Problems with Win32/Z bot G in the system Volume Information Directory please help

Solved
By Rich108
Feb 7, 2011
Topic Status:
Not open for further replies.
  1. Can anybody advise me how to resolve the issues am having with my computer. I have the aforementioned problems in my avg(30 day trial)virus vault, I am unsure of whether that means it is safe to use my pc as normal or whether i need to reformat my drives to ensure that i get rid of the viruses on my pc I have followed the 8 steps as advised on the board but am having problems updating my service pack from 2 to 3. I also have Hitman pro 3.5 (30 day trial), Super anti spyware, Ad- Aware and MalwareBytes on my pc they are all coming up clear when I run scans with them but I know that probably doesn't mean the issue is resolved if anybody can look at the logs that are requested in the 8 steps and advise me of any action I need to take I would be extremely grateful. Do you want me to paste all the logs in one thread or one log at a time ?

    Thanks
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    [​IMG]
    (Image courtesy animationplayhouse.com)

    Welcome to TechSpot!
    If you would like us to check the system for malware, please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

    Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.

    Note please: System Volume is where the Restore Points are held. If malware is only in a restore point, it is not active in the system. But if you do a System Restore and pick an infected restore point, you could reinfect the system.

    At the end of cleaning, we have you set a new, clean restore point, then drop the old ones. We do not advise dropping restore points before the system is clean. There are times when the only way into a system is through system Restore.

    I strongly recommend that you remove this: Hitman pro 3.5 (30 day trial), This is a bundle of programs that are all free on the internet- some being used without the author's permission. Hitman does not allow you to remove anything that's found after the trial, unless you pay to do it. But if you used any of the free programs, you would have full function.
  3. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Thanks

    Thanks for ur help here are the logs, I will get rid of Hitman pro 3.5 but it hlped me get rid of tkjvrup.exe, msmsgs.exe, ssleay32.dll, libexpatw.dll and bspatch.exe when neither of the other programs on my system where reporting anything back and my pc was in a bad way



    Malwarebytes' Anti-Malware 1.50.1.110
    www.malwarebytes.org

    Database version: 5671

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    2/7/2011 5:30:29 PM
    mbam-log-2011-02-07 (17-30-29).txt

    Scan type: Quick scan
    Objects scanned: 149443
    Time elapsed: 16 minute(s), 12 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-02-07 15:17:09
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST380011A rev.8.01
    Running: rwh0spwt.exe; Driver: C:\DOCUME~1\Richard\LOCALS~1\Temp\pxtdipow.sys


    ---- Devices - GMER 1.0.15 ----

    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
    Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

    AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

    ---- EOF - GMER 1.0.15 ----

    DS (Ver_10-12-12.02) - NTFSx86
    Run by Richard at 16:22:16.64 on Mon 02/07/2011
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.113 [GMT 0:00]

    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

    ============== Running Processes ===============

    C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Apps\Powercinema\PCMService.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\DivX\DivX Update\DivXUpdate.exe
    C:\Program Files\AVG\AVG10\avgtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\AVG\AVG10\avgwdsvc.exe
    C:\Documents and Settings\Richard\Local Settings\Application Data\Autobahn\autobahn.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
    C:\Program Files\AVG\AVG10\avgam.exe
    C:\Program Files\AVG\AVG10\avgnsx.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
    C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    C:\Program Files\AVG\AVG10\avgcsrvx.exe
    C:\Program Files\AVG\AVG10\avgcsrvx.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Documents and Settings\Richard\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
    uInternet Settings,ProxyOverride = *.local
    mWinlogon: Userinit=c:\windows\system32\userinit.exe
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - No File
    TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
    mRun: [VTTimer] VTTimer.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [PCMService] "c:\apps\powercinema\PCMService.exe"
    mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [HitmanPro35] "c:\program files\hitman pro 3.5\HitmanPro35.exe" /scan:boot
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    StartupFolder: c:\docume~1\richard\startm~1\programs\startup\autobahn.lnk - c:\documents and settings\richard\local settings\application data\autobahn\autobahn.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
    DPF: DigiChat Applet - hxxp://host19.digichat.com/DigiChat/DigiClasses/Client_IE.cab
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
    DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} - hxxps://signup.msn.com/pages/MsnInstC.cab
    DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1094347499875
    DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
    DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - hxxp://www.pandasoftware.com/activescan/as5/asinst.cab
    DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} - hxxps://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
    DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553534400} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
    DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://chat.msn.com/bin/msnchat45.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\richard\applic~1\mozilla\firefox\profiles\qjolvo62.default\
    FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\google\google updater\2.4.1908.5032\npCIDetect14.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\tvuplayer\npTVUAx.dll
    FF - plugin: c:\program files\veetle\player\npvlc.dll
    FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
    FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg10\Firefox

    ============= SERVICES / DRIVERS ===============

    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-2-2 64288]
    R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2010-10-3 59240]
    R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2004-7-28 11264]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 251728]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 299984]
    R1 RapportCerberus_19917;RapportCerberus_19917;c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportcerberus\19917\RapportCerberus_19917.sys [2010-10-3 34792]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-6 1402272]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2010-10-3 767208]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-3 123472]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-3 30288]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-3 26192]
    R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2010-2-3 27632]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-7 135664]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-17 15264]
    S3 NPF;Netgroup Packet Filter;c:\windows\system32\drivers\npf.sys [2008-8-14 42512]
    S3 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2010-10-3 169320]
    S3 RkHit;RkHit;\??\c:\windows\system32\drivers\rkhit.sys --> c:\windows\system32\drivers\RKHit.sys [?]
    S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [2004-8-30 72576]

    =============== Created Last 30 ================

    2011-02-06 18:42:59 -------- d-----w- c:\program files\CCleaner
    2011-02-04 16:45:09 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2011-02-04 16:45:04 -------- d-----w- c:\program files\Hitman Pro 3.5
    2011-02-04 16:44:21 -------- d-----w- c:\docume~1\alluse~1\applic~1\Hitman Pro
    2011-02-03 20:48:52 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-03 20:47:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-03 20:25:37 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
    2011-02-03 20:21:47 -------- d-----w- c:\windows\system32\drivers\nss\0300010.008
    2011-02-03 20:21:47 -------- d-----w- c:\windows\system32\drivers\NSS
    2011-02-03 20:21:47 -------- d-----w- c:\program files\Norton Security Scan
    2011-02-03 20:21:39 -------- d-----w- c:\program files\Ask.com
    2011-02-03 20:21:39 -------- d-----w- c:\docume~1\richard\locals~1\applic~1\AskToolbar
    2011-02-03 20:21:08 -------- d-----w- c:\program files\SopCast
    2011-02-02 17:10:39 -------- d-----w- c:\docume~1\richard\applic~1\Malwarebytes
    2011-02-02 17:09:59 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-02-02 17:09:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 20:15:38 -------- d-----w- c:\docume~1\richard\applic~1\SUPERAntiSpyware.com
    2011-02-01 20:11:35 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-01-31 17:03:52 -------- d--h--w- C:\$AVG
    2011-01-30 14:01:46 -------- d-----w- c:\docume~1\richard\applic~1\AVG
    2011-01-30 12:43:07 -------- d-----w- c:\docume~1\richard\applic~1\AVG10
    2011-01-30 12:36:42 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Common Files
    2011-01-30 12:30:42 -------- d-----w- c:\windows\system32\drivers\AVG
    2011-01-30 12:30:42 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVG10
    2011-01-30 12:29:28 -------- d-----w- c:\program files\AVG
    2011-01-30 12:24:35 -------- d-----w- c:\docume~1\alluse~1\applic~1\MFAData

    ==================== Find3M ====================

    2010-11-29 17:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 17:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-12 18:53:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-12 16:34:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2008-04-30 16:09:06 3187458 ----a-w- c:\program files\Setup-SopCast-3.0.3-2008-4-30.exe
    2006-07-08 21:28:17 37518744 ----a-w- c:\program files\iTunesSetup.exe

    ============= FINISH: 16:24:18.28 ===============

    NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 8/12/2004 1:22:20 PM
    System Uptime: 2/7/2011 3:02:07 PM (1 hours ago)

    Motherboard: NEC COMPUTERS INTERNATIONAL | | MS-6786
    Processor: AMD Athlon(tm) XP 3000+ | Socket A | 2158/166mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 71 GiB total, 41.71 GiB free.
    D: is CDROM ()
    E: is FIXED (NTFS) - 75 GiB total, 52.879 GiB free.
    G: is FIXED (NTFS) - 932 GiB total, 512.629 GiB free.

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP287: 2/5/2011 1:51:19 PM - System Checkpoint
    RP288: 2/7/2011 1:25:53 AM - System Checkpoint

    ==== Installed Programs ======================


    µTorrent
    Ad-Aware
    Adobe Acrobat 5.0
    Adobe AIR
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.4.1
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Autobahn
    AVG 2011
    AVG PC Tuneup 2011
    AviSynth 2.5
    Bonjour
    Camera RAW Plug-In for EPSON Creativity Suite
    CCleaner
    Disc2Phone
    DivX Converter
    DivX Plus DirectShow Filters
    DivX Setup
    DivX Version Checker
    DVD Shrink 3.2
    DVDx 2
    Ease Audio Converter 1.00
    eMusic - 50 Free MP3 offer
    EPSON-Drucker-Software
    EPSON Easy Photo Print
    EPSON File Manager
    EPSON Print CD
    EPSON PRINT Image Framer Tool
    EPSON Scan Assistant
    EPSON Web-To-Page
    Express Burn Uninstall
    Express Rip Uninstall
    Google Chrome
    Google Update Helper
    Google Updater
    Google Video Player
    GSpot Codec Information Appliance
    Handbrake
    Hard Disk Sentinel PRO
    Hitman Pro 3.5
    Hotfix for Windows Internet Explorer 7 (KB947864)
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 23
    Java(TM) 6 Update 4
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Joost (tm) Beta 1.0.3
    K-Meleon 1.5.4 en-US (remove only)
    MakeTorrent v2.0
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Works 7.0
    MobileMe Control Panel
    Mozilla Firefox (3.6.13)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    Music Visualizer Library 1.4.00
    OpenMG Secure Module 4.3.00
    Packard Bell Companion
    PeerGuardian 2.0
    PPMate Network TV 2.3.2.0
    PPStream V2.6.86.8972 Final
    QuickTime
    Rapport
    RealPlayer
    RegCure 1.5.0.1
    Rockstar Custom Tracks 1.0
    ScanToWeb
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Sonic RecordNow!
    SopCast 3.3.2
    Soulseek Client 152
    SoulSeek Client 156c
    SUPERAntiSpyware
    TVUPlayer 2.5.3.1
    VC80CRTRedist - 8.0.50727.4053
    Veetle TV 0.9.18
    VIA Rhine-Family Fast Ethernet Adapter
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 1.1.7
    VobSub v2.23 (Remove Only)
    VoiceOver Kit
    WebFldrs XP
    WildTangent Web Driver
    Winamp
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 2
    XviD MPEG-4 Codec

