijji\ENGLISH\Gunz\Gunz.exe
C:\ijji\ENGLISH\Gunz\GunzLauncher.exe
C:\ijji\ENGLISH\Gunz\GunzUS.ini
C:\ijji\ENGLISH\Gunz\HanAuthForClient.dll
C:\ijji\ENGLISH\Gunz\HanPollForClient.dll
C:\ijji\ENGLISH\Gunz\HanReportForClient.dll
C:\ijji\ENGLISH\Gunz\Interface\default.mrs
C:\ijji\ENGLISH\Gunz\Interface\loadable.mrs
C:\ijji\ENGLISH\Gunz\Interface\Login.mrs
C:\ijji\ENGLISH\Gunz\Interface\MonsterIllust.mrs
C:\ijji\ENGLISH\Gunz\lastchar.dat
C:\ijji\ENGLISH\Gunz\Maps\Battle Arena.mrs
C:\ijji\ENGLISH\Gunz\Maps\Castle.mrs
C:\ijji\ENGLISH\Gunz\Maps\Catacomb.mrs
C:\ijji\ENGLISH\Gunz\Maps\Dungeon.mrs
C:\ijji\ENGLISH\Gunz\Maps\Factory.mrs
C:\ijji\ENGLISH\Gunz\Maps\Garden.mrs
C:\ijji\ENGLISH\Gunz\Maps\Hall.mrs
C:\ijji\ENGLISH\Gunz\Maps\Island.mrs
C:\ijji\ENGLISH\Gunz\Maps\Jail.mrs
C:\ijji\ENGLISH\Gunz\Maps\Lost Shrine.mrs
C:\ijji\ENGLISH\Gunz\Maps\mansion.mrs
C:\ijji\ENGLISH\Gunz\Maps\Port.mrs
C:\ijji\ENGLISH\Gunz\Maps\prison II.mrs
C:\ijji\ENGLISH\Gunz\Maps\prison.mrs
C:\ijji\ENGLISH\Gunz\Maps\Ruin.mrs
C:\ijji\ENGLISH\Gunz\Maps\Shower Room.mrs
C:\ijji\ENGLISH\Gunz\Maps\Snow_Town.mrs
C:\ijji\ENGLISH\Gunz\Maps\Stairway.mrs
C:\ijji\ENGLISH\Gunz\Maps\station.mrs
C:\ijji\ENGLISH\Gunz\Maps\Town.mrs
C:\ijji\ENGLISH\Gunz\mlog.txt
C:\ijji\ENGLISH\Gunz\model.mrs
C:\ijji\ENGLISH\Gunz\Model\man.mrs
C:\ijji\ENGLISH\Gunz\Model\NPC\goblin.mrs
C:\ijji\ENGLISH\Gunz\Model\NPC\Palmpoa.mrs
C:\ijji\ENGLISH\Gunz\Model\NPC\Skeleton.mrs
C:\ijji\ENGLISH\Gunz\Model\woman.mrs
C:\ijji\ENGLISH\Gunz\msvcp71.dll
C:\ijji\ENGLISH\Gunz\msvcr71.dll
C:\ijji\ENGLISH\Gunz\patch.xml
C:\ijji\ENGLISH\Gunz\patchlog.txt
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_cavern1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_cavern2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_cavern3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_nest1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_nest2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_nest3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_passage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_passage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Dungeon_passage3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_hall1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_hall2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_hall3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_passage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_passage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_passage3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_room1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_room2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Mansion_room3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_drainage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_drainage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_hall1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_hall2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_passage1.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_passage2.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_passage3.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_prison.mrs
