Google searches redirect to ad websites[Re-Opened]

Help

Members

Calendar

Live Chat

Welcome Guest ( Log In | Register )

Atribune.org > Malware Removal and Internet Browser Support > HijackThis and Malware Removal

Google searches redirect to ad websites[Re-Opened], Re-opened + Merged ~Extremeboy

Options

Rorschach112 View Member Profile	May 10 2010, 11:14 AM Post #2
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	Please run the MGA Diagnostic Tool and post back the report it shall produce: Download MGADiag to your desktop. Double-click on MGADiag.exe to launch the program Click "Continue" Ensure that the "Windows" tab is selected (it should be by default). Click the "Copy" button to copy the MGA Diagnostic Report to the Windows clipboard. Paste the MGA Diagnostic Report back here in your next reply. Make sure to use Internet Explorer for this Please go to VirSCAN.org FREE on-line scan service Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page: C:\WINDOWS\system32\rdpdd.cpo Click on the Upload button If a pop-up appears saying the file has been scanned already, please select the ReScan button. Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard. Paste the contents of the Clipboard in your next reply. Run OTL Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTL O33 - MountPoints2\{71ef8876-23e8-11df-9865-0050da29b0ad}\Shell\AutoRun\command - "" = J:\slacker.synclauncher.exe -- File not found O33 - MountPoints2\{71ef8876-23e8-11df-9865-0050da29b0ad}\Shell\slacker\command - "" = J:\slacker.synclauncher.exe -- File not found MsConfig - StartUpReg: chkeilor - hkey= - key= - C:\Documents and Settings\TheLeviathan\Local Settings\Application Data\mejrju\qgqisysguard.exe File not found MsConfig - StartUpReg: pqxduivu - hkey= - key= - C:\Documents and Settings\TheLeviathan\Local Settings\Application Data\cuykgf\ocsnsysguard.exe File not found MsConfig - StartUpReg: ypetnpgj - hkey= - key= - C:\Documents and Settings\TheLeviathan\Local Settings\Application Data\nxemvp\qvnhsysguard.exe File not found :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "3389:TCP"=- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "3389:TCP"=- :Files C:\WINDOWS\system32\rdpdd.cpo :Commands [purity] [resethosts] [emptytemp] [EMPTYFLASH] [CREATERESTOREPOINT] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot the PC when it is done Please download HelpAsst_mebroot_fix.exe and save it to your desktop. Close out all other open programs and windows. Double click the file to run it and follow any prompts. If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer. Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter. helpasst -mbrt Make sure you leave a space between helpasst and -mbrt ! When it completes, a log will open. Please post the contents of that log. In the event the tool does not detect an mbr infection and completes, click Start>Run and type the following bolded command, then hit Enter. mbr -f* Now, please do the Start>Run>mbr -f command a second time. Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up. Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter. helpasst -mbrt Make sure you leave a space between helpasst and -mbrt ! When it completes, a log will open. Please post the contents of that log. **Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended). -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