    ==== Event Viewer Messages From Past Week ========

    2/7/2011 1:46:26 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    2/7/2011 1:46:22 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    2/7/2011 1:46:22 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    2/7/2011 1:46:21 PM, error: Service Control Manager [7034] - The Rapport Management Service service terminated unexpectedly. It has done this 1 time(s).
    2/7/2011 1:46:21 PM, error: Service Control Manager [7034] - The AOL Connectivity Service service terminated unexpectedly. It has done this 1 time(s).
    2/7/2011 1:46:21 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    2/6/2011 6:48:56 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    2/6/2011 6:48:15 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 ASPI32 Avgldx86 Avgmfx86 Avgtdix Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL Tcpip
    2/6/2011 6:48:15 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2011 6:48:15 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2011 6:48:15 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2011 6:48:15 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2011 6:48:15 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2011 6:48:15 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/4/2011 7:58:51 AM, error: Service Control Manager [7034] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 3 time(s).
    2/4/2011 7:22:17 AM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    2/4/2011 7:18:34 PM, error: Service Control Manager [7024] - The Hitman Pro 3.5 Crusader (Boot) service terminated with service-specific error 0 (0x0).
    2/4/2011 6:02:47 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the VJVodClientServices service to connect.
    2/4/2011 6:02:47 AM, error: Service Control Manager [7000] - The VJVodClientServices service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/3/2011 7:09:01 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The system cannot find the file specified.
    2/3/2011 6:15:47 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 ASPI32 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x PCIIde perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp
    2/1/2011 7:28:56 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    2/1/2011 7:16:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 ASPI32 Avgldx86 Avgmfx86 Fips
    2/1/2011 12:09:08 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the avgwd service.
    2/1/2011 12:03:23 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    2/1/2011 12:02:46 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Lavasoft Ad-Aware Service service to connect.
    2/1/2011 12:02:46 PM, error: Service Control Manager [7000] - The Lavasoft Ad-Aware Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/1/2011 1:17:08 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\windows media player\wmpband.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 10.0.0.3646.
    1/31/2011 8:33:00 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file wmpband.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 10.0.0.3646.
    1/31/2011 8:33:00 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file npdsplay.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 3.0.2.628.
    1/31/2011 8:32:51 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\windows media player\wmplayer.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 11.0.5721.5145.
    1/31/2011 8:32:46 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\windows media player\setup_wm.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 11.0.5721.5146.
    1/31/2011 8:32:36 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\windows media player\mpvis.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 11.0.5721.5145.
    1/31/2011 8:32:33 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\windows media player\migrate.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 10.0.0.3646.
    1/31/2011 8:13:44 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\outlook express\wabimp.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.3138.
    1/31/2011 8:13:32 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\outlook express\msoe.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.3138.
    1/31/2011 7:43:40 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\internet explorer\iedw.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 7.0.5730.11.
    1/31/2011 7:43:36 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\internet explorer\hmmapi.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 8.0.6001.18702.
    1/31/2011 7:03:29 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\wab32.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.3138.
    1/31/2011 7:02:38 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file msadco.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 2.81.1117.0.
    1/31/2011 7:02:15 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\msadc\msadce.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 2.81.1135.0.
    1/31/2011 7:02:12 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\directdb.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.3138.
    1/31/2011 7:02:09 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\ado\msjro.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 2.81.1128.0.
    1/31/2011 7:02:07 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\ado\msadox.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 2.81.1128.0.
    1/31/2011 7:02:02 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\ado\msadomd.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 2.81.1128.0.
    1/31/2011 7:02:00 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\system\ado\msado15.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 2.81.1128.0.
    1/31/2011 6:49:26 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\common files\microsoft shared\vgx\vgx.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 8.0.6001.18702.
    1/31/2011 5:03:26 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ASPI32
    1/31/2011 5:03:26 PM, error: Service Control Manager [7022] - The AVGIDSAgent service hung on starting.
    1/31/2011 5:00:19 PM, error: Dhcp [1002] - The IP address lease 94.175.87.31 for the Network Card with network address 0011093C3649 has been denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Please uninstall the following:
    Hitman Pro 3.5
    Java(TM) 6 Update 4
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    µTorrent
    MakeTorrent v2.0

    ====================================
    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Re-enable your Antivirus software.
    10. A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
    ======================================
    Download Combofix to your desktop from one of these locations:
    Link 1
    Link 2
    • Double click combofix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Query- Recovery Console image
      [​IMG]
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes it will open a text window. Please paste that log in your next reply.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
  5. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Problems with the old Java updates

    I have uninstalled utorrent, hitman pro 3.5 and make torrent , JavaRa has got rid of all the old Java updates you requested but updates 5 and 7 are still listed in add/remove programs which is puzzling me because in the logfile after JavaRa has completed it states that it has removed

    Found and removed: C:\Program Files\Java\jre1.6.0_04

    Found and removed: C:\Program Files\Java\jre1.6.0_05

    Found and removed: C:\Program Files\Java\jre1.6.0_07

    Didnt want to put the whole log file in here as it wasnt requested but am confused why it would say that and the add/remove programs only had update 7 removed the system ddi encounter a problem before JavaRa concluded its program but when i try to run it again it says there arent any more old updates to remove so will presume that add/remove programs is lying and proceed with the rest of your advice I can post the full log of JavaRa if you want but didnt want to irriate you with unnecessary information.
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Go to the Control Panel> Add/Remove Programs> Uninstall any version of Java except v6u23. If any entries are left over, I can remove them with script after you run Combofix.

    Be sure to reboot the computer after you finish. Please go on with Combofix and the Eset scans.
  7. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Combofix will not run with AVG on the computer on it but am having problems removing it.its wont let me remove it in add/remove programs. I downloaded a program called Revo Uninstaller Pro which gets rid of it within its program but there is still an entity in Control Panel Add/Remove Programs although the remove option has disappeared. When I run ComboFix it still thinks AVG is present and wont run do you have any idea of what can use to properly get rid of it ?

    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6419
    # api_version=3.0.2
    # EOSSerial=c36aca40b61f1043b2edb3b84f30be4c
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2011-02-09 04:50:52
    # local_time=2011-02-09 04:50:52 (+0000, GMT Standard Time)
    # country="United States"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 2
    # compatibility_mode=1032 16777213 100 95 756743 40557668 0 0
    # compatibility_mode=3584 16777215 100 0 0 0 0 0
    # compatibility_mode=8192 67108863 100 0 4008 4008 0 0
    # scanned=87033
    # found=2
    # cleaned=0
    # scan_time=2977
    C:\RECYCLER\S-1-5-21-1495889697-3474788689-3807336589-1009\Dc3.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP287\A0135189.exe multiple threats (unable to clean) 00000000000000000000000000000000 I
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Going to have to write myself a note to remember to tell this to AVG users:

    Download AppRemover and save to the desktop]
    How to Use AppRemover to Remove a Complete Security Application
    1. Double click the setup on the desktop> click Next
    2. Select “Remove Security Application”
    3. Let scan finish to determine security apps
    4. A screen like below will appear:
      http://www.appremover.com/about/chooseuninstall.gif/image_preview[/img[*] Click on [b]Next[/b] after choice has been made
      [*] Check the AVG program you want to uninstall
      [*] After uninstall shows complete, follow online prompts to Exit the program.[/list]

      [b][u]How to Use AppRemover to Clean Up a Failed Uninstall[/b][/u] [list=1]
      [*] Return to Step 1 above
      [*] Check [b]Clean Up Failed Uninstall> Click [b]Next[/b]
      [*] Allow program to rescan for the security program failed the uninstall
      [*] Carefully Choose which application to uninstall> Next
      [*] Follow prompts to close and Exit. [/list].
  9. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Found a avg removal.exe on avgs site to get rid of it at long last here is the Combofix log

    ((((((((((((((((((((((((( Files Created from 2011-01-09 to 2011-02-09 )))))))))))))))))))))))))))))))
    .

    2011-02-09 22:14 . 2011-02-09 22:14 -------- d-----w- c:\program files\Perfect Uninstaller
    2011-02-09 17:45 . 2011-02-09 17:45 -------- d-----w- c:\documents and settings\Richard\Local Settings\Application Data\VS Revo Group
    2011-02-09 17:44 . 2009-12-30 11:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
    2011-02-09 17:44 . 2011-02-09 17:44 -------- d-----w- c:\program files\VS Revo Group
    2011-02-09 15:54 . 2011-02-09 15:54 -------- d-----w- c:\program files\ESET
    2011-02-06 18:42 . 2011-02-06 18:43 -------- d-----w- c:\program files\CCleaner
    2011-02-04 16:45 . 2011-02-09 10:59 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2011-02-04 16:45 . 2011-02-04 16:45 -------- d-----w- c:\program files\Hitman Pro 3.5
    2011-02-04 16:44 . 2011-02-04 19:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
    2011-02-03 20:48 . 2010-12-20 18:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-03 20:47 . 2010-12-20 18:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-03 20:25 . 2011-02-03 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2011-02-03 20:21 . 2011-02-03 20:21 -------- d-----w- c:\windows\system32\drivers\NSS
    2011-02-03 20:21 . 2011-02-03 20:21 -------- d-----w- c:\program files\Norton Security Scan
    2011-02-03 20:21 . 2011-02-03 20:21 -------- d-----w- c:\program files\Ask.com
    2011-02-03 20:21 . 2011-02-03 20:21 -------- d-----w- c:\documents and settings\Richard\Local Settings\Application Data\AskToolbar
    2011-02-03 20:21 . 2011-02-05 14:54 -------- d-----w- c:\program files\SopCast
    2011-02-02 17:10 . 2011-02-02 17:10 -------- d-----w- c:\documents and settings\Richard\Application Data\Malwarebytes
    2011-02-02 17:09 . 2011-02-02 17:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-02-02 17:09 . 2011-02-03 20:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 20:15 . 2011-02-01 20:15 -------- d-----w- c:\documents and settings\Richard\Application Data\SUPERAntiSpyware.com
    2011-02-01 20:11 . 2011-02-06 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-02-01 19:28 . 2011-02-01 19:28 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-01-31 17:03 . 2011-01-31 17:03 -------- d-----w- C:\$AVG
    2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
    2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2011-01-30 12:43 . 2011-01-30 12:43 -------- d-----w- c:\documents and settings\Richard\Application Data\AVG10
    2011-01-30 12:36 . 2011-01-30 12:36 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
    2011-01-30 12:29 . 2011-01-30 13:59 -------- d-----w- c:\program files\AVG
    2011-01-30 12:24 . 2011-01-30 12:29 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-29 17:38 . 2010-11-29 17:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 17:38 . 2010-11-29 17:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-12 18:53 . 2010-04-21 17:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-12 16:34 . 2010-12-23 15:44 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2008-04-30 16:09 . 2008-07-26 17:04 3187458 ----a-w- c:\program files\Setup-SopCast-3.0.3-2008-4-30.exe
    2006-07-08 21:28 . 2006-07-08 21:28 37518744 ----a-w- c:\program files\iTunesSetup.exe
    2008-06-30 12:44 . 2008-07-31 20:05 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
    .

    ------- Sigcheck -------

    [7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys
    [-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys
    [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [7] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
    [7] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
    [7] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
    [7] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
    [7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
    [-] 2002-08-29 . 244A2F9816BC9B593957281EF577D976 . 332928 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-01-13 2424560]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer"="VTTimer.exe" [2004-03-26 49152]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-26 65024]
    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-01-30 81920]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-02-11 198160]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

    c:\documents and settings\Richard\Start Menu\Programs\Startup\
    autobahn.lnk - c:\documents and settings\Richard\Local Settings\Application Data\Autobahn\autobahn.exe [2009-4-2 710360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SPTISRV"=3 (0x3)
    "PACSPTISVR"=3 (0x3)
    "MSCSPTISRV"=3 (0x3)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
    "c:\\Program Files\\PPStream\\PPStream.exe"=
    "c:\\Program Files\\PPStream\\PPSAP.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/2/2010 7:10 PM 64288]
    R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [10/3/2010 10:43 PM 59240]
    R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [7/28/2004 7:30 AM 11264]
    R1 RapportCerberus_19917;RapportCerberus_19917;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [10/3/2010 10:54 PM 34792]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 6:25 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 6:41 PM 67656]
    R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2/3/2010 6:52 AM 27632]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/17/2010 5:33 AM 15264]
    S3 RapportIaso;RapportIaso;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\21923\RapportIaso.sys [1/5/2011 10:43 AM 12928]
    S3 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [10/3/2010 10:43 PM 169320]
    S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2/9/2011 5:44 PM 27064]
    S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [8/30/2004 10:31 AM 72576]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    vvdsvc REG_MULTI_SZ vvdsvc
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-06 20:03]

    2011-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]

    2011-02-09 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-02 10:15]

    2011-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-07 18:50]

    2011-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-07 18:50]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    DPF: DigiChat Applet - hxxp://host19.digichat.com/DigiChat/DigiClasses/Client_IE.cab
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
    FF - ProfilePath - c:\documents and settings\Richard\Application Data\Mozilla\Firefox\Profiles\qjolvo62.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    AddRemove-InstallShield_{F5E4C38C-73BC-4D44-8BFC-969C2B4DABCA} - c:\progra~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe
    AddRemove-Packard Bell Companion - c:\progra~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-09 23:01
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(640)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    - - - - - - - > 'explorer.exe'(2184)
    c:\program files\Trusteer\Rapport\bin\rooksbas.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe
    c:\program files\Lavasoft\Ad-Aware\AAWService.exe
    c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\windows\system32\VTTimer.exe
    c:\windows\SOUNDMAN.EXE
    c:\windows\System32\wbem\unsecapp.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Trusteer\Rapport\bin\RapportService.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\system32\msiexec.exe
    c:\windows\system32\MsiExec.exe
    c:\windows\system32\MsiExec.exe
    c:\windows\system32\MsiExec.exe
    c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
    .
    **************************************************************************
    .
    Completion time: 2011-02-09 23:13:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-02-09 23:13

    Pre-Run: 42,058,354,688 bytes free
    Post-Run: 41,913,716,736 bytes free

    - - End Of File - - 8F50C62058F23518021CAB6555223583
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Rich, there is a heading at the top of the Comofix log> please paste that in for me. There is information there I need.