C:\ijji\ENGLISH\Gunz\Quest\Maps\Prison_shower_room.mrs
C:\ijji\ENGLISH\Gunz\sfx.mrs
C:\ijji\ENGLISH\Gunz\Shader\patchlog.txt
C:\ijji\ENGLISH\Gunz\Shader\skin.vso
C:\ijji\ENGLISH\Gunz\Shader\skin1.vso
C:\ijji\ENGLISH\Gunz\Sound\bgm.mrs
C:\ijji\ENGLISH\Gunz\Sound\effect.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\fx2.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\nar.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\goblin.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\golem.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\lizard.mrs
C:\ijji\ENGLISH\Gunz\Sound\Effect\quest\skeleton.mrs
C:\ijji\ENGLISH\Gunz\system.mrs
C:\ijji\ENGLISH\Gunz\Uninstall.exe
C:\ijji\ENGLISH\Gunz\Update1.mrs
C:\ijji\ENGLISH\Gunz\Update2.mrs
C:\ijji\ENGLISH\Gunz\Update3.mrs
C:\ijji\ENGLISH\HanAuthForClient.dll
C:\ijji\ENGLISH\HanReportForClient.dll
C:\ijji\ENGLISH\HanUninstall.ini
C:\ijji\ENGLISH\HgAniGm3.dll
C:\ijji\ENGLISH\HgAniGm3_16Bit.dll
C:\ijji\ENGLISH\HgAvatar2006.dll
C:\ijji\ENGLISH\HgBoard3.dll
C:\ijji\ENGLISH\HgSoundOut.exe
C:\ijji\ENGLISH\IjjiGamePluginRemoveTool.exe
C:\ijji\ENGLISH\ijjiLauncher_PostPluginDll_01.dll
C:\ijji\ENGLISH\ijjiLauncher_PrePluginDll_01.dll
C:\ijji\ENGLISH\ijjiUninstall.exe
C:\ijji\ENGLISH\ijl15.dll
C:\ijji\ENGLISH\nb_option.dat
C:\ijji\ENGLISH\NeoBit.dll
C:\ijji\ENGLISH\PiXel.dll
C:\ijji\ENGLISH\SwitcheRooUS.ini
C:\ijji\ENGLISH\u_goonzu.exe
C:\ijji\ENGLISH\u_sf.exe
C:\ijji\ENGLISH\u_sf\data\area\area_001.sff
C:\ijji\ENGLISH\u_sf\data\area\area_002.sff
C:\ijji\ENGLISH\u_sf\data\area\area_003.sff
C:\ijji\ENGLISH\u_sf\data\area\area_005.sff
C:\ijji\ENGLISH\u_sf\data\area\area_006.sff
C:\ijji\ENGLISH\u_sf\data\area\area_007.sff
C:\ijji\ENGLISH\u_sf\data\area\Area_010.sff
C:\ijji\ENGLISH\u_sf\data\clan\clanmark_bg.dfz
C:\ijji\ENGLISH\u_sf\data\clan\clanmark_frame.dfz
C:\ijji\ENGLISH\u_sf\data\clan\clanmark_symbol.dfz
C:\ijji\ENGLISH\u_sf\data\clan\clanmark1.dfz
C:\ijji\ENGLISH\u_sf\data\clan\clanmark2.dfz
C:\ijji\ENGLISH\u_sf\data\clan\clanmark3.dfz
C:\ijji\ENGLISH\u_sf\data\config_new.cfg
C:\ijji\ENGLISH\u_sf\data\default.cfg
C:\ijji\ENGLISH\u_sf\data\effect\effect_001.sff
C:\ijji\ENGLISH\u_sf\data\force\force_001.sff
C:\ijji\ENGLISH\u_sf\data\force\force_002.sff
C:\ijji\ENGLISH\u_sf\data\force\force_003.sff
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData1.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData10.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData11.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData12.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData13.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData14.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData15.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData16.