The Leviathan View Member Profile	May 11 2010, 12:48 AM Post #3
Member Group: Member+ Posts: 13 Joined: 10-May 10 Member No.: 10,224	Hi, Thanks for the reply. My logs are pasted below. The Leviathan ======================== Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Status: Genuine Validation Code: 0 Cached Validation Code: N/A Windows Product Key: ***-*-3PD68-WGMPW-TCPFD Windows Product Key Hash: fajyGXEWwCfTwK3ESAMyEQ5xFW8= Windows Product ID: 55274-640-8778937-23662 Windows Product ID Type: 1 Windows License Type: Volume Windows OS version: 5.1.2600.2.00010100.3.0.pro ID: {D46477CB-607F-4026-B719-4DF74670B971}(3) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: Registered, 1.8.31.9 Signed By: Microsoft Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2efd_E2AD56EA-148-80004005_16E0B333-89-80004005 Resolution Status: N/A Vista WgaER Data--> ThreatID(s): N/A Version: N/A Windows XP Notifications Data--> Cached Result: 0 File Exists: Yes Version: 1.8.31.9 WgaTray.exe Signed By: Microsoft WgaLogon.dll Signed By: Microsoft OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 114 Blocked VLK 2 Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2 OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-230-1 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32) Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> Other data--> Office Details: <GenuineResults><MachineData><UGUID>{D46477CB-607F-4026-B719-4DF74670B971}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*-*-*-**-TCPFD</PKey><PID>55274-640-8778937-23662</PID><PIDType>1</PIDType><SID>S-1-5-21-1409082233-1532298954-839522115</SID><SYSTEM><Manufacturer>To Be Filled By O.E.M.</Manufacturer><Model>To Be Filled By O.E.M.</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1010.003</Version><SMBIOSVersion major="2" minor="3"/><Date>20050126000000.000000+000</Date></BIOS><HWID>7EE93B0701842077</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.8.31.9"/><File Name="WgaLogon.dll" Version="1.8.31.9"/></GANotification></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73931-640-0000106-57668</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults> Licensing Data--> N/A Windows Activation Technologies--> N/A HWID Data--> N/A OEM Activation 1.0 Data--> BIOS string matches: yes Marker string from BIOS: 1A298:Quantum Microponents Ltd Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005 OEM Activation 2.0 Data--> N/A VirSCAN.org Scanned Report : Scanned time : 2010/05/10 18:34:31 (CDT) Scanner results: Scanners did not find malware! File Name : rdpdd.cpo File Size : 4653 byte File Type : data MD5 : 360f6c294cf5d5bc674a243b931f7c3a SHA1 : 913225c4a3f4d8a05ba0a104a41c975e3c4a032e Online report : http://virscan.org/report/866ca4ba7c47b927...0fa5edc6be.html Scanner Engine Ver Sig Ver Sig Date Time Scan result a-squared 4.5.0.8 20100508053127 2010-05-08 5.21 - AhnLab V3 2010.05.11.00 2010.05.11 2010-05-11 1.08 - AntiVir 8.2.1.236 7.10.7.84 2010-05-10 0.24 - Antiy 2.0.18 20100510.4348349 2010-05-10 0.12 - Arcavir 2009 201005101630 2010-05-10 0.02 - Authentium 5.1.1 201005100922 2010-05-10 1.26 - AVAST! 4.7.4 100510-1 2010-05-10 0.00 - AVG 8.5.793 271.1.1/2866 2010-05-11 0.22 - BitDefender 7.81008.5859271 7.31603 2010-05-11 3.73 - ClamAV 0.95.3 10955 2010-05-10 0.01 - Comodo 3.13.579 4819 2010-05-10 0.88 - CP Secure 1.3.0.5 2010.05.10 2010-05-10 0.01 - Dr.Web 5.0.2.3300 2010.05.11 2010-05-11 7.04 - F-Prot 4.4.4.56 20100510 2010-05-10 1.26 - F-Secure 7.02.73807 2010.05.10.10 2010-05-10 10.94 - Fortinet 4.0.14 11.925 2010-05-10 0.14 - GData 21.126/21.44 20100510 2010-05-10 6.79 - ViRobot 20100510 2010.05.10 2010-05-10 0.41 - Ikarus T3.1.01.84 2010.05.10.75826 2010-05-10 6.25 - JiangMin 13.0.900 2010.05.10 2010-05-10 1.17 - Kaspersky 5.5.10 2010.05.10 2010-05-10 0.03 - KingSoft 2009.2.5.15 2010.5.10.18 2010-05-10 0.63 - McAfee 5400.1158 5978 2010-05-10 0.02 - Microsoft 1.5703 2010.05.11 2010-05-11 6.50 - Norman 6.04.12 6.04.00 2010-05-10 6.01 - Panda 9.05.01 2010.05.10 2010-05-10 1.64 - Trend Micro 9.120-1004 7.158.14 2010-05-10 0.03 - Quick Heal 10.00 2010.05.10 2010-05-10 1.52 - Rising 20.0 22.47.00.04 2010-05-10 0.28 - Sophos 3.07.1 4.53 2010-05-11 3.24 - Sunbelt 3.9.2421.2 6288 2010-05-10 6.07 - Symantec 1.3.0.24 20100510.002 2010-05-10 0.04 - nProtect 20100510.01 8224986 2010-05-10 7.50 - The Hacker 6.5.2.0 v00278 2010-05-09 0.43 - VBA32 3.12.12.4 20100506.1333 2010-05-06 2.45 - VirusBuster 4.5.11.10 10.126.23/2048291 2010-05-10 2.35 - All processes killed ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71ef8876-23e8-11df-9865-0050da29b0ad}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71ef8876-23e8-11df-9865-0050da29b0ad}\ not found. File J:\slacker.synclauncher.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71ef8876-23e8-11df-9865-0050da29b0ad}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71ef8876-23e8-11df-9865-0050da29b0ad}\ not found. File J:\slacker.synclauncher.exe not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\chkeilor\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\pqxduivu\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\ypetnpgj\ deleted successfully. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\3389:TCP deleted successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\3389:TCP deleted successfully. ========== FILES ========== C:\WINDOWS\system32\rdpdd.cpo moved successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: TheLeviathan ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 597188511 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 3781 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: HelpAssistant ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 4382660 bytes ->Flash cache emptied: 2716 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 2676171 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 2046336 bytes Total Files Cleaned = 578.00 mb [EMPTYFLASH] User: All Users User: TheLeviathan ->Flash cache emptied: 0 bytes User: Default User User: HelpAssistant ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb Restore point Set: OTL Restore Point (0) OTL by OldTimer - Version 3.2.4.1 log created on 05102010_193822 Files\Folders moved on Reboot... C:\Documents and Settings\TheLeviathan\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully. File move failed. C:\WINDOWS\temp\$$$dq3e scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\$67we.$ scheduled to be moved on reboot. Registry entries deleted on Reboot... C:\Documents and Settings\TheLeviathan\Desktop\HelpAsst_mebroot_fix.exe Mon 05/10/2010 at 20:00:54.03 HelpAssistant account is Active ~ attempting to de-activate Account active Yes Local Group Memberships Administrators HelpAssistant successfully set Inactive ~~ Checking for termsrv32.dll ~~ termsrv32.dll present! ~ attempting to remove Remove on reboot: C:\WINDOWS\system32\termsrv32.dll ~~ Checking firewall ports ~~ backing up DomainProfile\GloballyOpenPorts\List registry key closing rogue ports HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list "65533:TCP"=- "52344:TCP"=- "2382:TCP"=- "1941:TCP"=- "2102:TCP"=- "2704:TCP"=- "4509:TCP"=- "7518:TCP"=- "7415:TCP"=- "7416:TCP"=- "3389:TCP"=- backing up StandardProfile\GloballyOpenPorts\List registry key closing rogue ports HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list "65533:TCP"=- "52344:TCP"=- "2382:TCP"=- "1941:TCP"=- "2102:TCP"=- "2704:TCP"=- "4509:TCP"=- "7518:TCP"=- "7415:TCP"=- "7416:TCP"=- "3389:TCP"=- ~~ Checking profile list ~~ HelpAssistant profile found in registry ~ backing up and removing S-1-5-21-1409082233-1532298954-839522115-1000 HelpAssistant profile directory exists at C:\Documents and Settings\HelpAssistant ~ attempting to remove ~ All C:\Documents and Settings\HelpAssistant files successfully removed ~ ~~ Checking mbr ~~ mbr infection detected! ~ running mbr -f Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully detected MBR rootkit hooks: \Driver\ACPI -> 0x8a3042d0 \Driver\atapi -> 0x8a310de0 NDIS: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) -> SendCompleteHandler -> 0x8978f5c0 Warning: possible MBR rootkit infection ! copy of MBR has been found in sector 0x0FBC043 malicious code @ sector 0x0FBC046 ! PE file found in sector at 0x0FBC05C ! MBR rootkit infection detected ! Use: "mbr.exe -f" to fix. original MBR restored successfully ! Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully detected MBR rootkit hooks: \Driver\ACPI -> 0x8a3042d0 \Driver\atapi -> 0x8a310de0 NDIS: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) -> SendCompleteHandler -> 0x8978f5c0 Warning: possible MBR rootkit infection ! user & kernel MBR OK copy of MBR has been found in sector 0x0FBC043 malicious code @ sector 0x0FBC046 ! PE file found in sector at 0x0FBC05C ! Use "Recovery Console" command "fixmbr" to clear infection ! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Status check on Mon 05/10/2010 at 20:20:37.37 Account active No Local Group Memberships ~~ Checking mbr ~~ Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x896D93C8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\ACPI -> 0x896d93c8 \Driver\atapi -> 0x89f902d0 NDIS: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) -> SendCompleteHandler -> 0x897965c0 Warning: possible MBR rootkit infection ! user & kernel MBR OK copy of MBR has been found in sector 0x0FBC043 malicious code @ sector 0x0FBC046 ! PE file found in sector at 0x0FBC05C ! Use "Recovery Console" command "fixmbr" to clear infection ! ~~ Checking for termsrv32.dll ~~ termsrv32.dll not found HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll ~~ Checking profile list ~~ No HelpAssistant profile in registry ~~ Checking for HelpAssistant directories ~~ none found ~~ Checking firewall ports ~~ [HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List] "65533:TCP"=65533:TCP::Enabled:Services "52344:TCP"=52344:TCP::Enabled:Services "7415:TCP"=7415:TCP::Enabled:Services "7416:TCP"=7416:TCP::Enabled:Services [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "65533:TCP"=65533:TCP::Enabled:Services "52344:TCP"=52344:TCP::Enabled:Services "7415:TCP"=7415:TCP::Enabled:Services "7416:TCP"=7416:TCP::Enabled:Services ~~ EOF ~~

Rorschach112 View Member Profile	May 11 2010, 01:02 PM Post #4
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	Please download WVCheck by Artellos from one of the mirrors below; Artellos.com (exe) Artellos.com (zip) After the download, run WVCheck.exe As indicated by the prompt, This program can take a while depending on your hard drive space. Once the program is done, copy the contents of the notepad file as a reply. Download ComboFix here : Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them Click me Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt** log in your next reply. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