    Regarding these entries in Eset: Neither is active in the system now. System Volume is the restore Point. I will have you drop the old restore points when we finish.

    C:\RECYCLER\S-1-5-21-1495889697-3474788689-3807336589-1009\Dc3.exe Win32/RegistryBooster application (unable to clean)
    C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP287\A0135189.exe multiple threats (unable to clean) [/b]

    For the Recycler> this is where the Recycle Bin sends the deleted files and folders. It is a hidden file, so we must show those files. The other condition is that the Recycle Bin must be empty or files in the Recycler can't be emptied:

    Right click on Start> Explore> Tools> Folder Options> View ta> Check 'show hidden files and folders'> Uncheck 'hide protected system files (Recommended)> answer yes when asked to confirm.

    Make sure the Recycle Bin is empty> Click on the Recycler> Look for the SID S-1-5-21-1495889697-3474788689-3807336589-1009 on the right screen> Click on it to highlight> Delete> Exit Explorer.
    Please go back to Folder Options> View tab> Check 'don't show hidden files and folders'> Check 'Hide protected system files-(Recommended)> Apply> OK> Exit.
    ==============================================
    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    KillAll::
    File::
    c:\windows\system32\drivers\hitmanpro35.sys
    FileLook::
    c:\windows\system32\msiexec.exe
    c:\windows\system32\MsiExec.exe
    c:\windows\system32\MsiExec.exe
    c:\windows\system32\MsiExec.exe
    Folder::
    c:\program files\Hitman Pro 3.5
    c:\documents and settings\All Users\Application Data\Hitman Pro
    c:\program files\Ask.com
    c:\documents and settings\Richard\Local Settings\Application Data\AskToolbar
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=-
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ========================================
    Remove outdated Java plugin files from the Firefox plugins folder:
    Note: It is recommended that you do not copy Java plugins from other locations to the Firefox plugins folder. Outdated Java plugins can cause Java not to work if you update Java and then uninstall the older Java version, if plugins from the old Java version are still in the Firefox plugins folder.
    1. Open Firefox> Tools> Add-ons. The Add-ons window will open.
    2. In the Add-ons window> select the Plugins panel, to display a list of installed plugins.
    3. Select each Java plugin listed to make sure that all are enabled.
    4. Check if the Java plugins are correctly detected. All Java plugins listed in the Add-ons window should match the version number of the currently installed JRE. There should be no plugins for earlier versions of Java.
    5. Java plugin files that do not match your current version means that the Firefox plugins folder contains outdated Java plugin files which should be removed> there are 12 old versions, 5-22. This folder is typically in the following location: Use Windows Explorer to access> My Computer> Local Drive> Programs>>>
    C:\Program Files\Mozilla Firefox\plugins
    Java files from older versions in the Firefox plugins folder can prevent Java from runing well.
  11. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    the rest of Combofix log

    When I try to follow the instructions regarding deleting the file S-1-5-21-1495889697-3474788689-3807336589-1009 from the hidden Recycler folder it wont let me delete the reason given being it is being used by another program or person. When i try to turn the read only option off in the properties of the file it will still not let me delete the file with the same reason cited before shown. Do you have any idea of what else can do to resolve this issue. I am not sure whether to carry on with the rest of the instructions unless this is remedied so wont start that unless Instructed.


    ComboFix 11-02-09.02 - Richard 02/09/2011 22:50:28.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.128 [GMT 0:00]
    Running from: c:\documents and settings\Richard\Desktop\ComboFix.exe
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    c:\documents and settings\Richard\Application Data\.#
    c:\documents and settings\Richard\Application Data\.#\MBX@3F8@B241E8.###
    c:\documents and settings\Richard\Application Data\.#\MBX@3F8@B24218.###
    c:\documents and settings\Richard\Application Data\.#\MBX@3F8@B24248.###
    c:\documents and settings\Richard\Application Data\.#\MBX@A50@B241E8.###
    c:\documents and settings\Richard\Application Data\.#\MBX@A50@B24218.###
    c:\documents and settings\Richard\Application Data\.#\MBX@A50@B24248.###
    c:\documents and settings\Richard\Local Settings\Application Data\woaawmc.dat
    c:\documents and settings\Richard\Local Settings\Application Data\woaawmc_navup.dat
    c:\program files\Internet Explorer\dmlconf.dat
    C:\test.txt
    c:\windows\struct~.ini
    c:\windows\system32\42KJE738.ocx
    c:\windows\system32\drivers\npf.sys
    c:\windows\system32\Packet.dll
    c:\windows\system32\wpcap.dll

    ----- BITS: Possible infected sites -----

    hxxp://updates.swarmcast.net
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_NPF
    -------\Legacy_RKHIT
    -------\Service_NPF
    -------\Service_RkHit
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    That is a significant amount! Not only the header bit in the deletions.

    I noticed you had the SopCast> a P2P internet TV Player program installed. SoP is the abbreviation for Streaming over P2P. . And I also note that Combofix is warning about possibly infected site at swarmcast which is similar. So be aware of the following:
    P2P or 'file sharing' Warning:
    Note: Even if you are using a "safe" P2P program, it is only the program that is safe.
    • As long as you are using file sharing networks and programs which are from sources that are not documented, you cannot verity that a download is legitimate.
    • Malware writers use these program to include malicious content.
    • File sharing is usually unmonitored and there is a danger that your private files might be accessed.
    • The 'sharing' also includes malware that the shared system has on it.
    • Files that are illegal can be spread through file sharing.

    Please read the information on P2P Warning to help you better understand these dangers.
    =============================================
    Please go ahead and run the script I left in Combofix.
  13. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Sorry about missing that much of the log out last night I was rushing because I work early in the mornings and I was trying to get to my bed I will heed what you said about P2P programs and will run the Script just now thanks
     
  14. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    new combofix log

    ComboFix 11-02-09.05 - Richard 02/10/2011 16:07:52.2.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.150 [GMT 0:00]
    Running from: c:\documents and settings\Richard\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Richard\Desktop\CFScript.txt
    AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

    FILE ::
    "c:\windows\system32\drivers\hitmanpro35.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\Hitman Pro
    c:\documents and settings\All Users\Application Data\Hitman Pro\Banner.bin
    c:\documents and settings\All Users\Application Data\Hitman Pro\HitmanPro.key
    c:\documents and settings\All Users\Application Data\Hitman Pro\HitmanPro.lic
    c:\documents and settings\Richard\Local Settings\Application Data\AskToolbar
    c:\program files\Ask.com
    c:\program files\Ask.com\GenericAskToolbar.dll
    c:\program files\Ask.com\SaUpdate.exe
    c:\program files\Ask.com\UpdateTask.exe
    c:\program files\Hitman Pro 3.5
    c:\program files\Hitman Pro 3.5\HitmanPro35.exe
    c:\windows\system32\drivers\hitmanpro35.sys

    .
    ((((((((((((((((((((((((( Files Created from 2011-01-10 to 2011-02-10 )))))))))))))))))))))))))))))))
    .

    2011-02-09 23:32 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2011-02-09 23:32 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2011-02-09 23:32 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2011-02-09 23:32 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2011-02-09 23:32 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2011-02-09 23:32 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2011-02-09 23:32 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2011-02-09 23:31 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
    2011-02-09 23:31 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
    2011-02-09 23:31 . 2011-02-09 23:31 -------- d-----w- c:\program files\Alwil Software
    2011-02-09 23:31 . 2011-02-09 23:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2011-02-09 22:14 . 2011-02-09 22:14 -------- d-----w- c:\program files\Perfect Uninstaller
    2011-02-09 17:45 . 2011-02-09 17:45 -------- d-----w- c:\documents and settings\Richard\Local Settings\Application Data\VS Revo Group
    2011-02-09 17:44 . 2009-12-30 11:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
    2011-02-09 17:44 . 2011-02-09 17:44 -------- d-----w- c:\program files\VS Revo Group
    2011-02-09 15:54 . 2011-02-09 15:54 -------- d-----w- c:\program files\ESET
    2011-02-06 18:42 . 2011-02-06 18:43 -------- d-----w- c:\program files\CCleaner
    2011-02-03 20:48 . 2010-12-20 18:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-03 20:47 . 2010-12-20 18:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-03 20:25 . 2011-02-03 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2011-02-03 20:21 . 2011-02-03 20:21 -------- d-----w- c:\windows\system32\drivers\NSS
    2011-02-03 20:21 . 2011-02-03 20:21 -------- d-----w- c:\program files\Norton Security Scan
    2011-02-03 20:21 . 2011-02-05 14:54 -------- d-----w- c:\program files\SopCast
    2011-02-02 17:10 . 2011-02-02 17:10 -------- d-----w- c:\documents and settings\Richard\Application Data\Malwarebytes
    2011-02-02 17:09 . 2011-02-02 17:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-02-02 17:09 . 2011-02-03 20:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 20:15 . 2011-02-01 20:15 -------- d-----w- c:\documents and settings\Richard\Application Data\SUPERAntiSpyware.com
    2011-02-01 20:11 . 2011-02-06 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-02-01 19:28 . 2011-02-01 19:28 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-01-31 17:03 . 2011-01-31 17:03 -------- d-----w- C:\$AVG
    2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
    2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2011-01-30 12:43 . 2011-01-30 12:43 -------- d-----w- c:\documents and settings\Richard\Application Data\AVG10
    2011-01-30 12:36 . 2011-01-30 12:36 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
    2011-01-30 12:29 . 2011-01-30 13:59 -------- d-----w- c:\program files\AVG
    2011-01-30 12:24 . 2011-01-30 12:29 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-29 17:38 . 2010-11-29 17:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 17:38 . 2010-11-29 17:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-12 18:53 . 2010-04-21 17:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-12 16:34 . 2010-12-23 15:44 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2008-04-30 16:09 . 2008-07-26 17:04 3187458 ----a-w- c:\program files\Setup-SopCast-3.0.3-2008-4-30.exe
    2006-07-08 21:28 . 2006-07-08 21:28 37518744 ----a-w- c:\program files\iTunesSetup.exe
    2008-06-30 12:44 . 2008-07-31 20:05 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
    .