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData17.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData18.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData19.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData2.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData20.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData21.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData22.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData23.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData24.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData25.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData26.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData27.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData3.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData4.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData5.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData6.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData7.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData8.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\LobbyData9.mrg
C:\ijji\ENGLISH\u_sf\data\lobby\macro.txt
C:\ijji\ENGLISH\u_sf\data\lobby\Notice.txt
C:\ijji\ENGLISH\u_sf\data\lobby\PatchLog.log
C:\ijji\ENGLISH\u_sf\data\lobby\pure.drk
C:\ijji\ENGLISH\u_sf\data\lobby\SF_Curse.drk
C:\ijji\ENGLISH\u_sf\data\menu\menu_001.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_002.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_003.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_004.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_005.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_006.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_007.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_008.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_009.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_011.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_012.sff
C:\ijji\ENGLISH\u_sf\data\menu\menu_013.sff
C:\ijji\ENGLISH\u_sf\data\menu\Menu_014.sff
C:\ijji\ENGLISH\u_sf\data\menu\Menu_015.sff
C:\ijji\ENGLISH\u_sf\data\save\SaveReadme.txt
C:\ijji\ENGLISH\u_sf\data\scr\scr_001.sff
C:\ijji\ENGLISH\u_sf\data\screenshot\2007November16083046.bmp
C:\ijji\ENGLISH\u_sf\data\screenshot\2007November17111639.bmp
C:\ijji\ENGLISH\u_sf\data\screenshot\2007November17164722.bmp
C:\ijji\ENGLISH\u_sf\data\screenshot\2007November17164821.bmp
C:\ijji\ENGLISH\u_sf\data\screenshot\2007November17170056.bmp
C:\ijji\ENGLISH\u_sf\data\screenshot\2007November19150121.bmp
C:\ijji\ENGLISH\u_sf\data\screenshot\ShotReadme.txt
C:\ijji\ENGLISH\u_sf\data\sound\sound_001.sff
C:\ijji\ENGLISH\u_sf\data\sound\sound_002.sff
C:\ijji\ENGLISH\u_sf\data\sound\sound_003.sff
C:\ijji\ENGLISH\u_sf\data\sound\sound_004.sff
C:\ijji\ENGLISH\u_sf\data\sound\sound_005.sff
C:\ijji\ENGLISH\u_sf\data\sound\sound_006.sff
C:\ijji\ENGLISH\u_sf\data\sound\sound_007.sff