The Leviathan View Member Profile	May 12 2010, 12:13 AM Post #5
Member Group: Member+ Posts: 13 Joined: 10-May 10 Member No.: 10,224	Thanks again for the reply and your help! Any idea how serious this issue is? I remember perusing another thread, possibly on another forum, where someone had the Rustock rootkit and they were advised to contact their financial institutions to keep an eye out for identity theft. Should I be as vigilant with this MBR rootkit? My logs are attached below. The Leviathan ====================== Windows Validation Check Log Created On: 1856_11-05-2010 ------------------------ WVCheck's Registry Dump ----------------------- Auto-Update Option: Do not download or install updates automatically. ------------------------------ Last success time for Automatic Updates for 'Detect', 'Download' and 'Install' could not be found. WVCheck's File Dump ------------------- WVCheck found no files. WVCheck's HOSTS File Check ------------------- WVCheck found no bad lines in the hosts file. -------- End of File, program close at 1902_11-05-2010 -------- ComboFix 10-05-10.05 - TheLeviathan 05/11/2010 19:35:45.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1042 [GMT -4:00] Running from: c:\documents and settings\TheLeviathan\Desktop\ComboFix.exe AV: Symantec AntiVirus Corporate Edition On-access scanning disabled (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . Infected copy of c:\windows\system32\drivers\mouclass.sys was found and disinfected Restored copy from - Kitty had a snack . ((((((((((((((((((((((((( Files Created from 2010-04-11 to 2010-05-11 ))))))))))))))))))))))))))))))) . 2010-05-11 23:33 . 2010-05-11 23:40 -------- d-----w- c:\documents and settings\HelpAssistant 2010-05-11 21:19 . 2010-05-11 21:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM 2010-05-11 21:18 . 2010-05-11 21:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-05-11 00:00 . 2010-05-11 00:01 -------- d-----w- C:\HelpAsst_backup 2010-05-10 23:38 . 2010-05-10 23:38 -------- d-----w- C:\_OTL 2010-05-09 22:16 . 2007-01-18 12:00 3968 ----a-w- c:\windows\system32\drivers\AvgArCln.sys 2010-05-09 19:34 . 2010-05-09 19:34 -------- d-----w- C:\Rooter$ 2010-05-09 06:02 . 2010-05-09 06:02 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\Malwarebytes 2010-05-09 06:02 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-09 06:02 . 2010-05-09 06:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-09 06:02 . 2010-05-09 06:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-05-09 06:02 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-07 07:59 . 2010-05-07 07:26 15880 ----a-w- c:\windows\system32\lsdelete.exe 2010-05-07 07:26 . 2010-02-04 15:53 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2010-05-07 07:26 . 2010-05-07 07:26 -------- dc----w- c:\windows\system32\DRVSTORE 2010-05-07 07:26 . 2010-05-07 07:26 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-05-07 07:24 . 2010-05-07 07:24 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-05-07 07:24 . 2010-02-04 15:53 2954656 -c--a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe 2010-05-07 07:24 . 2010-05-07 07:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2010-05-07 07:24 . 2010-05-07 07:24 -------- d-----w- c:\program files\Lavasoft 2010-05-06 06:02 . 2010-05-06 07:03 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-05-06 06:02 . 2010-05-06 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-05-05 04:01 . 2010-05-05 04:05 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe 2010-05-05 04:01 . 2010-05-05 04:05 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll 2010-05-05 04:01 . 2010-05-05 04:01 -------- d-----w- c:\documents and settings\TheLeviathan\Local Settings\Application Data\mdnslib 2010-05-05 03:59 . 2010-05-05 03:59 -------- d-----w- c:\documents and settings\TheLeviathan\Local Settings\Application Data\FLVService 2010-05-05 03:59 . 2010-05-05 03:59 -------- d-----w- c:\windows\Replay Media Catcher 2010-05-05 03:46 . 2010-05-05 03:46 46 ----a-w- c:\windows\system32\DonationCoder_urlsnooper_InstallInfo.dat 2010-05-05 03:46 . 2010-05-05 03:46 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\DonationCoder 2010-05-05 03:36 . 2010-05-05 03:36 -------- d-----w- c:\program files\Orbitdownloader 2010-05-01 04:10 . 2010-05-10 22:53 -------- d-----w- c:\program files\FreeVPN 2010-04-16 06:59 . 2010-04-16 07:00 -------- d-----w- c:\windows\system32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-11 23:33 . 2009-11-22 07:46 -------- d-----w- c:\program files\Symantec AntiVirus 2010-05-05 03:58 . 2010-04-10 21:20 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\Orbit 2010-04-28 07:57 . 2010-01-29 20:48 256 ----a-w- c:\windows\system32\pool.bin 2010-04-25 05:20 . 2010-04-25 05:20 -------- d-----w- c:\program files\Common Files\Java 2010-04-25 05:20 . 2010-04-25 05:20 503808 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n\msvcp71.dll 2010-04-25 05:20 . 2010-04-25 05:20 499712 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n\jmc.dll 2010-04-25 05:20 . 2010-04-25 05:20 348160 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n\msvcr71.dll 2010-04-25 05:20 . 2010-04-25 05:20 61440 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3415ad37-n\decora-sse.dll 2010-04-25 05:20 . 2010-04-25 05:20 12800 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3415ad37-n\decora-d3d.dll 2010-04-25 05:20 . 2010-04-25 05:20 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-04-25 05:20 . 2010-04-25 05:20 -------- d-----w- c:\program files\Java 2010-04-10 21:27 . 2010-04-10 21:20 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\GrabPro 2010-03-29 02:57 . 2010-03-29 02:57 38976 ----a-w- c:\windows\system32\drivers\pssdk42.sys 2010-03-29 02:57 . 2010-03-29 02:57 -------- d-----w- c:\program files\NetWorx 2010-03-29 02:57 . 2010-03-29 02:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SoftPerfect . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-04-09 155648] "BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536] "NetWorx"="c:\program files\NetWorx\networx.exe" [2010-03-22 2909696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] 2005-10-04 17:42 48752 ----a-w- c:\program files\Common Files\Symantec Shared\ccApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] 2007-04-09 17:32 19456 ------w- c:\windows\system32\CtHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp] 2007-04-09 17:32 19968 ------w- c:\windows\system32\Ctxfihlp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-04-12 22:46 1135912 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2006-10-22 17:22 7700480 ----a-w- c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2006-10-22 17:22 86016 ----a-w- c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2006-10-22 17:22 1622016 ----a-w- c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-04-09 01:23 155648 ------w- c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "m:\\Microsoft Games\\Flight Simulator 9\\fs9.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "l:\\Microsoft Games\\Flight Simulator 9\\fs9.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "65533:TCP"= 65533:TCP:Services "52344:TCP"= 52344:TCP:Services "7415:TCP"= 7415:TCP:Services "7416:TCP"= 7416:TCP:Services "3389:TCP"= 3389:TCP:Remote Desktop R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [11/23/2008 10:18 AM 155136] R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [11/23/2008 10:18 AM 5248] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/7/2010 3:26 AM 64288] R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [11/24/2008 2:10 AM 77312] R1 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [3/28/2010 10:57 PM 38976] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2/4/2010 11:52 AM 1285864] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/22/2009 3:53 AM 102448] S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 2:27 PM 169200] . Contents of the 'Scheduled Tasks' folder 2010-05-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 07:26] . . ------- Supplementary Scan ------- . uStart Page = about:blank uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = <local> IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe AddRemove-Soundslides - c:\program files\Soundslides\uninstall.exe \u ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-11 19:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x899B8388]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xba10cf28 \Driver\ACPI -> 0x899b8388 \Driver\atapi -> 0x89ff59d8 IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022 ParseProcedure -> ntkrnlpa.exe @ 0x80577c84 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022 ParseProcedure -> ntkrnlpa.exe @ 0x80577c84 NDIS: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) -> SendCompleteHandler -> 0x898105c0 PacketIndicateHandler -> NDIS.sys @ 0xb9dd9a21 SendHandler -> NDIS.sys @ 0xb9dce949 Warning: possible MBR rootkit infection ! user & kernel MBR OK copy of MBR has been found in sector 0x0FBC043 malicious code @ sector 0x0FBC046 ! PE file found in sector at 0x0FBC05C ! ************************************************************************ . Completion time: 2010-05-11 19:46:07 ComboFix-quarantined-files.txt 2010-05-11 23:46 Pre-Run: 1,475,059,712 bytes free Post-Run: 1,200,979,968 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn - - End Of File - - 25BC13B302BE489CBEDEC7CCE4C8B9A1