    (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    --- c:\windows\system32\MsiExec.exe ---
    Company: Microsoft Corporation
    File Description: Windows® installer
    File Version: 3.1.4000.1823
    Product Name: Windows Installer - Unicode
    Copyright: © Microsoft Corporation. All rights reserved.
    Original Filename: msiexec.exe
    File size: 78848
    Created time: 2002-09-19 19:26
    Modified time: 2005-03-21 14:00
    MD5: F5F0146580E7023ADB963879840777F8
    SHA1: 4030C8BBCB8F146A1D8BA0FF2357BE6575E48199


    ------- Sigcheck -------

    [7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys
    [-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys
    [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [7] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
    [7] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
    [7] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
    [7] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
    [7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
    [-] 2002-08-29 . 244A2F9816BC9B593957281EF577D976 . 332928 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-01-13 2424560]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer"="VTTimer.exe" [2004-03-26 49152]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-26 65024]
    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-01-30 81920]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-02-11 198160]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
    "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

    c:\documents and settings\Richard\Start Menu\Programs\Startup\
    autobahn.lnk - c:\documents and settings\Richard\Local Settings\Application Data\Autobahn\autobahn.exe [2009-4-2 710360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SPTISRV"=3 (0x3)
    "PACSPTISVR"=3 (0x3)
    "MSCSPTISRV"=3 (0x3)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
    "c:\\Program Files\\PPStream\\PPStream.exe"=
    "c:\\Program Files\\PPStream\\PPSAP.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/2/2010 7:10 PM 64288]
    R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [10/3/2010 10:43 PM 59240]
    R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [7/28/2004 7:30 AM 11264]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2/9/2011 11:32 PM 294608]
    R1 RapportCerberus_19917;RapportCerberus_19917;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [10/3/2010 10:54 PM 34792]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 6:25 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 6:41 PM 67656]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/9/2011 11:32 PM 17744]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/6/2010 5:28 PM 1402272]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [10/3/2010 10:43 PM 767208]
    R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2/3/2010 6:52 AM 27632]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/7/2010 6:50 PM 135664]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/17/2010 5:33 AM 15264]
    S3 RapportIaso;RapportIaso;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\21923\RapportIaso.sys [1/5/2011 10:43 AM 12928]
    S3 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [10/3/2010 10:43 PM 169320]
    S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2/9/2011 5:44 PM 27064]
    S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [8/30/2004 10:31 AM 72576]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    vvdsvc REG_MULTI_SZ vvdsvc
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-06 20:03]

    2011-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]

    2011-02-10 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-02 10:15]

    2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-07 18:50]

    2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-07 18:50]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    DPF: DigiChat Applet - hxxp://host19.digichat.com/DigiChat/DigiClasses/Client_IE.cab
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
    FF - ProfilePath - c:\documents and settings\Richard\Application Data\Mozilla\Firefox\Profiles\qjolvo62.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-10 16:27
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(656)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    - - - - - - - > 'explorer.exe'(3960)
    c:\program files\Trusteer\Rapport\bin\rooksbas.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Alwil Software\Avast5\AvastSvc.exe
    c:\windows\system32\VTTimer.exe
    c:\windows\SOUNDMAN.EXE
    c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\System32\wbem\unsecapp.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Trusteer\Rapport\bin\RapportService.exe
    c:\windows\system32\msiexec.exe
    c:\windows\system32\MsiExec.exe
    c:\windows\system32\MsiExec.exe
    c:\windows\system32\MsiExec.exe
    c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
    .
    **************************************************************************
    .
    Completion time: 2011-02-10 16:43:11 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-02-10 16:43
    ComboFix2.txt 2011-02-09 23:13

    Pre-Run: 41,546,014,720 bytes free
    Post-Run: 41,523,363,840 bytes free

    - - End Of File - - A033F293D5E9871CAC477AA212EB5350



    In the plug-ins section of firefox Java Deployment Toolkit 6.0.230.5 is the only Java item listed
  15. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Nothing will be hurt while that file remains in the Recycler. Did you remember to empty the recycle bin first?

    Are you going back to AVG when we're finished? Right now you have Avast running, an AVG directory and Norton Security Scan. That is 2 too many V. Let me know so I can remove the remnants of those you don't want.
  16. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    I put on Avast on it temporarily so that Combofix and it could co exist together without having to uninstall it every time I needed to run Combofix to resolve the problems, Do you have any recommendations Anti Virus wise, I had Norton on the machine when my friend gave me it, A lot of my other friends where going on about how useless Norton was and how it used up too many system resources and in my own experience it wasnt that good for detecting trojans etc. People where raving on about AVG being better but the amount of hassle I had removing it to run Combofix is making me think it maybe it isnt the one for me but that may have just been my lack of knowledge of the process of removing hard to remove software. Do you think AVG is any good or should i stick with Avast (registered purchase rather than free edition). I followed your exact instructions about the Recycler file but still no joy, the recycle bin is currently empty has been since ran tfc at the start of the 8 steps process

    I realise that my question is better suited to the software forum I will just stick with Avast for the moment thanks for your help
  17. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Either Avast or Avira are good and both free. I am not a fan of Norton. AVG was good until it got to v8, then it went downhill. Most of the AVG scans I see have mostly Tracking Cookies, little else. And even users in AVG forums are complaining about the problem of not being able to disable it for scans and having to uninstall it instead!

    Let me know so I can include entries for AV programs you don't want to keep in the script.
  18. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    I will stick with Avast for the time being you can get rid of anything to do with avg and security scan in the script thanks
  19. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    c:\windows\system32\drivers\rkhit.sys
    Folder::
    C:\$AVG
    c:\program files\Norton Security Scan
    c:\program files\AVG
    c:\windows\system32\drivers\NSS
    c:\documents and settings\Richard\Application Data\AVG10
    c:\documents and settings\All Users\Application Data\Common Files
    Extra::
    File::
    c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    Firefox::
    Firefox-:-Profile- c:\docume~1\richard\applic~1\mozilla\firefox\profiles\qjolvo62.default\
    DDS::
    BHO: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - No File
    TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    mRun: [HitmanPro35] "c:\program files\hitman pro 3.5\HitmanPro35.exe" /scan:boot
    DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    Driver::
    RkHit
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ====================
    All of the outdated Java extensions are still showing in Firefox.
    ==========================================
    Download HijackThis and save to your desktop.
    • Extract it to a directory on your hard drive called c:\HijackThis.
    • Then navigate to that directory and double-click on the hijackthis.exe file.
    • When started click on the Scan button and then the Save Log button to create a log of your information.
    • The log file and then the log will open in notepad. Be sure to click on Format> Uncheck Word Wrap when you open Notepad
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
  20. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Thanks for your help am extremely grateful here is the new combofix log wll get on with the hijack this part just now. When I followed your instructions regarding firefox plugins 23 was the only update listed so dont know what is going on

    ComboFix 11-02-11.02 - Richard 02/12/2011 12:40:56.3.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.136 [GMT 0:00]
    Running from: c:\documents and settings\Richard\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Richard\Desktop\CFScript.txt
    AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    * Created a new restore point