C:\ijji\ENGLISH\u_sf\data\sound\Sound_008.sff
C:\ijji\ENGLISH\u_sf\data\weapon\weapon_001.sff
C:\ijji\ENGLISH\u_sf\data\weapon\weapon_002.sff
C:\ijji\ENGLISH\u_sf\dbghelp.dll
C:\ijji\ENGLISH\u_sf\enet.dll
C:\ijji\ENGLISH\u_sf\GameGuard.des
C:\ijji\ENGLISH\u_sf\GameGuard\GameGuard.ver
C:\ijji\ENGLISH\u_sf\GameGuard\GameMon.des
C:\ijji\ENGLISH\u_sf\GameGuard\ggscan.des
C:\ijji\ENGLISH\u_sf\GameGuard\npgg.erl
C:\ijji\ENGLISH\u_sf\GameGuard\npgg9x.des
C:\ijji\ENGLISH\u_sf\GameGuard\npggNT.des
C:\ijji\ENGLISH\u_sf\GameGuard\npgl.erl
C:\ijji\ENGLISH\u_sf\GameGuard\npgl1.erl
C:\ijji\ENGLISH\u_sf\GameGuard\npgm.erl
C:\ijji\ENGLISH\u_sf\GameGuard\npgmup.des
C:\ijji\ENGLISH\u_sf\GameGuard\npgmup.des.new
C:\ijji\ENGLISH\u_sf\GameGuard\npgmup.erl
C:\ijji\ENGLISH\u_sf\GameGuard\npsc.des
C:\ijji\ENGLISH\u_sf\GameGuard\npsc.erl
C:\ijji\ENGLISH\u_sf\GameGuard\SpecialForceUS.ini
C:\ijji\ENGLISH\u_sf\GameGuard\Splash.jpg
C:\ijji\ENGLISH\u_sf\HanAuthForClient.dll
C:\ijji\ENGLISH\u_sf\HanReportForClient.dll
C:\ijji\ENGLISH\u_sf\HyperPeer.dll
C:\ijji\ENGLISH\u_sf\mss32.dll
C:\ijji\ENGLISH\u_sf\msvcp60.dll
C:\ijji\ENGLISH\u_sf\msvcp71.dll
C:\ijji\ENGLISH\u_sf\msvcp71d.dll
C:\ijji\ENGLISH\u_sf\msvcr71.dll
C:\ijji\ENGLISH\u_sf\msvcr71d.dll
C:\ijji\ENGLISH\u_sf\MSVCRTD.DLL
C:\ijji\ENGLISH\u_sf\quietus.dll
C:\ijji\ENGLISH\u_sf\quietusVS.ini
C:\ijji\ENGLISH\u_sf\redist\mssa3d.m3d
C:\ijji\ENGLISH\u_sf\redist\mssds3d.m3d
C:\ijji\ENGLISH\u_sf\redist\mssdsp.flt
C:\ijji\ENGLISH\u_sf\redist\mssdx7.m3d
C:\ijji\ENGLISH\u_sf\redist\msseax.m3d
C:\ijji\ENGLISH\u_sf\redist\mssmp3.asi
C:\ijji\ENGLISH\u_sf\redist\mssrsx.m3d
C:\ijji\ENGLISH\u_sf\redist\msssoft.m3d
C:\ijji\ENGLISH\u_sf\redist\mssvoice.asi
C:\ijji\ENGLISH\u_sf\SF.ico
C:\ijji\ENGLISH\u_sf\soldierfront.exe
C:\ijji\ENGLISH\u_sf\SpecialForceUS.ini
C:\ijji\ENGLISH\urlhgb3.cfg
C:\ijji\ENGLISH\urlhgc3.cfg
C:\ijji\ENGLISH\USAAniChannelWnd.dll
C:\ijji\ENGLISH\UsaBase.dll
C:\ijji\ENGLISH\USABASE.hvr
C:\ijji\ENGLISH\UsaBaseExt.dll
C:\ijji\ENGLISH\XDebug.dll
C:\ijji\ENGLISH\XFire\xfire_installer_24715.soldierfront.exe
C:\ijji\ENGLISH\XInNetwork.dll
C:\ijji\ENGLISH\XPlatform.dll
C:\ijji\ENGLISH\XStream.dll
C:\ijji\ENGLISH\XSystem.dll
C:\WINDOWS\system32\ijjiPlugin2.dll
C:\WINDOWS\system32\ijjiSetup.exe
C:\WINDOWS\system32\t3YgDTwF.exe
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At75.job
C:\WINDOWS\Tasks\At76.job
C:\WINDOWS\Tasks\At77.job
C:\WINDOWS\Tasks\At78.job
C:\WINDOWS\Tasks\At79.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At80.job
C:\WINDOWS\Tasks\At81.job
C:\WINDOWS\Tasks\At82.job
C:\WINDOWS\Tasks\At83.job
C:\WINDOWS\Tasks\At84.job
C:\WINDOWS\Tasks\At85.job
C:\WINDOWS\Tasks\At86.job
C:\WINDOWS\Tasks\At87.job
C:\WINDOWS\Tasks\At88.job
C:\WINDOWS\Tasks\At89.job
C:\WINDOWS\Tasks\At9.job
C:\WINDOWS\Tasks\At90.job
C:\WINDOWS\Tasks\At91.job
C:\WINDOWS\Tasks\At92.job
C:\WINDOWS\Tasks\At93.job
C:\WINDOWS\Tasks\At94.job
C:\WINDOWS\Tasks\At95.job
C:\WINDOWS\Tasks\At96.job