The Leviathan View Member Profile	May 12 2010, 03:18 AM Post #6
Member Group: Member+ Posts: 13 Joined: 10-May 10 Member No.: 10,224	Just an update, my Norton Corporate/Symantec antivirus found the following infected file(s) on auto-protect mode, here is the log: ====== Risk Backdoor.Tidserv!inf Backdoor.Tidserv!inf Action Partial Partial Count 4 4 Filename A0033904.sys A0033904.sys Threat Type File File Original Location C:\System Volume Information\_restore{2EAA3C7C-1452-452A-8E4B-A6AE4367A720}\RP365\ C:\System Volume Information\_restore{2EAA3C7C-1452-452A-8E4B-A6AE4367A720}\RP365\ Computer THELEVIATHAN THELEVIATHAN User THELEVIATHAN\SYSTEM THELEVIATHAN\SYSTEM Status Infected Infected Current Location C:\System Volume Information\_restore{2EAA3C7C-1452-452A-8E4B-A6AE4367A720}\RP365\ C:\System Volume Information\_restore{2EAA3C7C-1452-452A-8E4B-A6AE4367A720}\RP365\ Primary Action Clean security risk Clean security risk Secondary Action Quarantine Quarantine Logged By Auto-Protect scan Auto-Protect scan Action Description Quarantine was partially successful. Quarantine was partially successful. Date 5/11/2010 22:22 5/11/2010 21:24 ====== The action was partial because in both instances it successfully deleted a 'Browser Cache Remediation'. I tried forcing quarantine and delete without any success. Also, when I shut down I know get six separate error windows for SpyBot's TeaTimer.exe which may be related to its disabling during the ComboFix process above, as it only started happening after reactivating it. The errors say the same thing, appear twice each, and only have the [OK] and [X] button available to press. The first set of errors say this: [/indent]Error Access violation at address 00470A3D in module 'TeaTimer.exe'. Read of address 00000010 After pressing [OK] on both error boxes, the second set of error windows pop up: Error Access violation at address 74E50DE8. Read of address 74E50DE8 Press [OK] again for each error and we get the final two boxes: Error [indent] Access violation at address 0425A64B. Write of address 00000400 SpyBot then needs to be 'End Tasked' in order to resume shutdown process. ====== Again, many thanks for your continued help; The Leviathan

Rorschach112 View Member Profile	May 12 2010, 12:05 PM Post #7
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	wont hurt to change your passwords Please download OTM Save it to your desktop. Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes :Services :Reg :Files c:\documents and settings\HelpAssistant :Commands [purity] [resethosts] [emptytemp] [CREATERESTOREPOINT] [EMPTYFLASH] [Reboot] Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTM and reboot your PC. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE File:: Folder:: c:\documents and settings\HelpAssistant Registry:: [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"=- MBR:: Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