    FILE ::
    "c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll"
    "c:\windows\system32\drivers\rkhit.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\$AVG
    c:\$avg\$VAULT\V_00007957.fil
    c:\$avg\$VAULT\V_00007958.fil
    c:\$avg\$VAULT\V_00007959.fil
    c:\$avg\$VAULT\V_00007960.fil
    c:\$avg\$VAULT\V_00007961.fil
    c:\$avg\$VAULT\V_00007962.fil
    c:\$avg\$VAULT\V_00007963.fil
    c:\$avg\$VAULT\V_00007964.fil
    c:\$avg\$VAULT\V_00007965.fil
    c:\$avg\$VAULT\V_00007966.fil
    c:\$avg\$VAULT\V_00007967.fil
    c:\$avg\$VAULT\V_00007968.fil
    c:\$avg\$VAULT\V_00007969.fil
    c:\$avg\$VAULT\V_00007970.fil
    c:\$avg\$VAULT\V_00007971.fil
    c:\$avg\$VAULT\V_00007972.fil
    c:\$avg\$VAULT\V_00007973.fil
    c:\$avg\$VAULT\V_00007974.fil
    c:\$avg\$VAULT\V_00007975.fil
    c:\$avg\$VAULT\V_00007976.fil
    c:\$avg\$VAULT\V_00007977.fil
    c:\$avg\$VAULT\V_00007978.fil
    c:\$avg\$VAULT\V_00007979.fil
    c:\$avg\$VAULT\V_00007980.fil
    c:\$avg\$VAULT\V_00007981.fil
    c:\$avg\$VAULT\V_00007982.fil
    c:\$avg\$VAULT\V_00007983.fil
    c:\$avg\$VAULT\V_00007984.fil
    c:\$avg\$VAULT\V_00007985.fil
    c:\$avg\$VAULT\V_00007986.fil
    c:\$avg\$VAULT\V_00007987.fil
    c:\$avg\$VAULT\V_00007988.fil
    c:\$avg\$VAULT\V_00007989.fil
    c:\$avg\$VAULT\V_00007990.fil
    c:\$avg\$VAULT\V_00007991.fil
    c:\$avg\$VAULT\V_00007992.fil
    c:\$avg\$VAULT\V_00007993.fil
    c:\$avg\$VAULT\V_00007994.fil
    c:\$avg\$VAULT\V_00007995.fil
    c:\$avg\$VAULT\V_00007996.fil
    c:\$avg\$VAULT\V_00007997.fil
    c:\$avg\$VAULT\V_00007998.fil
    c:\$avg\$VAULT\V_00007999.fil
    c:\$avg\$VAULT\V_00008000.fil
    c:\$avg\$VAULT\V_00008001.fil
    c:\$avg\$VAULT\V_00008002.fil
    c:\$avg\$VAULT\V_00008003.fil
    c:\$avg\$VAULT\V_00008004.fil
    c:\$avg\$VAULT\V_00008005.fil
    c:\$avg\$VAULT\V_00008006.fil
    c:\$avg\$VAULT\V_00008007.fil
    c:\$avg\$VAULT\V_00008008.fil
    c:\$avg\$VAULT\V_00008009.fil
    c:\$avg\$VAULT\V_00008010.fil
    c:\$avg\$VAULT\V_00008011.fil
    c:\$avg\$VAULT\V_00008012.fil
    c:\$avg\$VAULT\V_00008013.fil
    c:\$avg\$VAULT\V_00008014.fil
    c:\$avg\$VAULT\V_00008015.fil
    c:\$avg\$VAULT\V_00008016.fil
    c:\$avg\$VAULT\V_00008017.fil
    c:\$avg\$VAULT\V_00008018.fil
    c:\$avg\$VAULT\V_00008019.fil
    c:\$avg\$VAULT\V_00008020.fil
    c:\$avg\$VAULT\V_00008021.fil
    c:\$avg\$VAULT\V_00008022.fil
    c:\$avg\$VAULT\V_00008023.fil
    c:\$avg\$VAULT\V_00008024.fil
    c:\$avg\$VAULT\V_00008025.fil
    c:\$avg\$VAULT\V_00008026.fil
    c:\$avg\$VAULT\V_00008027.fil
    c:\$avg\$VAULT\V_00008028.fil
    c:\$avg\$VAULT\V_00008029.fil
    c:\$avg\$VAULT\V_00008030.fil
    c:\$avg\$VAULT\V_00008031.fil
    c:\$avg\$VAULT\V_00008032.fil
    c:\$avg\$VAULT\V_00008033.fil
    c:\$avg\$VAULT\V_00008034.fil
    c:\$avg\$VAULT\V_00008035.fil
    c:\$avg\$VAULT\V_00008036.fil
    c:\$avg\$VAULT\V_00008037.fil
    c:\$avg\$VAULT\V_00008038.fil
    c:\$avg\$VAULT\V_00008039.fil
    c:\$avg\$VAULT\V_00008040.fil
    c:\$avg\$VAULT\V_00008041.fil
    c:\$avg\$VAULT\V_00008042.fil
    c:\$avg\$VAULT\V_00008043.fil
    c:\$avg\$VAULT\V_00008044.fil
    c:\$avg\$VAULT\V_00008045.fil
    c:\$avg\$VAULT\V_00008046.fil
    c:\$avg\$VAULT\V_00008047.fil
    c:\$avg\$VAULT\V_00008048.fil
    c:\$avg\$VAULT\V_00008049.fil
    c:\$avg\$VAULT\V_00008050.fil
    c:\$avg\$VAULT\V_00008051.fil
    c:\$avg\$VAULT\V_00008052.fil
    c:\$avg\$VAULT\V_00008053.fil
    c:\$avg\$VAULT\V_00008054.fil
    c:\$avg\$VAULT\V_00008055.fil
    c:\$avg\$VAULT\V_00008056.fil
    c:\$avg\$VAULT\V_00008057.fil
    c:\$avg\$VAULT\V_00008058.fil
    c:\$avg\$VAULT\V_00008059.fil
    c:\$avg\$VAULT\V_00008060.fil
    c:\$avg\$VAULT\V_00008061.fil
    c:\$avg\$VAULT\V_00008062.fil
    c:\$avg\$VAULT\V_00008063.fil
    c:\$avg\$VAULT\V_00008064.fil
    c:\$avg\$VAULT\V_00008065.fil
    c:\$avg\$VAULT\V_00008066.fil
    c:\$avg\$VAULT\V_00008067.fil
    c:\$avg\$VAULT\V_00008068.fil
    c:\$avg\$VAULT\V_00008069.fil
    c:\$avg\$VAULT\V_00008070.fil
    c:\$avg\$VAULT\V_00008071.fil
    c:\$avg\$VAULT\V_00008072.fil
    c:\$avg\$VAULT\V_00008073.fil
    c:\$avg\$VAULT\V_00008074.fil
    c:\$avg\$VAULT\V_00008075.fil
    c:\$avg\$VAULT\V_00008076.fil
    c:\$avg\$VAULT\V_00008077.fil
    c:\$avg\$VAULT\V_00008078.fil
    c:\$avg\$VAULT\V_00008079.fil
    c:\$avg\$VAULT\V_00008080.fil
    c:\$avg\$VAULT\V_00008081.fil
    c:\$avg\$VAULT\V_00008082.fil
    c:\$avg\$VAULT\V_00008083.fil
    c:\$avg\$VAULT\V_00008084.fil
    c:\$avg\$VAULT\V_00008085.fil
    c:\$avg\$VAULT\V_00008086.fil
    c:\$avg\$VAULT\V_00008087.fil
    c:\$avg\$VAULT\V_00008088.fil
    c:\$avg\$VAULT\V_00008089.fil
    c:\$avg\$VAULT\V_00008090.fil
    c:\$avg\$VAULT\V_00008091.fil
    c:\$avg\$VAULT\V_00008092.fil
    c:\$avg\$VAULT\V_00008093.fil
    c:\$avg\$VAULT\V_00008094.fil
    c:\$avg\$VAULT\V_00008095.fil
    c:\$avg\$VAULT\V_00008096.fil
    c:\$avg\$VAULT\V_00008097.fil
    c:\$avg\$VAULT\V_00008098.fil
    c:\$avg\$VAULT\V_00008099.fil
    c:\$avg\$VAULT\V_00008100.fil
    c:\$avg\$VAULT\V_00008101.fil
    c:\$avg\$VAULT\V_00008102.fil
    c:\$avg\$VAULT\V_00008103.fil
    c:\$avg\$VAULT\V_00008104.fil
    c:\$avg\$VAULT\V_00008105.fil
    c:\$avg\$VAULT\V_00008106.fil
    c:\$avg\$VAULT\V_00008107.fil
    c:\$avg\$VAULT\V_00008108.fil
    c:\$avg\$VAULT\V_00008109.fil
    c:\$avg\$VAULT\V_00008110.fil
    c:\$avg\$VAULT\V_00008111.fil
    c:\$avg\$VAULT\V_00008112.fil
    c:\$avg\$VAULT\V_00008113.fil
    c:\$avg\$VAULT\V_00008114.fil
    c:\$avg\$VAULT\V_00008115.fil
    c:\$avg\$VAULT\V_00008116.fil
    c:\$avg\$VAULT\V_00008117.fil
    c:\$avg\$VAULT\V_00008118.fil
    c:\$avg\$VAULT\V_00008119.fil
    c:\$avg\$VAULT\V_00008120.fil
    c:\$avg\$VAULT\V_00008121.fil
    c:\$avg\$VAULT\V_00008122.fil
    c:\$avg\$VAULT\V_00008123.fil
    c:\$avg\$VAULT\V_00008124.fil
    c:\$avg\$VAULT\V_00008125.fil
    c:\$avg\$VAULT\V_00008126.fil
    c:\$avg\$VAULT\V_00008127.fil
    c:\$avg\$VAULT\V_00008128.fil
    c:\$avg\$VAULT\V_00008129.fil
    c:\$avg\$VAULT\V_00008130.fil
    c:\$avg\$VAULT\V_00008131.fil
    c:\$avg\$VAULT\V_00008132.fil
    c:\$avg\$VAULT\V_00008133.fil
    c:\$avg\$VAULT\V_00008134.fil
    c:\$avg\$VAULT\V_00008135.fil
    c:\$avg\$VAULT\V_00008136.fil
    c:\$avg\$VAULT\V_00008137.fil
    c:\$avg\$VAULT\V_00008138.fil
    c:\$avg\$VAULT\V_00008139.fil
    c:\$avg\$VAULT\V_00008140.fil
    c:\$avg\$VAULT\V_00008141.fil
    c:\$avg\$VAULT\V_00008142.fil
    c:\$avg\$VAULT\V_00008143.fil
    c:\$avg\$VAULT\V_00008144.fil
    c:\$avg\$VAULT\V_00008145.fil
    c:\$avg\$VAULT\V_00008146.fil
    c:\$avg\$VAULT\V_00008147.fil
    c:\$avg\$VAULT\V_00008148.fil
    c:\$avg\$VAULT\V_00008149.fil
    c:\$avg\$VAULT\V_00008150.fil
    c:\$avg\$VAULT\V_00008151.fil
    c:\$avg\$VAULT\V_00008152.fil
    c:\$avg\$VAULT\V_00008153.fil
    c:\$avg\$VAULT\V_00008154.fil
    c:\$avg\$VAULT\V_00008155.fil
    c:\$avg\$VAULT\V_00008156.fil
    c:\$avg\$VAULT\V_00008157.fil
    c:\$avg\$VAULT\V_00008158.fil
    c:\$avg\$VAULT\V_00008159.fil
    c:\$avg\$VAULT\V_00008160.fil
    c:\$avg\$VAULT\V_00008161.fil
    c:\$avg\$VAULT\V_00008162.fil
    c:\$avg\$VAULT\V_00008163.fil
    c:\$avg\$VAULT\V_00008164.fil
    c:\$avg\$VAULT\V_00008165.fil
    c:\$avg\$VAULT\V_00008166.fil
    c:\$avg\$VAULT\V_00008167.fil
    c:\$avg\$VAULT\V_00008168.fil
    c:\$avg\$VAULT\V_00008169.fil
    c:\$avg\$VAULT\V_00008170.fil
    c:\$avg\$VAULT\V_00008171.fil
    c:\$avg\$VAULT\V_00008172.fil
    c:\$avg\$VAULT\V_00008173.fil
    c:\$avg\$VAULT\V_00008174.fil
    c:\$avg\$VAULT\V_00008175.fil
    c:\$avg\$VAULT\V_00008176.fil
    c:\$avg\$VAULT\V_00008177.fil
    c:\$avg\$VAULT\V_00008178.fil
    c:\$avg\$VAULT\V_00008179.fil
    c:\$avg\$VAULT\V_00008180.fil
    c:\$avg\$VAULT\V_00008181.fil
    c:\$avg\$VAULT\V_00008182.fil
    c:\$avg\$VAULT\V_00008183.fil
    c:\$avg\$VAULT\V_00008184.fil
    c:\$avg\$VAULT\V_00008185.fil
    c:\$avg\$VAULT\V_00008186.fil
    c:\$avg\$VAULT\V_00008187.fil
    c:\$avg\$VAULT\V_00008188.fil