.
((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 )))))))))))))))))))))))))))))))
.

2007-12-05 15:34 . 2007-12-05 16:50 2,048,623 --a------ C:\smsk.tmp0
2007-12-05 14:07 . 2007-12-05 16:50 3,527,279 --a------ C:\smap.tmp0
2007-12-04 12:33 . 2007-12-04 12:33 <DIR> d-------- C:\Documents and Settings\Windows XP User\debug
2007-12-04 12:19 . 2007-12-05 21:45 <DIR> d-------- C:\Program Files\Conquer 2.0
2007-12-03 17:49 . 2007-12-03 17:49 268 --ah----- C:\sqmdata08.sqm
2007-12-03 17:49 . 2007-12-03 17:49 244 --ah----- C:\sqmnoopt08.sqm
2007-12-02 18:21 . 2007-12-02 18:21 <DIR> d-------- C:\Program Files\ffdshow
2007-12-02 18:21 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-12-02 18:21 . 2007-11-28 23:38 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-12-02 18:21 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-12-01 16:04 . 2007-12-01 16:10 25,382,879 --a------ C:\smap.tmp1
2007-12-01 16:04 . 2007-12-01 16:10 14,729,183 --a------ C:\smsk.tmp1
2007-11-27 22:24 . 2007-11-27 22:24 <DIR> d-------- C:\Documents and Settings\Windows XP User\Application Data\Axara
2007-11-27 22:21 . 2007-11-27 22:21 <DIR> d-------- C:\Program Files\Common Files\Axara
2007-11-27 22:21 . 2003-05-21 23:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2007-11-27 22:21 . 2002-08-20 00:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-11-27 22:21 . 2003-05-21 23:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
2007-11-27 22:21 . 2003-05-21 23:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
2007-11-27 22:21 . 2007-05-07 11:30 73,728 --a------ C:\WINDOWS\system32\mslh264dsfilter.ax
2007-11-27 22:21 . 2003-05-21 23:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-27 22:20 . 2007-11-27 22:21 <DIR> d-------- C:\Program Files\Axara
2007-11-27 22:20 . 2004-02-04 21:11 81,920 --a------ C:\WINDOWS\system32\AC3ACM.acm
2007-11-27 22:20 . 2004-09-06 16:06 53,248 --a------ C:\WINDOWS\system32\xvid.ax
2007-11-27 22:20 . 2003-05-21 23:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
2007-11-27 22:20 . 2000-03-14 20:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
2007-11-26 17:45 . 2007-11-26 17:47 <DIR> d-------- C:\Program Files\Total Video Converter
2007-11-24 09:46 . 2007-11-24 09:51 <DIR> d-------- C:\My Music
2007-11-23 12:15 . 2007-11-23 12:15 <DIR> d-------- C:\Documents and Settings\Windows XP User\dwhelper
2007-11-23 12:03 . 2007-11-23 12:05 <DIR> d-------- C:\Documents and Settings\Windows XP User\Application Data\Orbit
2007-11-19 18:59 . 2007-11-19 18:59 <DIR> d-------- C:\Program Files\MAIET
2007-11-16 10:38 . 2007-12-01 11:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-16 10:38 . 2007-11-16 10:38 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-16 07:55 . 2007-11-16 07:55 <DIR> d-------- C:\Program Files\NHN USA
2007-11-14 18:45 . 2007-11-16 15:55 <DIR> d--h----- C:\Documents and Settings\Windows XP User\Application Data\ijjigame
2007-11-14 09:08 . 2007-11-14 09:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\IJJIGame
2007-11-13 20:35 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-11-13 20:35 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-11-13 20:35 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-11-13 20:35 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-11-13 20:35 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-11-13 20:35 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-11-13 20:35 . 2007-05-31 19:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-11-13 20:35 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-11-13 20:35 . 2007-05-31 19:29 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-11-12 14:40 . 2007-11-12 14:47 <DIR> d-------- C:\Program Files\Axialis
2007-11-11 22:19 . 2007-11-13 20:11 319 --a------ C:\WINDOWS\game.ini
2007-11-11 21:52 . 2007-11-11 21:52 <DIR> d-------- C:\Program Files\Activision
2007-11-08 18:00 . 2007-12-03 23:05 <DIR> d-------- C:\OutputFolder
2007-11-06 17:51 . 2007-11-06 20:10 <DIR> d-------- C:\Documents and Settings\Windows XP User\Application Data\Uniblue
2007-11-05 11:06 . 2007-11-05 11:06 268 --ah----- C:\sqmdata07.sqm
2007-11-05 11:06 . 2007-11-05 11:06 244 --ah----- C:\sqmnoopt07.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 04:18 --------- d-----w C:\Program Files\FlashGet
2007-12-04 04:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-03 00:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Firefly Studios
2007-11-30 00:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2007-11-27 04:08 --------- d-----w C:\Program Files\Allok Video to 3GP Converter
2007-11-21 01:40 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\AVG7
2007-11-11 14:20 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 10:21 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\Moyea
2007-11-06 10:17 --------- d-----w C:\Program Files\Moyea
2007-10-27 10:59 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\dvdcss
2007-10-27 10:22 --------- d-----w C:\Program Files\CyberLink
2007-10-20 02:43 --------- d-----w C:\Documents and Settings\Windows XP User\Application Data\Eltima Software
2007-10-13 09:54 --------- d-----w C:\Program Files\Universal Shield 4.1
2007-10-08 01:45 --------- d-----w C:\Program Files\LimeWire
2007-10-01 00:07 729,088 ----a-w C:\WINDOWS\iun6002.exe
2007-04-07 23:40 604 -c-ha-w C:\Program Files\STLL Notifier
2006-10-31 00:22 81,920 -c--a-w C:\Documents and Settings\Windows XP User\Application Data\ezpinst.exe
2006-10-31 00:22 47,360 -c--a-w C:\Documents and Settings\Windows XP User\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c--a-w 81,920 2005-08-11 07:30:30 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe

-c--a-w 249,856 2005-08-11 07:30:30 C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe

-c--a-w 59,040 2006-04-13 05:20:52 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe

-c--a-w 406,016 2007-02-04 02:14:01 C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe

-c--a-w 503,808 2004-06-27 07:38:58 C:\Program Files\Multimedia Combo Set\bak\MouseDrv.exe

-c--a-w 233,472 2005-08-02 14:50:00 C:\Program Files\Multimedia Combo Set\bak\PS2USBKbdDrv.exe

-c--a-w 282,624 2007-02-16 02:54:04 C:\Program Files\QuickTime\bak\qttask.exe

-c--a-w 100,056 2006-08-10 11:41:19 C:\Program Files\SymNetDrv\bak\SNDMon.exe

-c--a-w 15,360 2004-08-03 16:56:50 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-03 16:56:50 C:\WINDOWS\system32\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:56]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-07-23 20:13]
"Steam"="c:\valve\steam\steam.exe" [2007-11-30 07:54]
"ares"="C:\Program Files\Ares\Ares.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-26 09:41]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-10-05 22:11]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-26 09:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Windows XP User^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Windows XP User\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioDeck]
C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 00:56 15360 --a------ C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
C:\Program Files\DAP\DAP.EXE /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
C:\Program Files\ICQLite\ICQLite.exe -minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMprocess]
C:\Program Files\Instant Messenger Names\IM-svr.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InfoData]
rundll32.exe C:\WINDOWS\iihebc.dll,realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark_X79-55]
C:\WINDOWS\system32\lsasss.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnsyslog]
C:\WINDOWS\msnlogm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 11:50 155648 --a--c--- C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-10-12 03:10 49263 --a--c--- C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WireLessKeyboard ]
C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WireLessMouse ]
C:\Program Files\Multimedia Combo Set\MouseDrv.exe