The Leviathan View Member Profile	May 15 2010, 10:45 AM Post #8
Member Group: Member+ Posts: 13 Joined: 10-May 10 Member No.: 10,224	Thank you for the password change advice. I am sorry for the late reply; my logs are listed below. Regards, The Leviathan ================ All processes killed ========== PROCESSES ========== ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== c:\documents and settings\HelpAssistant\UserData\YPX00AA2 folder moved successfully. c:\documents and settings\HelpAssistant\UserData\XDVVPD9O folder moved successfully. c:\documents and settings\HelpAssistant\UserData\X4THNU5V folder moved successfully. c:\documents and settings\HelpAssistant\UserData\QC4FRZBG folder moved successfully. c:\documents and settings\HelpAssistant\UserData folder moved successfully. c:\documents and settings\HelpAssistant\Templates folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\WinRAR folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\Startup folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\eXpress TimeStamp Toucher folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\Accessories\System Tools folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\Accessories\Entertainment folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\Accessories\Accessibility folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs\Accessories folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu\Programs folder moved successfully. c:\documents and settings\HelpAssistant\Start Menu folder moved successfully. c:\documents and settings\HelpAssistant\SendTo folder moved successfully. c:\documents and settings\HelpAssistant\Recent folder moved successfully. c:\documents and settings\HelpAssistant\PrintHood folder moved successfully. c:\documents and settings\HelpAssistant\NetHood\My Web Sites on MSN folder moved successfully. c:\documents and settings\HelpAssistant\NetHood folder moved successfully. c:\documents and settings\HelpAssistant\My Documents\My Videos\DivX Movies folder moved successfully. c:\documents and settings\HelpAssistant\My Documents\My Videos folder moved successfully. c:\documents and settings\HelpAssistant\My Documents\My Pictures folder moved successfully. c:\documents and settings\HelpAssistant\My Documents\My Music folder moved successfully. c:\documents and settings\HelpAssistant\My Documents\Flight Simulator Files folder moved successfully. c:\documents and settings\HelpAssistant\My Documents folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\II4W8K27 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ETQNA5WO folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\4ERQV9SJ folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\3TJLEK7B folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files\AntiPhishing folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temporary Internet Files folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temp\WPDNSE folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temp\RarSFX0 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Temp folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\History\History.IE5\MSHist012010051120100512 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\History\History.IE5\MSHist012010051020100511 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\History\History.IE5\MSHist012010050320100510 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\History\History.IE5\MSHist012010041820100419 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\History\History.IE5 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\History folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0\Z8MLAQWP.W85\1KGXAZMC.BP3\manifests folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0\Z8MLAQWP.W85\1KGXAZMC.BP3 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0\Z8MLAQWP.W85 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0\Data\89J235P4.7G1\N560924J.X8O folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0\Data\89J235P4.7G1 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0\Data folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps\2.0 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Apps folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Symantec folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\nxemvp folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\temp folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows NT\NTBackup folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows NT folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows Media\9.0 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows Media\11.0 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows Media folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Windows folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\s\mblaj4qqffg1hhhww2sljrugc2b4hoqjzu20u5jkbe3krigsbcaaacfa\f folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\s\mblaj4qqffg1hhhww2sljrugc2b4hoqjzu20u5jkbe3krigsbcaaacfa folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\s\fg55llasblzekh4g3lxdq2bycsmihi3znlh3fmbjx5pakfxnx1aaagea\f folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\s\fg55llasblzekh4g3lxdq2bycsmihi3znlh3fmbjx5pakfxnx1aaagea folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\s folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\l folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\g\05tegpd0e531u3m3g2kuvwhcozhjk101i2vrknwtwduez2rkdyaaagfa folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1\g folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5\1 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg\eizehace.ao5 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is\3sfzpffo.kjg folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight\is folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Silverlight folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Portable Devices folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Outlook folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\OFFICE\ONetConfig folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\OFFICE\12.0 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\OFFICE folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Media Player\Transcoded Files Cache folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Media Player\Sync Generated Playlists folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Media Player\Sync Downloads folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Media Player\Art Cache\LocalMLS folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Media Player\Art Cache folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Media Player folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Internet Explorer folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\HelpCtr folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\FORMS folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds Cache\ZMOI2RTA folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds Cache\YG8M82C2 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds Cache\S4BWXZ8S folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds Cache\O10PLQHA folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds Cache folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~ folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Feeds folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1409082233-1532298954-839522115-1003 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1409082233-1532298954-839522115-1000 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\Credentials folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft\CD Burning folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Microsoft folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\mejrju folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\mdnslib folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Identities\{967BD4D9-58A1-4D95-B3EB-1FF13349B933}\Microsoft\Outlook Express folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Identities\{967BD4D9-58A1-4D95-B3EB-1FF13349B933}\Microsoft folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Identities\{967BD4D9-58A1-4D95-B3EB-1FF13349B933} folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Identities folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Help folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\FLVService\lib folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\FLVService folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Deployment folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\cuykgf folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\15\14 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\15 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\14\07 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\14 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\13\06 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\13 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\12\14 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\12\09 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\12\06 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\12\03 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\12 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\11\07 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\11\05 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\11 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\10\13 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\10 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\08\09 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\08 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07\13 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07\02 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\06\08 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\06 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\05\15 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\05 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\04\04 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\04\02 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\04 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\03\14 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\03\10 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\03 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\02\15 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\02\12 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\02 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\01\15 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\01\12 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\01\09 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\01 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\00\05 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads\00 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime\downloads folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer\QuickTime folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Apple Computer folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Updater6\Install folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Updater6\Data\UpdateAvailable\pselements7-en_US folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Updater6\Data\UpdateAvailable folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Updater6\Data folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Updater6 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\TypeSupport folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Fonts folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\ESD folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Color folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache\Search70 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Acrobat\7.0 folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe\Acrobat folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data\Adobe folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings\Application Data folder moved successfully. c:\documents and settings\HelpAssistant\Local Settings folder moved successfully. c:\documents and settings\HelpAssistant\Favorites\Microsoft Websites folder moved successfully. c:\documents and settings\HelpAssistant\Favorites\Links folder moved successfully. c:\documents and settings\HelpAssistant\Favorites folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\youtube folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Canon Pictures folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slide Show folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Bills folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Pictures 1 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Pictures\Tea folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Pictures folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Orbit Downloads\New Folder (2) folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Orbit Downloads\CBC - The Current\Robert Fisk folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Orbit Downloads\CBC - The Current folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Orbit Downloads folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\New Folder folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow\Slideshow Photos\Original folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow\Slideshow Photos\Edited folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow\Slideshow Photos folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow\Pictures folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow\Music folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow\Background folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Slideshow folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\SysRestorePoint_v13 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\Rooter folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\OTL folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\LockSearch folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\erunt\Backup\5-9-2010\Users\00000002 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\erunt\Backup\5-9-2010\Users\00000001 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\erunt\Backup\5-9-2010\Users folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\erunt\Backup\5-9-2010 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\erunt\Backup folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\erunt folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal\CKScanner folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Malware removal folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Finished\Top 50 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Finished\Pictures folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Finished\File Lists folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Finished\Edited Top 50 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Finished folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\DeviantART folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Canon Pictures 2 folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\BB backup folder moved successfully. c:\documents and settings\HelpAssistant\Desktop\Tax folder moved successfully. c:\documents and settings\HelpAssistant\Desktop folder moved successfully. c:\documents and