    c:\$avg\$VAULT\V_00008189.fil
    c:\$avg\$VAULT\V_00008190.fil
    c:\$avg\$VAULT\V_00008191.fil
    c:\$avg\$VAULT\V_00008192.fil
    c:\$avg\$VAULT\V_00008193.fil
    c:\$avg\$VAULT\V_00008194.fil
    c:\$avg\$VAULT\V_00008195.fil
    c:\$avg\$VAULT\V_00008196.fil
    c:\$avg\$VAULT\V_00008197.fil
    c:\$avg\$VAULT\V_00008198.fil
    c:\$avg\$VAULT\V_00008199.fil
    c:\$avg\$VAULT\V_00008200.fil
    c:\$avg\$VAULT\V_00008201.fil
    c:\$avg\$VAULT\V_00008202.fil
    c:\$avg\$VAULT\V_00008203.fil
    c:\$avg\$VAULT\V_00008204.fil
    c:\$avg\$VAULT\V_00008205.fil
    c:\$avg\$VAULT\V_00008206.fil
    c:\$avg\$VAULT\V_00008207.fil
    c:\$avg\$VAULT\V_00008208.fil
    c:\$avg\$VAULT\V_00008209.fil
    c:\$avg\$VAULT\V_00008210.fil
    c:\$avg\$VAULT\V_00008211.fil
    c:\$avg\$VAULT\V_00008212.fil
    c:\$avg\$VAULT\V_00008213.fil
    c:\$avg\$VAULT\V_00008214.fil
    c:\$avg\$VAULT\V_00008215.fil
    c:\$avg\$VAULT\V_00008216.fil
    c:\$avg\$VAULT\V_00008217.fil
    c:\$avg\$VAULT\V_00008218.fil
    c:\$avg\$VAULT\V_00008219.fil
    c:\$avg\$VAULT\V_00008220.fil
    c:\$avg\$VAULT\V_00008221.fil
    c:\$avg\$VAULT\V_00008222.fil
    c:\$avg\$VAULT\V_00008223.fil
    c:\$avg\$VAULT\V_00008224.fil
    c:\$avg\$VAULT\V_00008225.fil
    c:\$avg\$VAULT\V_00008226.fil
    c:\$avg\$VAULT\V_00008227.fil
    c:\$avg\$VAULT\V_00008228.fil
    c:\$avg\$VAULT\V_00008229.fil
    c:\$avg\$VAULT\V_00008230.fil
    c:\$avg\$VAULT\V_00008231.fil
    c:\$avg\$VAULT\V_00008232.fil
    c:\$avg\$VAULT\V_00008233.fil
    c:\$avg\$VAULT\V_00008234.fil
    c:\$avg\$VAULT\V_00008235.fil
    c:\$avg\$VAULT\V_00008236.fil
    c:\$avg\$VAULT\V_00008237.fil
    c:\$avg\$VAULT\V_00008238.fil
    c:\$avg\$VAULT\V_00008239.fil
    c:\$avg\$VAULT\V_00008240.fil
    c:\$avg\$VAULT\V_00008241.fil
    c:\$avg\$VAULT\V_00008242.fil
    c:\$avg\$VAULT\V_00008243.fil
    c:\$avg\$VAULT\V_00008244.fil
    c:\$avg\$VAULT\V_00008245.fil
    c:\$avg\$VAULT\V_00008246.fil
    c:\$avg\$VAULT\V_00008247.fil
    c:\$avg\$VAULT\V_00008248.fil
    c:\$avg\$VAULT\V_00008249.fil
    c:\$avg\$VAULT\V_00008250.fil
    c:\$avg\$VAULT\V_00008251.fil
    c:\$avg\$VAULT\V_00008252.fil
    c:\$avg\$VAULT\V_00008253.fil
    c:\$avg\$VAULT\V_00008254.fil
    c:\$avg\$VAULT\V_00008255.fil
    c:\$avg\$VAULT\V_00008256.fil
    c:\$avg\$VAULT\V_00008257.fil
    c:\$avg\$VAULT\V_00008258.fil
    c:\$avg\$VAULT\V_00008259.fil
    c:\$avg\$VAULT\V_00008260.fil
    c:\$avg\$VAULT\V_00008261.fil
    c:\$avg\$VAULT\V_00008262.fil
    c:\$avg\$VAULT\V_00008263.fil
    c:\$avg\$VAULT\V_00008264.fil
    c:\$avg\$VAULT\V_00008265.fil
    c:\$avg\$VAULT\V_00008266.fil
    c:\$avg\$VAULT\V_00008267.fil
    c:\$avg\$VAULT\V_00008268.fil
    c:\$avg\$VAULT\V_00008269.fil
    c:\$avg\$VAULT\V_00008270.fil
    c:\$avg\$VAULT\V_00008271.fil
    c:\$avg\$VAULT\V_00008272.fil
    c:\$avg\$VAULT\V_00008273.fil
    c:\$avg\$VAULT\V_00008274.fil
    c:\$avg\$VAULT\V_00008275.fil
    c:\$avg\$VAULT\V_00008276.fil
    c:\$avg\$VAULT\V_00008277.fil
    c:\$avg\$VAULT\V_00008278.fil
    c:\$avg\$VAULT\V_00008279.fil
    c:\$avg\$VAULT\V_00008280.fil
    c:\$avg\$VAULT\V_00008281.fil
    c:\$avg\$VAULT\V_00008282.fil
    c:\$avg\$VAULT\V_00008283.fil
    c:\$avg\$VAULT\V_00008284.fil
    c:\$avg\$VAULT\V_00008285.fil
    c:\$avg\$VAULT\V_00008286.fil
    c:\$avg\$VAULT\V_00008287.fil
    c:\$avg\$VAULT\V_00008288.fil
    c:\$avg\$VAULT\V_00008289.fil
    c:\$avg\$VAULT\V_00008290.fil
    c:\$avg\$VAULT\V_00008291.fil
    c:\$avg\$VAULT\V_00008292.fil
    c:\$avg\$VAULT\V_00008293.fil
    c:\$avg\$VAULT\V_00008294.fil
    c:\$avg\$VAULT\V_00008295.fil
    c:\$avg\$VAULT\V_00008296.fil
    c:\$avg\$VAULT\V_00008297.fil
    c:\$avg\$VAULT\V_00008298.fil
    c:\$avg\$VAULT\V_00008299.fil
    c:\$avg\$VAULT\V_00008300.fil
    c:\$avg\$VAULT\V_00008301.fil
    c:\$avg\$VAULT\V_00008302.fil
    c:\$avg\$VAULT\V_00008303.fil
    c:\$avg\$VAULT\V_00008304.fil
    c:\$avg\$VAULT\V_00008305.fil
    c:\$avg\$VAULT\V_00008306.fil
    c:\$avg\$VAULT\V_00008307.fil
    c:\$avg\$VAULT\V_00008308.fil
    c:\$avg\$VAULT\V_00008309.fil
    c:\$avg\$VAULT\V_00008310.fil
    c:\$avg\$VAULT\V_00008311.fil
    c:\$avg\$VAULT\V_00008312.fil
    c:\$avg\$VAULT\V_00008313.fil
    c:\$avg\$VAULT\V_00008314.fil
    c:\$avg\$VAULT\V_00008315.fil
    c:\$avg\$VAULT\V_00008316.fil
    c:\$avg\$VAULT\V_00008317.fil
    c:\$avg\$VAULT\V_00008318.fil
    c:\$avg\$VAULT\V_00008319.fil
    c:\$avg\$VAULT\V_00008320.fil
    c:\$avg\$VAULT\V_00008321.fil
    c:\$avg\$VAULT\V_00008322.fil
    c:\$avg\$VAULT\V_00008323.fil
    c:\$avg\$VAULT\V_00008324.fil
    c:\$avg\$VAULT\V_00008325.fil
    c:\$avg\$VAULT\V_00008326.fil
    c:\$avg\$VAULT\V_00008327.fil
    c:\$avg\$VAULT\V_00008328.fil
    c:\$avg\$VAULT\V_00008329.fil
    c:\$avg\$VAULT\V_00008330.fil
    c:\$avg\$VAULT\V_00008331.fil
    c:\$avg\$VAULT\V_00008332.fil
    c:\$avg\$VAULT\V_00008333.fil
    c:\$avg\$VAULT\V_00008334.fil
    c:\$avg\$VAULT\V_00008335.fil
    c:\$avg\$VAULT\V_00008336.fil
    c:\$avg\$VAULT\V_00008337.fil
    c:\$avg\$VAULT\V_00008338.fil
    c:\$avg\$VAULT\V_00008339.fil
    c:\$avg\$VAULT\V_00008340.fil
    c:\$avg\$VAULT\V_00008341.fil
    c:\$avg\$VAULT\V_00008342.fil
    c:\$avg\$VAULT\V_00008343.fil
    c:\$avg\$VAULT\V_00008344.fil
    c:\$avg\$VAULT\V_00008345.fil
    c:\$avg\$VAULT\V_00008346.fil
    c:\$avg\$VAULT\V_00008347.fil
    c:\$avg\$VAULT\V_00008348.fil
    c:\$avg\$VAULT\V_00008349.fil
    c:\$avg\$VAULT\V_00008350.fil
    c:\$avg\$VAULT\V_00008351.fil
    c:\$avg\$VAULT\V_00008352.fil
    c:\$avg\$VAULT\V_00008353.fil
    c:\$avg\$VAULT\V_00008354.fil
    c:\$avg\$VAULT\V_00008355.fil
    c:\$avg\$VAULT\V_00008356.fil
    c:\$avg\$VAULT\V_00008357.fil
    c:\$avg\$VAULT\V_00008358.fil
    c:\$avg\$VAULT\V_00008359.fil
    c:\$avg\$VAULT\V_00008360.fil
    c:\$avg\$VAULT\V_00008361.fil
    c:\$avg\$VAULT\V_00008362.fil
    c:\$avg\$VAULT\V_00008363.fil
    c:\$avg\$VAULT\V_00008364.fil
    c:\$avg\$VAULT\V_00008365.fil
    c:\$avg\$VAULT\V_00008366.fil
    c:\$avg\$VAULT\V_00008367.fil
    c:\$avg\$VAULT\V_00008368.fil
    c:\$avg\$VAULT\V_00008369.fil
    c:\$avg\$VAULT\V_00008370.fil
    c:\$avg\$VAULT\V_00008371.fil
    c:\$avg\$VAULT\V_00008372.fil
    c:\$avg\$VAULT\V_00008373.fil
    c:\$avg\$VAULT\V_00008374.fil
    c:\$avg\$VAULT\V_00008375.fil
    c:\$avg\$VAULT\V_00008376.fil
    c:\$avg\$VAULT\V_00008377.fil
    c:\$avg\$VAULT\V_00008378.fil
    c:\$avg\$VAULT\V_00008379.fil
    c:\$avg\$VAULT\V_00008380.fil
    c:\$avg\$VAULT\V_00008381.fil
    c:\$avg\$VAULT\V_00008382.fil
    c:\$avg\$VAULT\V_00008383.fil
    c:\$avg\$VAULT\V_00008384.fil
    c:\$avg\$VAULT\V_00008385.fil
    c:\$avg\$VAULT\V_00008386.fil
    c:\$avg\$VAULT\V_00008387.fil
    c:\$avg\$VAULT\V_00008388.fil
    c:\$avg\$VAULT\V_00008389.fil
    c:\$avg\$VAULT\V_00008390.fil
    c:\$avg\$VAULT\V_00008391.fil
    c:\$avg\$VAULT\V_00008392.fil
    c:\$avg\$VAULT\V_00008393.fil
    c:\$avg\$VAULT\V_00008394.fil
    c:\$avg\$VAULT\V_00008395.fil
    c:\$avg\$VAULT\V_00008396.fil
    c:\$avg\$VAULT\V_00008397.fil
    c:\$avg\$VAULT\V_00008398.fil
    c:\$avg\$VAULT\V_00008399.fil
    c:\$avg\$VAULT\V_00008400.fil
    c:\$avg\$VAULT\V_00008401.fil
    c:\$avg\$VAULT\V_00008402.fil
    c:\$avg\$VAULT\V_00008403.fil
    c:\$avg\$VAULT\V_00008404.fil
    c:\$avg\$VAULT\V_00008405.fil
    c:\$avg\$VAULT\V_00008406.fil
    c:\$avg\$VAULT\V_00008407.fil
    c:\$avg\$VAULT\V_00008408.fil
    c:\$avg\$VAULT\V_00008409.fil
    c:\$avg\$VAULT\V_00008410.fil
    c:\$avg\$VAULT\V_00008411.fil
    c:\$avg\$VAULT\V_00008412.fil
    c:\$avg\$VAULT\V_00008413.fil
    c:\$avg\$VAULT\V_00008414.fil
    c:\$avg\$VAULT\V_00008415.fil
    c:\$avg\$VAULT\V_00008416.fil
    c:\$avg\$VAULT\V_00008417.fil
    c:\$avg\$VAULT\V_00008418.fil
    c:\$avg\$VAULT\V_00008419.fil
    c:\$avg\$VAULT\V_00008420.fil
    c:\$avg\$VAULT\V_00008421.fil
    c:\$avg\$VAULT\V_00008422.fil
    c:\$avg\$VAULT\V_00008423.fil
    c:\$avg\$VAULT\V_00008424.fil
    c:\$avg\$VAULT\V_00008425.fil