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
S3 cusbohcn;cusbohcn;\??\C:\DOCUME~1\WINDOW~1\LOCALS~1\Temp\cusbohcn.sys
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys
S3 npkycryp;npkycryp;\??\C:\Program Files\Gravity\RO\npkycryp.sys
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
S3 XDva008;XDva008;\??\C:\WINDOWS\system32\XDva008.sys
S3 XDva012;XDva012;\??\C:\WINDOWS\system32\XDva012.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e569a90-3a9e-11dc-b6c6-001349aa913f}]
\Shell\Auto\command - MicrosoftPowerPoint.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e900224c-5b9c-11db-b44e-0013d3a269e6}]
\Shell\AutoRun\command - ie.exe
\Shell\explore\Command - ie.exe
\Shell\open\Command - ie.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-02 23:41:36 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-05 23:40:49 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-26 09:51:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-11-06 09:51:19 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 07:38:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-06 7:42:21 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-05 09:19
.
--- E O F ---

by **trifty** » Thu Dec 06, 2007 12:46 am

HIJACK THIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:06 AM, on 12/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\valve\steam\steam.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Windows XP User\Local Settings\Temp\wz2ba1\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 74.71.225.89:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\en-us\msntb.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O15 - Trusted Zone: http://doa.cube-asia.com
O15 - Trusted Zone: http://www.doa.cube-asia.com
O16 - DPF: {20050325-D35A-4233-926E-2E801AE25949} (NMJPStarter15 Class) - http://www.netmarble.jp/_common/cab/NMStarterJP6.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-MY/a-U ... E_UNO1.cab
O16 - DPF: {6FC19219-C47E-4880-9A79-D218A1C374F9} (NMJTransX Control) - http://file.netmarble.jp/Control/NMJTransX.cab
O16 - DPF: {98164EE5-3C94-4844-841D-2B740D4EFB5E} - http://www.elecard.com/AXConverter/EOnl ... r_Demo.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedow ... in9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedow ... n10USA.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C80DF5D3-01DA-4D23-B570-524257FEBF62}: NameServer = 202.188.0.133,202.188.1.5
O20 - AppInit_DLLs:
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

--
End of file - 9188 bytes

by **Gecko** » Thu Dec 06, 2007 12:59 pm

trifty,

Combofix really cleaned out a lot this time good job!

You currently are running HijackThis from here: C:\Documents and Settings\Windows XP User\Local Settings\Temp\wz2ba1\HijackThis.exe

Please make a folder here: c:\HJT and place HijackThis.exe in that folder.

DO NOT follow the steps below until you have moved HijackThis

Start HijackThis and click "Do a system scan only" put a check next to each of the following entries:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 74.71.225.89:80
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\en-us\msntb.dll (file missing)
O20 - AppInit_DLLs:

Now click the "Fixed checked" button and then close HijackThis

Restart your computer and post a new HiJackThis log when you reply.

by **trifty** » Thu Dec 06, 2007 1:18 pm

ya i realised that gecko =) the svchost error is not coming up .. from today i wont be on the net for 2 days okay im going camp =)this is the log file for hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:17:05 PM, on 12/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\valve\steam\steam.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O15 - Trusted Zone: http://doa.cube-asia.com
O15 - Trusted Zone: http://www.doa.cube-asia.com
O16 - DPF: {20050325-D35A-4233-926E-2E801AE25949} (NMJPStarter15 Class) - http://www.netmarble.jp/_common/cab/NMStarterJP6.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-MY/a-U ... E_UNO1.cab
O16 - DPF: {6FC19219-C47E-4880-9A79-D218A1C374F9} (NMJTransX Control) - http://file.netmarble.jp/Control/NMJTransX.cab
O16 - DPF: {98164EE5-3C94-4844-841D-2B740D4EFB5E} - http://www.elecard.com/AXConverter/EOnl ... r_Demo.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedow ... in9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedow ... n10USA.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C80DF5D3-01DA-4D23-B570-524257FEBF62}: NameServer = 202.188.0.133,202.188.1.5
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

--
End of file - 8831 bytes

PCTech Forums

MEMORY COULD NOT BE READ

MEMORY COULD NOT BE READ

MEMORY COULD NOT BE READ

Who is online