settings\HelpAssistant\Cookies folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\WinRAR folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc\art\title\Addiction (Radio) folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc\art\title folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc\art\artistalbum\Royksopp\The Understanding folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc\art\artistalbum\Royksopp folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc\art\artistalbum folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc\art folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\vlc folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\jre1.6.0_20 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\tmp\si folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\tmp folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\9 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\8 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\7 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\63 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\62 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\61 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\60 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\6 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\59 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\58 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\57 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\56 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\55 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\54 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\53 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\52 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\51 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\50 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\5 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\49 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\48 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\47 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\46 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\45 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\44 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\43 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\42 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\41 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\40 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\4 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\39 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\38 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\37 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\36 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\35 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\34 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\33 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\32 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\31 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\30 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\3 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\29 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\28 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\27 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\26 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\25 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\24 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\23 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\22 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\21 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\20 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\2 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\19 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\18 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3415ad37-n folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\17 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\16 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\15 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\14 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\13 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\12 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\11 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\10 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\1 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0\0 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache\6.0 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\SystemCache folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\security folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\log folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\ext folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment\cache folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\Deployment folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java\AU folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun\Java folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Sun folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Updates folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader History folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache\ebb063f0583e757ce35970273a5a5db448b62c2d\UMTS folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache\ebb063f0583e757ce35970273a5a5db448b62c2d\Java folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache\ebb063f0583e757ce35970273a5a5db448b62c2d folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache\dae2b5a3587e6ac33bf1d3eb90b2ee889df44b5b folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache\01748d6d5c6fd795ce842c6fa2a3523c46eca1ab\Java folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache\01748d6d5c6fd795ce842c6fa2a3523c46eca1ab folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Loader Cache folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Intellisync\2554B2B0 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Intellisync\21CB02E3 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Intellisync\2094D375 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\Intellisync folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry\DesktopInstallerFiles folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion\BlackBerry folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Research In Motion folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Photodex\Proshow Producer folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Photodex\ProShow Gold folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Photodex folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Orbit\flink folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Orbit folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Netscape\Plugins folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Netscape folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Nero\OnlineServices folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Nero\Nero 9\Nero Burning ROM folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Nero\Nero 9 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Nero folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Mozilla\Plugins folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Mozilla folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Word\STARTUP folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Word folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Windows\Themes folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Windows folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Templates folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\SystemCertificates\My\CTLs folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\SystemCertificates\My\CRLs folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\SystemCertificates\My\Certificates folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\SystemCertificates\My folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\SystemCertificates folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Speech\Files\UserLexicons folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Speech\Files folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Speech folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Protect\S-1-5-21-1409082233-1532298954-839522115-1003 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Protect folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Proof folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\PowerPoint folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Office\Recent folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Office folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\MMC folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Media Player\Skins folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Media Player folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Internet Explorer\Quick Launch folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Internet Explorer folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\HTML Help folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\SceneryCache folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\Facilities folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Wright_Flyer folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Vickers_Vimy folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Spirit_of_StLouis folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\schweizr folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Robinson_R22 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Piper_J3Cub folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\pa28_180 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\mooney_bravo folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\md_83 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Lockheed_Vega folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\lockheed-martinsr-71ablackbird folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\lear45 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Ford_Trimotor folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\F-16NY folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\extra300 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Douglas_DC3 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\dh_dash8_100 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\DeHavilland_Comet folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\Curtiss_Jenny folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\C208B folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\C208 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\c182 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\c172 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\bell206b folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\beech_king_air_350 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\beech_baron_58 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\b777_300 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\b747_400 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT\b737_400 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9\AIRCRAFT folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\FS9 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Forms folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Excel\XLSTART folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Excel folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1409082233-1532298954-839522115-1003 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Crypto\RSA folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Crypto folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\CryptnetUrlCache\MetaData folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\CryptnetUrlCache\Content folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\CryptnetUrlCache folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Credentials\S-1-5-21-1409082233-1532298954-839522115-1003 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Credentials\S-1-5-21-1409082233-1532298954-839522115-1000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Credentials folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\Address Book folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft\AddIns folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Microsoft folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Malwarebytes\Malwarebytes' Anti-Malware folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Malwarebytes folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\TextXtra folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\TextAsset folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\SWA folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\SoundControl folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\Shockwave3dAsset folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\MacroMix folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\Havok folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\FontXtra folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\FontAsset folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\FlashAsset folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\DirectSound folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras\download folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\xtras folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\Prefs\ZKCGCLYT folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player\Prefs folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Shockwave Player folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.cbc.ca folder moved successfully/ c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\macromedia.com\support folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\macromedia.com folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\ML4GXU3S\www.cbc.ca\video\swf\UberPlayer.swf folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\ML4GXU3S\www.cbc.ca\video\swf folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\ML4GXU3S\www.cbc.ca\video folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\ML4GXU3S\www.cbc.ca folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects\ML4GXU3S folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player\#SharedObjects folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia\Flash Player folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Macromedia folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Identities\{967BD4D9-58A1-4D95-B3EB-1FF13349B933} folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Identities folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Help folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\GrabPro folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\TRAINING_DAY-2002021909053900-1bf2f47507 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\OCEANS_THIRTEEN-2007082903522600-01b071e40c folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\KISS_KISS_BANG_BANG-2006031523521400-1bf2f47507 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\GOODFELLAS_4X3_NA_PT2-1997022001295500-1bf1cf271b folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\GOODFELLAS_4X3LB_NA-1997021923075700-d58c7323e0 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\F-00000349000002dc-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\c-0000034300000343-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\b-000003340000038b-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\a-36887b34bac8f7ff-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\9-0000035500000367-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\9-000002c4000002f5-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\4_-1ed51128ea6d9a49-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\4-e79d53adcee14eab-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\.