    c:\$avg\$VAULT\V_00008426.fil
    c:\$avg\$VAULT\V_00008427.fil
    c:\$avg\$VAULT\V_00008428.fil
    c:\$avg\$VAULT\V_00008429.fil
    c:\$avg\$VAULT\V_00008430.fil
    c:\$avg\$VAULT\V_00008431.fil
    c:\$avg\$VAULT\V_00008432.fil
    c:\$avg\$VAULT\V_00008433.fil
    c:\$avg\$VAULT\V_00008434.fil
    c:\$avg\$VAULT\V_00008435.fil
    c:\$avg\$VAULT\V_00008436.fil
    c:\$avg\$VAULT\V_00008437.fil
    c:\$avg\$VAULT\V_00008438.fil
    c:\$avg\$VAULT\V_00008439.fil
    c:\$avg\$VAULT\V_00008440.fil
    c:\$avg\$VAULT\V_00008441.fil
    c:\$avg\$VAULT\V_00008442.fil
    c:\$avg\$VAULT\V_00008443.fil
    c:\$avg\$VAULT\V_00008444.fil
    c:\$avg\$VAULT\V_00008445.fil
    c:\$avg\$VAULT\V_00008446.fil
    c:\$avg\$VAULT\V_00008447.fil
    c:\$avg\$VAULT\V_00008448.fil
    c:\$avg\$VAULT\V_00008449.fil
    c:\$avg\$VAULT\V_00008450.fil
    c:\$avg\$VAULT\V_00008451.fil
    c:\$avg\$VAULT\V_00008452.fil
    c:\$avg\$VAULT\V_00008453.fil
    c:\$avg\$VAULT\V_00008454.fil
    c:\$avg\$VAULT\V_00008455.fil
    c:\$avg\$VAULT\V_00008456.fil
    c:\$avg\$VAULT\V_00008457.fil
    c:\$avg\$VAULT\V_00008458.fil
    c:\$avg\$VAULT\V_00008459.fil
    c:\$avg\$VAULT\V_00008460.fil
    c:\$avg\$VAULT\V_00008461.fil
    c:\$avg\$VAULT\V_00008462.fil
    c:\$avg\$VAULT\V_00008463.fil
    c:\$avg\$VAULT\V_00008464.fil
    c:\$avg\$VAULT\V_00008465.fil
    c:\$avg\$VAULT\V_00008466.fil
    c:\$avg\$VAULT\V_00008467.fil
    c:\$avg\$VAULT\V_00008468.fil
    c:\$avg\$VAULT\V_00008469.fil
    c:\$avg\$VAULT\V_00008470.fil
    c:\$avg\$VAULT\V_00008471.fil
    c:\$avg\$VAULT\V_00008472.fil
    c:\$avg\$VAULT\V_00008473.fil
    c:\$avg\$VAULT\V_00008474.fil
    c:\$avg\$VAULT\V_00008475.fil
    c:\$avg\$VAULT\V_00008476.fil
    c:\$avg\$VAULT\V_00008477.fil
    c:\$avg\$VAULT\V_00008478.fil
    c:\$avg\$VAULT\V_00008479.fil
    c:\$avg\$VAULT\V_00008480.fil
    c:\$avg\$VAULT\V_00008481.fil
    c:\$avg\$VAULT\V_00008482.fil
    c:\$avg\$VAULT\V_00008483.fil
    c:\$avg\$VAULT\V_00008484.fil
    c:\$avg\$VAULT\V_00008485.fil
    c:\$avg\$VAULT\V_00008486.fil
    c:\$avg\$VAULT\V_00008487.fil
    c:\$avg\$VAULT\V_00008488.fil
    c:\$avg\$VAULT\V_00008489.fil
    c:\$avg\$VAULT\V_00008490.fil
    c:\$avg\$VAULT\V_00008491.fil
    c:\$avg\$VAULT\V_00008492.fil
    c:\$avg\$VAULT\V_00008493.fil
    c:\$avg\$VAULT\V_00008494.fil
    c:\$avg\$VAULT\V_00008495.fil
    c:\$avg\$VAULT\V_00008496.fil
    c:\$avg\$VAULT\V_00008497.fil
    c:\$avg\$VAULT\V_00008498.fil
    c:\$avg\$VAULT\V_00008499.fil
    c:\$avg\$VAULT\V_00008500.fil
    c:\$avg\$VAULT\V_00008501.fil
    c:\$avg\$VAULT\V_00008502.fil
    c:\$avg\$VAULT\V_00008503.fil
    c:\$avg\$VAULT\V_00008504.fil
    c:\$avg\$VAULT\V_00008505.fil
    c:\$avg\$VAULT\V_00008506.fil
    c:\$avg\$VAULT\V_00008507.fil
    c:\$avg\$VAULT\V_00008508.fil
    c:\$avg\$VAULT\V_00008509.fil
    c:\$avg\$VAULT\V_00008510.fil
    c:\$avg\$VAULT\V_00008511.fil
    c:\$avg\$VAULT\V_00008512.fil
    c:\$avg\$VAULT\V_00008513.fil
    c:\$avg\$VAULT\V_00008514.fil
    c:\$avg\$VAULT\V_00008515.fil
    c:\$avg\$VAULT\V_00008516.fil
    c:\$avg\$VAULT\V_00008517.fil
    c:\$avg\$VAULT\V_00008518.fil
    c:\$avg\$VAULT\V_00008519.fil
    c:\$avg\$VAULT\V_00008520.fil
    c:\$avg\$VAULT\V_00008521.fil
    c:\$avg\$VAULT\V_00008522.fil
    c:\$avg\$VAULT\V_00008523.fil
    c:\$avg\$VAULT\V_00008524.fil
    c:\$avg\$VAULT\V_00008525.fil
    c:\$avg\$VAULT\V_00008526.fil
    c:\$avg\$VAULT\V_00008527.fil
    c:\$avg\$VAULT\V_00008528.fil
    c:\$avg\$VAULT\V_00008529.fil
    c:\$avg\$VAULT\V_00008530.fil
    c:\$avg\$VAULT\V_00008531.fil
    c:\$avg\$VAULT\V_00008532.fil
    c:\$avg\$VAULT\V_00008533.fil
    c:\$avg\$VAULT\V_00008534.fil
    c:\$avg\$VAULT\V_00008535.fil
    c:\$avg\$VAULT\V_00008536.fil
    c:\$avg\$VAULT\V_00008537.fil
    c:\$avg\$VAULT\V_00008538.fil
    c:\$avg\$VAULT\V_00008539.fil
    c:\$avg\$VAULT\V_00008540.fil
    c:\$avg\$VAULT\V_00008541.fil
    c:\$avg\$VAULT\V_00008542.fil
    c:\$avg\$VAULT\V_00008543.fil
    c:\$avg\$VAULT\V_00008544.fil
    c:\$avg\$VAULT\V_00008545.fil
    c:\$avg\$VAULT\V_00008546.fil
    c:\$avg\$VAULT\V_00008547.fil
    c:\$avg\$VAULT\V_00008548.fil
    c:\$avg\$VAULT\V_00008549.fil
    c:\$avg\$VAULT\V_00008550.fil
    c:\$avg\$VAULT\V_00008551.fil
    c:\$avg\$VAULT\V_00008552.fil
    c:\$avg\$VAULT\V_00008553.fil
    c:\$avg\$VAULT\V_00008554.fil
    c:\$avg\$VAULT\V_00008555.fil
    c:\$avg\$VAULT\V_00008556.fil
    c:\$avg\$VAULT\V_00008557.fil
    c:\$avg\$VAULT\V_00008558.fil
    c:\$avg\$VAULT\V_00008559.fil
    c:\$avg\$VAULT\V_00008560.fil
    c:\$avg\$VAULT\V_00008561.fil
    c:\$avg\$VAULT\V_00008562.fil
    c:\$avg\$VAULT\V_00008563.fil
    c:\$avg\$VAULT\V_00008564.fil
    c:\$avg\$VAULT\V_00008565.fil
    c:\$avg\$VAULT\V_00008566.fil
    c:\$avg\$VAULT\V_00008567.fil
    c:\$avg\$VAULT\V_00008568.fil
    c:\$avg\$VAULT\V_00008569.fil
    c:\$avg\$VAULT\V_00008570.fil
    c:\$avg\$VAULT\V_00008571.fil
    c:\$avg\$VAULT\V_00008572.fil
    c:\$avg\$VAULT\V_00008573.fil
    c:\$avg\$VAULT\V_00008574.fil
    c:\$avg\$VAULT\V_00008575.fil
    c:\$avg\$VAULT\V_00008576.fil
    c:\$avg\$VAULT\V_00008577.fil
    c:\$avg\$VAULT\V_00008578.fil
    c:\$avg\$VAULT\V_00008579.fil
    c:\$avg\$VAULT\V_00008580.fil
    c:\$avg\$VAULT\V_00008581.fil
    c:\$avg\$VAULT\V_00008582.fil
    c:\$avg\$VAULT\V_00008583.fil
    c:\$avg\$VAULT\V_00008584.fil
    c:\$avg\$VAULT\V_00008585.fil
    c:\$avg\$VAULT\V_00008586.fil
    c:\$avg\$VAULT\V_00008587.fil
    c:\$avg\$VAULT\V_00008588.fil
    c:\$avg\$VAULT\V_00008589.fil
    c:\$avg\$VAULT\V_00008590.fil
    c:\$avg\$VAULT\V_00008591.fil
    c:\$avg\$VAULT\V_00008592.fil
    c:\$avg\$VAULT\V_00008593.fil
    c:\$avg\$VAULT\V_00008594.fil
    c:\$avg\$VAULT\V_00008595.fil
    c:\$avg\$VAULT\V_00008596.fil
    c:\$avg\$VAULT\V_00008597.fil
    c:\$avg\$VAULT\V_00008598.fil
    c:\$avg\$VAULT\V_00008599.fil
    c:\$avg\$VAULT\V_00008600.fil
    c:\$avg\$VAULT\V_00008601.fil
    c:\$avg\$VAULT\V_00008602.fil
    c:\$avg\$VAULT\V_00008603.fil
    c:\$avg\$VAULT\V_00008604.fil
    c:\$avg\$VAULT\V_00008605.fil
    c:\$avg\$VAULT\V_00008606.fil
    c:\$avg\$VAULT\V_00008607.fil
    c:\$avg\$VAULT\V_00008608.fil
    c:\$avg\$VAULT\V_00008609.fil
    c:\$avg\$VAULT\V_00008610.fil
    c:\$avg\$VAULT\V_00008611.fil
    c:\$avg\$VAULT\V_00008612.fil
    c:\$avg\$VAULT\V_00008613.fil
    c:\$avg\$VAULT\V_00008614.fil
    c:\$avg\$VAULT\V_00008615.fil
    c:\$avg\$VAULT\V_00008616.fil
    c:\$avg\$VAULT\V_00008617.fil
    c:\$avg\$VAULT\V_00008618.fil
    c:\$avg\$VAULT\V_00008619.fil
    c:\$avg\$VAULT\V_00008620.fil
    c:\$avg\$VAULT\V_00008621.fil
    c:\$avg\$VAULT\V_00008622.fil
    c:\$avg\$VAULT\V_00008623.fil
    c:\$avg\$VAULT\V_00008624.fil
    c:\$avg\$VAULT\V_00008625.fil
    c:\$avg\$VAULT\V_00008626.fil
    c:\$avg\$VAULT\V_00008627.fil
    c:\$avg\$VAULT\V_00008628.fil
    c:\$avg\$VAULT\V_00008629.fil
    c:\$avg\$VAULT\V_00008630.fil
    c:\$avg\$VAULT\V_00008631.fil
    c:\$avg\$VAULT\V_00008632.fil
    c:\$avg\$VAULT\V_00008633.fil
    c:\$avg\$VAULT\V_00008634.fil
    c:\$avg\$VAULT\V_00008635.fil
    c:\$avg\$VAULT\V_00008636.fil
    c:\$avg\$VAULT\V_00008637.fil
    c:\$avg\$VAULT\V_00008638.fil
    c:\$avg\$VAULT\V_00008639.fil
    c:\$avg\$VAULT\V_00008640.fil
    c:\$avg\$VAULT\V_00008641.fil
    c:\$avg\$VAULT\V_00008642.fil
    c:\$avg\$VAULT\V_00008643.fil
    c:\$avg\$VAULT\V_00008644.fil
    c:\$avg\$VAULT\V_00008645.fil
    c:\$avg\$VAULT\V_00008646.fil
    c:\$avg\$VAULT\V_00008647.fil
    c:\$avg\$VAULT\V_00008648.fil
    c:\$avg\$VAULT\V_00008649.fil
    c:\$avg\$VAULT\V_00008650.fil
    c:\$avg\$VAULT\V_00008651.fil
    c:\$avg\$VAULT\V_00008652.fil
    c:\$avg\$VAULT\V_00008653.fil
    c:\$avg\$VAULT\V_00008654.fil
    c:\$avg\$VAULT\V_00008655.fil
    c:\$avg\$VAULT\V_00008656.fil
    c:\$avg\$VAULT\V_00008657.fil
    c:\$avg\$VAULT\V_00008658.fil
    c:\$avg\$VAULT\V_00008659.fil
    c:\$avg\$VAULT\V_00008660.fil
    c:\$avg\$VAULT\V_00008661.fil
    c:\$avg\$VAULT\V_00008662.fil