-0000033300000321-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-a71946f3aae6a784-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-6461746100000001-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-5379cc360a29eb14-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-362e34000000bc2d-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-2264af4b697f052f-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-206f98a2cda3ad1c-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-1b0015d600000000-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-0000039300000323-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-000003330000033b-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-0000033000000333-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-0000032600000313-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-00000308000002f1-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-000002ff00000321-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-000002e00000028d-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-000002c1000002cb-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-000002a4000002c1-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-0000027b00000291-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\-0000025f00000284-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\--000002b1000002cb-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss\)-0000028900000282-0000000000 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\dvdcss folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\DonationCoder\Keys folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\DonationCoder folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Creative\Calibrator folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Creative folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Blackberry Desktop\Yahoo Connector folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Blackberry Desktop\Novell GroupWise Connector folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Blackberry Desktop folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Apple Computer\QuickTime folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Apple Computer folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\AdobeUM folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\SWA folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\SoundControl folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\MacroMix folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\FlashAsset folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\DirectSound folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras\download folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\xtras folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\Prefs\GX4WR4PG folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\Prefs folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11\DswMedia folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Shockwave Player 11 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Plugins\Adobe Lighting Effects CS3\Photoshop\Lighting Styles folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Plugins\Adobe Lighting Effects CS3\Photoshop folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Plugins\Adobe Lighting Effects CS3 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Plugins\Adobe Filter Gallery CS2\Elements folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Plugins\Adobe Filter Gallery CS2 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Plugins folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Photoshop Elements Sync Agent\1.0\Logs folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Photoshop Elements Sync Agent\1.0 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Photoshop Elements Sync Agent folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Flash Player\AssetCache\DRYHBGZ8 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Flash Player\AssetCache folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Flash Player folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Color\Settings folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Color\Proofing folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Color folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Adobe PDF\Settings folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Adobe PDF folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\Updater folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\Security folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\Preferences folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\Messages\ENU folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\Messages folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\JavaScripts folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0\Collab folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat\7.0 folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe\Acrobat folder moved successfully. c:\documents and settings\HelpAssistant\Application Data\Adobe folder moved successfully. c:\documents and settings\HelpAssistant\Application Data folder moved successfully. c:\documents and settings\HelpAssistant folder moved successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: TheLeviathan ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 428120714 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 4182 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 1042 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 145094 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 34757544 bytes Total Files Cleaned = 442.00 mb Restore point Set: OTM Restore Point (0) OTM by OldTimer - Version 3.1.12.0 log created on 05152010_052732 Files moved on Reboot... C:\Documents and Settings\TheLeviathan\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully. File move failed. C:\WINDOWS\temp\$$$dq3e scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\$67we.$ scheduled to be moved on reboot. Registry entries deleted on Reboot... ComboFix 10-05-10.05 - TheLeviathan 05/15/2010 5:45.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1061 [GMT -4:00] Running from: c:\documents and settings\TheLeviathan\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\TheLeviathan\Desktop\CFScript.txt AV: Symantec AntiVirus Corporate Edition On-access scanning disabled (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} . ((((((((((((((((((((((((( Files Created from 2010-04-15 to 2010-05-15 ))))))))))))))))))))))))))))))) . 2010-05-15 09:27 . 2010-05-15 09:27 -------- d-----w- C:\_OTM 2010-05-11 21:19 . 2010-05-11 21:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM 2010-05-11 21:18 . 2010-05-11 21:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-05-11 00:00 . 2010-05-11 00:01 -------- d-----w- C:\HelpAsst_backup 2010-05-10 23:38 . 2010-05-10 23:38 -------- d-----w- C:\_OTL 2010-05-09 22:16 . 2007-01-18 12:00 3968 ----a-w- c:\windows\system32\drivers\AvgArCln.sys 2010-05-09 19:34 . 2010-05-09 19:34 -------- d-----w- C:\Rooter$ 2010-05-09 06:02 . 2010-05-09 06:02 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\Malwarebytes 2010-05-09 06:02 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-09 06:02 . 2010-05-09 06:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-09 06:02 . 2010-05-09 06:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-05-09 06:02 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-07 07:59 . 2010-05-07 07:26 15880 ----a-w- c:\windows\system32\lsdelete.exe 2010-05-07 07:26 . 2010-02-04 15:53 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2010-05-07 07:26 . 2010-05-07 07:26 -------- dc----w- c:\windows\system32\DRVSTORE 2010-05-07 07:26 . 2010-05-07 07:26 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-05-07 07:24 . 2010-05-07 07:24 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-05-07 07:24 . 2010-02-04 15:53 2954656 -c--a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe 2010-05-07 07:24 . 2010-05-07 07:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2010-05-07 07:24 . 2010-05-07 07:24 -------- d-----w- c:\program files\Lavasoft 2010-05-06 06:02 . 2010-05-06 07:03 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-05-06 06:02 . 2010-05-06 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-05-05 04:01 . 2010-05-05 04:05 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe 2010-05-05 04:01 . 2010-05-05 04:05 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll 2010-05-05 04:01 . 2010-05-05 04:01 -------- d-----w- c:\documents and settings\TheLeviathan\Local Settings\Application Data\mdnslib 2010-05-05 03:59 . 2010-05-05 03:59 -------- d-----w- c:\documents and settings\TheLeviathan\Local Settings\Application Data\FLVService 2010-05-05 03:59 . 2010-05-05 03:59 -------- d-----w- c:\windows\Replay Media Catcher 2010-05-05 03:46 . 2010-05-05 03:46 46 ----a-w- c:\windows\system32\DonationCoder_urlsnooper_InstallInfo.dat 2010-05-05 03:46 . 2010-05-05 03:46 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\DonationCoder 2010-05-05 03:36 . 2010-05-05 03:36 -------- d-----w- c:\program files\Orbitdownloader 2010-05-01 04:10 . 2010-05-10 22:53 -------- d-----w- c:\program files\FreeVPN 2010-04-16 06:59 . 2010-04-16 07:00 -------- d-----w- c:\windows\system32\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-15 09:55 . 2009-11-22 07:46 -------- d-----w- c:\program files\Symantec AntiVirus 2010-05-05 03:58 . 2010-04-10 21:20 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\Orbit 2010-04-28 07:57 . 2010-01-29 20:48 256 ----a-w- c:\windows\system32\pool.bin 2010-04-25 05:20 . 2010-04-25 05:20 -------- d-----w- c:\program files\Common Files\Java 2010-04-25 05:20 . 2010-04-25 05:20 503808 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n\msvcp71.dll 2010-04-25 05:20 . 2010-04-25 05:20 499712 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n\jmc.dll 2010-04-25 05:20 . 2010-04-25 05:20 348160 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2e67d4cd-n\msvcr71.dll 2010-04-25 05:20 . 2010-04-25 05:20 61440 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3415ad37-n\decora-sse.dll 2010-04-25 05:20 . 2010-04-25 05:20 12800 ----a-w- c:\documents and settings\TheLeviathan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3415ad37-n\decora-d3d.dll 2010-04-25 05:20 . 2010-04-25 05:20 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-04-25 05:20 . 2010-04-25 05:20 -------- d-----w- c:\program files\Java 2010-04-10 21:27 . 2010-04-10 21:20 -------- d-----w- c:\documents and settings\TheLeviathan\Application Data\GrabPro 2010-03-29 02:57 . 2010-03-29 02:57 38976 ----a-w- c:\windows\system32\drivers\pssdk42.sys 2010-03-29 02:57 . 2010-03-29 02:57 -------- d-----w- c:\program files\NetWorx 2010-03-29 02:57 . 2010-03-29 02:57 -------- d-----w- c:\documents and settings\All Users\Application Data\SoftPerfect . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-04-09 155648] "BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536] "NetWorx"="c:\program files\NetWorx\networx.exe" [2010-03-22 2909696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] 2005-10-04 17:42 48752 ----a-w- c:\program files\Common Files\Symantec Shared\ccApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] 2007-04-09 17:32 19456 ------w- c:\windows\system32\CtHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp] 2007-04-09 17:32 19968 ------w- c:\windows\system32\Ctxfihlp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2010-04-12 22:46 1135912 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2006-10-22 17:22 7700480 ----a-w- c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2006-10-22 17:22 86016 ----a-w- c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2006-10-22 17:22 1622016 ----a-w- c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-04-09 01:23 155648 ------w- c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "m:\\Microsoft Games\\Flight Simulator 9\\fs9.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "l:\\Microsoft Games\\Flight Simulator 9\\fs9.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "65533:TCP"= 65533:TCP:Services "52344:TCP"= 52344:TCP:Services "7415:TCP"= 7415:TCP:Services "7416:TCP"= 7416:TCP:Services "6711:TCP"= 6711:TCP:Services "6712:TCP"= 6712:TCP:Services "2227:TCP"= 2227:TCP:Services "2954:TCP"= 2954:TCP:Services "7820:TCP"= 7820:TCP:Services "7821:TCP"= 7821:TCP:Services R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [11/23/2008 10:18 AM 155136] R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [11/23/2008 10:18 AM 5248] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/7/2010 3:26 AM 64288] R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [11/24/2008 2:10 AM 77312] R1 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [3/28/2010 10:57 PM 38976] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2/4/2010 11:52 AM 1285864] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/22/2009 3:53 AM 102448] S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 2:27 PM 169200] . Contents of the 'Scheduled Tasks' folder 2010-05-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 07:26] . . ------- Supplementary Scan ------- . uStart Page = about:blank uInternet Settings,ProxyServer = http=127.0.0.1:5555 uInternet Settings,ProxyOverride = <local> IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-15 05:54 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89772D50]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xba10cf28 \Driver\ACPI -> 0x89772d50 \Driver\atapi -> 0x8a118f00 IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022 ParseProcedure -> ntkrnlpa.exe @ 0x80577c84 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022 ParseProcedure -> ntkrnlpa.exe @ 0x80577c84 NDIS: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) -> SendCompleteHandler -> 0x8980a5c0 PacketIndicateHandler -> NDIS.sys @ 0xb9dbba0d SendHandler -> NDIS.sys @ 0xb9dcfb40 Warning: possible MBR rootkit infection ! user & kernel MBR OK copy of MBR has been found in sector 0x0FBC043 malicious code @ sector 0x0FBC046 ! PE file found in sector at 0x0FBC05C ! ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2476) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Symantec Shared\ccSetMgr.exe c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\program files\Photodex\ProShowGold\ScsiAccess.exe c:\program files\Symantec AntiVirus\Rtvscan.exe c:\windows\system32\WgaTray.exe c:\windows\System32\wbem\unsecapp.exe c:\windows\system32\wscntfy.exe c:\program files\Lavasoft\Ad-Aware\AAWTray.exe . ************************************************************************ . Completion time: 2010-05-15 06:01:14 - machine was rebooted ComboFix-quarantined-files.txt 2010-05-15 10:01 Pre-Run: 1,101,193,216 bytes free Post-Run: 1,067,843,584 bytes free - - End Of File - - 452582F42B6060909104FAD87328962B

Rorschach112 View Member Profile	May 15 2010, 12:25 PM Post #9
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	Download TFC to your desktop Open the file and close any other windows. It will close all programs itself when run, make sure to let it run uninterrupted. Click the Start button to begin the process. The program should not take long to finish its job Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here. * Go here to run an online scannner from ESET. Note: You will need to use Internet explorer for this scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Check next options: Remove found threats and Scan unwanted applications. Click Scan Wait for the scan to finish Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt Copy and paste that log as a reply to this topic -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

The Leviathan View Member Profile	May 19 2010, 12:13 AM Post #10
Member Group: Member+ Posts: 13 Joined: 10-May 10 Member No.: 10,224	Hey, just wanted to post an update to let you know I am still working on this and to not close the thread. Kapersky scan took almost 40 hours and ESET scanner is running now. I will likely have the results tomorrow. Thanks, The Leviathan

Rorschach112 View Member Profile	May 19 2010, 11:27 AM Post #11
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	ok -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

The Leviathan View Member Profile	May 20 2010, 03:48 AM Post #12
Member Group: Member+ Posts: 13 Joined: 10-May 10 Member No.: 10,224	Hi again, thanks for your patience. My logs are posted below. Cheers, The Leviathan ============== Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4108 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 5/16/2010 10:32:43 PM mbam-log-2010-05-16 (22-32-43).txt Scan type: Quick scan Objects scanned: 125148 Time elapsed: 5 minute(s), 23 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, May 18, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, May 16, 2010 23:49:01 Records in database: 4118148 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ I:\ L:\ M:\ P:\ Scan statistics: Objects scanned: 587660 Threats found: 18 Infected objects found: 85 Suspicious objects found: 0 Scan duration: 38:42:01 File name / Threat / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500004.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500005.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500006.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500007.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500008.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500009.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50000A.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50000B.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50000C.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50000D.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500012.VBN Infected: Constructor.Win32.MS04-032.e 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50001A.VBN Infected: Trojan.Win32.Genome.cnpu 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500020.VBN Infected: Trojan-Dropper.Win32.Small.bf 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50002C.VBN Infected: Trojan-Dropper.Win32.Small.bf 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500031.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500032.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500033.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500034.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500035.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500036.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500037.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500038.VBN Infected: Trojan.Java.ClassLoader.as 3 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500039.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50003A.VBN Infected: Exploit.Java.Gimsh.a 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F50003F.VBN Infected: Constructor.Win32.MS04-032.e 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F500047.VBN Infected: Trojan.Win32.Genome.cnpu 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\mouclass.sys.vir Infected: Rootkit.Win32.TDSS.ap 1 C:\System Volume Information\_restore{2EAA3C7C-1452-452A-8E4B-A6AE4367A720}\RP365\A0033904.sys Infected: Rootkit.Win32.TDSS.ap 1 C:\_OTM\MovedFiles\05152010_052732\c_documents and settings\HelpAssistant\Local Settings\Temp\Av-test.txt Infected: EICAR-Test-File 1 D:\Games\ClashNSlash.rar Infected: Trojan-Downloader.Win32.Agent.dkcc 1 D:\Temporary\GDiVX1.9.9.6.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bx 1 D:\Temporary\GDiVX1.9.9.6.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.d 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D00000.VBN Infected: Trojan-Downloader.JS.Agent.bkr 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D00002.VBN Infected: Trojan-Downloader.JS.Agent.bkr 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\038C0000.VBN Infected: Trojan.Win32.Patched.af 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05B00000.VBN Infected: Trojan.Win32.Agent.bsg 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05B00001.VBN Infected: Trojan.Win32.Agent.bsg 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07D80000.VBN Infected: Backdoor.Win32.Agent.dbo 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09280000\4FEF2B9F.VBN Infected: Trojan.Win32.Patched.af 1 F:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AD80000.VBN Infected: Trojan.Win32.Obfuscated.jw 1 F:\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\6.0\17\3e448391-4e2953c3 Infected: Exploit.Java.ByteVerify 1 F:\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\animan.class-4bb611a9-2087d894.class Infected: Exploit.Java.ByteVerify 1 F:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Flops\flops.zip Infected: Constructor.Win32.MS04-032.e 1 F:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip Infected: Trojan.Win32.Genome.cnpu 1 F:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip Infected: Trojan.Win32.Genome.cnpu 1 M:\Files\Games\SimCity.rar Infected: Trojan-Dropper.Win32.Small.bf 1 M:\BACKUP\GDiVX1.9.9.6.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bx 1 M:\BACKUP\GDiVX1.9.9.6.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.d 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D00000.VBN Infected: Trojan-Downloader.JS.Agent.bkr 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D00002.VBN Infected: Trojan-Downloader.JS.Agent.bkr 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\038C0000.VBN Infected: Trojan.Win32.Patched.af 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05B00000.VBN Infected: Trojan.Win32.Agent.bsg 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05B00001.VBN Infected: Trojan.Win32.Agent.bsg 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07D80000.VBN Infected: Backdoor.Win32.Agent.dbo 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09280000\4FEF2B9F.VBN Infected: Trojan.Win32.Patched.af 1 P:\backup\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AD80000.VBN Infected: Trojan.Win32.Obfuscated.jw 1 P:\backup\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\6.0\17\3e448391-4e2953c3 Infected: Exploit.Java.ByteVerify 1 P:\backup\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\animan.class-4bb611a9-2087d894.class Infected: Exploit.Java.ByteVerify 1 P:\backup\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Flops\flops.zip Infected: Constructor.Win32.MS04-032.e 1 P:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip Infected: Trojan.Win32.Genome.cnpu 1 P:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip Infected: Trojan.Win32.Genome.cnpu 1 Selected area has been scanned. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=7.00.6000.16735 (vista_gdr.080820-1506) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=bd7611bab92c71459b9809e1749567ff # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-05-18 09:33:29 # local_time=2010-05-18 05:33:29 (-0500, Eastern Daylight Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=509704 # found=10 # cleaned=6 # scan_time=24138 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\_OTM\MovedFiles\05152010_052732\c_documents and settings\HelpAssistant\Local Settings\Temp\Av-test.txt Eicar test file cleaned by deleting - quarantined D:\Temporary folder\KA\NGA INSTALL\NGA Release 1[1].part01.rar a variant of Win32/Kryptik.BGE trojan deleted - quarantined F:\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\6.0\17\3e448391-4e2953c3 Java/TrojanDownloader.OpenStream.NAC trojan cleaned by deleting - quarantined F:\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\animan.class-4bb611a9-2087d894.class Java/TrojanDownloader.OpenStream.NAC trojan cleaned by deleting - quarantined F:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip a variant of Win32/Kryptik.AE trojan deleted F:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip a variant of Win32/Kryptik.AE trojan deleted F:\jars\Java Games\DigitalRed Shuffleboard v20\b-shuff2.zip probably a variant of Win32/Agent trojan deleted P:\backup\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\6.0\17\3e448391-4e2953c3 Java/TrojanDownloader.OpenStream.NAC trojan cleaned by deleting P:\backup\Documents and Settings\TheLeviathan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\animan.class-4bb611a9-2087d894.class Java/TrojanDownloader.OpenStream.NAC trojan cleaned by deleting

Rorschach112 View Member Profile	May 20 2010, 11:13 AM Post #13
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	Please download OTM Save it to your desktop. Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes :Services :Reg :Files D:\Games\ClashNSlash.rar D:\Temporary\GDiVX1.9.9.6.exe D:\Temporary\GDiVX1.9.9.6.exe P:\backup\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Flops\flops.zip P:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip P:\Documents and Settings\TheLeviathan\Desktop\Backup Drivers\Xvid\Xvid.zip :Commands [purity] [resethosts] [emptytemp] [CREATERESTOREPOINT] [EMPTYFLASH] [Reboot] Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTM and reboot your PC. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. Please download Dr.Web CureIt . Save it to your desktop: Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan. This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, select Complete scan. Click the green arrow at the right, and the scan will start. Click Yes to all if it asks if you want to cure/move the file. When the scan has finished, in the menu, click File and choose Save report list Save the report to your desktop. The report will be called DrWeb.csv Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum. Please post the Dr.Web.txt report in your next reply Close Dr.Web Cureit. Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot. NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner. also tell me how its running -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

Rorschach112 View Member Profile	May 24 2010, 02:01 PM Post #14
Advanced Member Group: Global Moderator Posts: 4,604 Joined: 17-September 07 Member No.: 3,506	Due to lack of feedback, this topic has been closed. If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic. Thank You ! -------------------- By the power of truth, I, while living, have conquered the universe. ~Scratch~ My help is always free, but if you want to donate to help me continue my fight against malware then click here

Extremeboy View Member Profile	May 25 2010, 01:57 AM Post #15
Advanced Member Group: Global Moderator Posts: 188 Joined: 18-June 09 Member No.: 8,211	Re-opened. Logs posted here in different topic: http://www.atribune.org/forums/index.php?showtopic=6047 Back to you. -------------------- If I'm helping you and I don't reply within 48 hours please feel free to send me a PM. Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED! Visit my Blog and Follow along! The help you receive here is always free but if you wish to show your appreciation, you may wish to

« Next Oldest · HijackThis and Malware Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 6th September 2010 - 04:27 PM