    c:\$avg\$VAULT\V_00008663.fil
    c:\$avg\$VAULT\V_00008664.fil
    c:\$avg\$VAULT\V_00008665.fil
    c:\$avg\$VAULT\V_00008666.fil
    c:\$avg\$VAULT\V_00008667.fil
    c:\$avg\$VAULT\V_00008668.fil
    c:\$avg\$VAULT\V_00008669.fil
    c:\$avg\$VAULT\V_00008670.fil
    c:\$avg\$VAULT\V_00008671.fil
    c:\$avg\$VAULT\V_00008672.fil
    c:\$avg\$VAULT\V_00008673.fil
    c:\$avg\$VAULT\V_00008674.fil
    c:\$avg\$VAULT\V_00008675.fil
    c:\$avg\$VAULT\V_00008676.fil
    c:\$avg\$VAULT\V_00008677.fil
    c:\$avg\$VAULT\V_00008678.fil
    c:\$avg\$VAULT\V_00008679.fil
    c:\$avg\$VAULT\V_00008680.fil
    c:\$avg\$VAULT\V_00008681.fil
    c:\$avg\$VAULT\V_00008682.fil
    c:\$avg\$VAULT\V_00008683.fil
    c:\$avg\$VAULT\V_00008684.fil
    c:\$avg\$VAULT\V_00008685.fil
    c:\$avg\$VAULT\V_00008686.fil
    c:\$avg\$VAULT\V_00008687.fil
    c:\$avg\$VAULT\V_00008688.fil
    c:\$avg\$VAULT\V_00008689.fil
    c:\$avg\$VAULT\V_00008690.fil
    c:\$avg\$VAULT\V_00008691.fil
    c:\$avg\$VAULT\V_00008692.fil
    c:\$avg\$VAULT\V_00008693.fil
    c:\$avg\$VAULT\V_00008694.fil
    c:\$avg\$VAULT\V_00008695.fil
    c:\$avg\$VAULT\V_00008696.fil
    c:\$avg\$VAULT\V_00008697.fil
    c:\$avg\$VAULT\V_00008698.fil
    c:\$avg\$VAULT\V_00008699.fil
    c:\$avg\$VAULT\V_00008700.fil
    c:\$avg\$VAULT\V_00008703.fil
    c:\$avg\$VAULT\V_00008704.fil
    c:\$avg\$VAULT\V_00008705.fil
    c:\$avg\$VAULT\V_00008706.fil
    c:\$avg\$VAULT\V_00008707.fil
    c:\$avg\$VAULT\V_00008708.fil
    c:\$avg\$VAULT\V_00008709.fil
    c:\$avg\$VAULT\V_00008710.fil
    c:\$avg\$VAULT\V_00008711.fil
    c:\$avg\$VAULT\V_00008712.fil
    c:\$avg\$VAULT\V_00008713.fil
    c:\$avg\$VAULT\V_00008714.fil
    c:\$avg\$VAULT\V_00008715.fil
    c:\$avg\$VAULT\V_00008716.fil
    c:\$avg\$VAULT\V_00008717.fil
    c:\$avg\$VAULT\V_00008718.fil
    c:\$avg\$VAULT\V_00008719.fil
    c:\$avg\$VAULT\V_00008720.fil
    c:\$avg\$VAULT\V_00008721.fil
    c:\$avg\$VAULT\V_00008722.fil
    c:\$avg\$VAULT\V_00008723.fil
    c:\$avg\$VAULT\V_00008724.fil
    c:\$avg\$VAULT\V_00008725.fil
    c:\$avg\$VAULT\V_00008726.fil
    c:\$avg\$VAULT\V_00008727.fil
    c:\$avg\$VAULT\V_00008728.fil
    c:\$avg\$VAULT\V_00008729.fil
    c:\$avg\$VAULT\V_00008730.fil
    c:\$avg\$VAULT\V_00008731.fil
    c:\$avg\$VAULT\V_00008732.fil
    c:\$avg\$VAULT\V_00008733.fil
    c:\$avg\$VAULT\V_00008734.fil
    c:\$avg\$VAULT\V_00008735.fil
    c:\$avg\$VAULT\V_00008736.fil
    c:\$avg\$VAULT\V_00008737.fil
    c:\$avg\$VAULT\V_00008738.fil
    c:\$avg\$VAULT\V_00008739.fil
    c:\$avg\$VAULT\V_00008740.fil
    c:\$avg\$VAULT\V_00008741.fil
    c:\$avg\$VAULT\V_00008742.fil
    c:\$avg\$VAULT\V_00008743.fil
    c:\$avg\$VAULT\V_00008744.fil
    c:\$avg\$VAULT\V_00008745.fil
    c:\$avg\$VAULT\V_00008746.fil
    c:\$avg\$VAULT\V_00008747.fil
    c:\$avg\$VAULT\V_00008748.fil
    c:\$avg\$VAULT\V_00008749.fil
    c:\$avg\$VAULT\V_00008750.fil
    c:\$avg\$VAULT\V_00008751.fil
    c:\$avg\$VAULT\V_00008752.fil
    c:\$avg\$VAULT\V_00008753.fil
    c:\$avg\$VAULT\V_00008754.fil
    c:\$avg\$VAULT\V_00008755.fil
    c:\$avg\$VAULT\V_00008756.fil
    c:\$avg\$VAULT\V_00008757.fil
    c:\$avg\$VAULT\V_00008758.fil
    c:\$avg\$VAULT\V_00008759.fil
    c:\$avg\$VAULT\V_00008760.fil
    c:\$avg\$VAULT\V_00008761.fil
    c:\$avg\$VAULT\V_00008762.fil
    c:\$avg\$VAULT\V_00008763.fil
    c:\$avg\$VAULT\V_00008764.fil
    c:\$avg\$VAULT\V_00008765.fil
    c:\$avg\$VAULT\V_00008766.fil
    c:\$avg\$VAULT\V_00008767.fil
    c:\$avg\$VAULT\V_00008768.fil
    c:\$avg\$VAULT\V_00008769.fil
    c:\$avg\$VAULT\V_00008770.fil
    c:\$avg\$VAULT\V_00008771.fil
    c:\$avg\$VAULT\V_00008772.fil
    c:\$avg\$VAULT\V_00008773.fil
    c:\$avg\$VAULT\V_00008774.fil
    c:\$avg\$VAULT\V_00008775.fil
    c:\$avg\$VAULT\V_00008776.fil
    c:\$avg\$VAULT\V_00008777.fil
    c:\$avg\$VAULT\V_00008778.fil
    c:\$avg\$VAULT\V_00008779.fil
    c:\$avg\$VAULT\V_00008780.fil
    c:\$avg\$VAULT\V_00008781.fil
    c:\$avg\$VAULT\V_00008782.fil
    c:\$avg\$VAULT\V_00008783.fil
    c:\$avg\$VAULT\V_00008784.fil
    c:\$avg\$VAULT\V_00008785.fil
    c:\$avg\$VAULT\V_00008786.fil
    c:\$avg\$VAULT\V_00008787.fil
    c:\$avg\$VAULT\V_00008788.fil
    c:\$avg\$VAULT\V_00008789.fil
    c:\$avg\$VAULT\V_00008790.fil
    c:\$avg\$VAULT\V_00008791.fil
    c:\$avg\$VAULT\V_00008792.fil
    c:\$avg\$VAULT\V_00008793.fil
    c:\$avg\$VAULT\V_00008794.fil
    c:\$avg\$VAULT\V_00008795.fil
    c:\$avg\$VAULT\V_00008796.fil
    c:\$avg\$VAULT\V_00008797.fil
    c:\$avg\$VAULT\V_00008798.fil
    c:\$avg\$VAULT\V_00008799.fil
    c:\$avg\$VAULT\V_00008800.fil
    c:\$avg\$VAULT\V_00008801.fil
    c:\$avg\$VAULT\V_00008802.fil
    c:\$avg\$VAULT\V_00008803.fil
    c:\$avg\$VAULT\V_00008804.fil
    c:\$avg\$VAULT\V_00008805.fil
    c:\$avg\$VAULT\V_00008806.fil
    c:\$avg\$VAULT\V_00008807.fil
    c:\$avg\$VAULT\V_00008808.fil
    c:\$avg\$VAULT\V_00008809.fil
    c:\$avg\$VAULT\V_00008810.fil
    c:\$avg\$VAULT\V_00008811.fil
    c:\$avg\$VAULT\V_00008812.fil
    c:\$avg\$VAULT\V_00008813.fil
    c:\$avg\$VAULT\V_00008814.fil
    c:\$avg\$VAULT\V_00008815.fil
    c:\$avg\$VAULT\V_00008816.fil
    c:\$avg\$VAULT\V_00008817.fil
    c:\$avg\$VAULT\V_00008818.fil
    c:\$avg\$VAULT\V_00008819.fil
    c:\$avg\$VAULT\V_00008820.fil
    c:\$avg\$VAULT\V_00008821.fil
    c:\$avg\$VAULT\V_00008822.fil
    c:\$avg\$VAULT\V_00008823.fil
    c:\$avg\$VAULT\V_00008824.fil
    c:\$avg\$VAULT\V_00008825.fil
    c:\$avg\$VAULT\V_00008826.fil
    c:\$avg\$VAULT\V_00008827.fil
    c:\$avg\$VAULT\V_00008828.fil
    c:\$avg\$VAULT\V_00008829.fil
    c:\$avg\$VAULT\V_00008830.fil
    c:\$avg\$VAULT\V_00008831.fil
    c:\$avg\$VAULT\V_00008832.fil
    c:\$avg\$VAULT\V_00008833.fil
    c:\$avg\$VAULT\V_00008834.fil
    c:\$avg\$VAULT\V_00008835.fil
    c:\$avg\$VAULT\V_00008836.fil
    c:\$avg\$VAULT\V_00008837.fil
    c:\$avg\$VAULT\V_00008838.fil
    c:\$avg\$VAULT\V_00008839.fil
    c:\$avg\$VAULT\V_00008840.fil
    c:\$avg\$VAULT\V_00008841.fil
    c:\$avg\$VAULT\V_00008842.fil
    c:\$avg\$VAULT\V_00008843.fil
    c:\$avg\$VAULT\V_00008844.fil
    c:\$avg\$VAULT\V_00008845.fil
    c:\$avg\$VAULT\V_00008846.fil
    c:\$avg\$VAULT\V_00008847.fil
    c:\$avg\$VAULT\V_00008848.fil
    c:\$avg\$VAULT\V_00008849.fil
    c:\$avg\$VAULT\V_00008850.fil
    c:\$avg\$VAULT\V_00008851.fil
    c:\$avg\$VAULT\V_00008852.fil
    c:\$avg\$VAULT\V_00008853.fil
    c:\$avg\$VAULT\V_00008854.fil
    c:\$avg\$VAULT\V_00008855.fil
    c:\$avg\$VAULT\V_00008856.fil
    c:\$avg\$VAULT\V_00008857.fil
    c:\$avg\$VAULT\V_00008858.fil
    c:\$avg\$VAULT\V_00008859.fil
    c:\$avg\$VAULT\V_00008860.fil
    c:\$avg\$VAULT\V_00008861.fil
    c:\$avg\$VAULT\V_00008862.fil
    c:\$avg\$VAULT\V_00008863.fil
    c:\$avg\$VAULT\V_00008864.fil
    c:\$avg\$VAULT\V_00008865.fil
    c:\$avg\$VAULT\V_00008866.fil
    c:\$avg\$VAULT\V_00008867.fil
    c:\$avg\$VAULT\V_00008868.fil
    c:\$avg\$VAULT\V_00008869.fil
    c:\$avg\$VAULT\V_00008870.fil
    c:\$avg\$VAULT\V_00008871.fil
    c:\$avg\$VAULT\V_00008872.fil
    c:\$avg\$VAULT\V_00008873.fil
    c:\$avg\$VAULT\V_00008874.fil
    c:\$avg\$VAULT\V_00008875.fil
    c:\$avg\$VAULT\V_00008876.fil
    c:\$avg\$VAULT\V_00008877.fil
    c:\$avg\$VAULT\V_00008878.fil
    c:\$avg\$VAULT\V_00008879.fil
    c:\$avg\$VAULT\V_00008880.fil
    c:\$avg\$VAULT\V_00008881.fil
    c:\$avg\$VAULT\V_00008882.fil
    c:\$avg\$VAULT\V_00008883.fil
    c:\$avg\$VAULT\V_00008884.fil
    c:\$avg\$VAULT\V_00008885.fil
    c:\$avg\$VAULT\V_00008886.fil
    c:\$avg\$VAULT\V_00008887.fil
    c:\$avg\$VAULT\V_00008888.fil
    c:\$avg\$VAULT\V_00008889.fil
    c:\$avg\$VAULT\V_00008890.fil
    c:\$avg\$VAULT\V_00008891.fil
    c:\$avg\$VAULT\V_00008892.fil
    c:\$avg\$VAULT\V_00008893.fil
    c:\$avg\$VAULT\V_00008894.fil
    c:\$avg\$VAULT\V_00008895.fil
    c:\$avg\$VAULT\V_00008896.fil
    c:\$avg\$VAULT\V_00008897.fil
    c:\$avg\$VAULT\V_00008898.fil
    c:\$avg\$VAULT\V_00008899.fil
    c:\$avg\$VAULT\V_00008900.fil
    c:\$avg\$VAULT\V_00008901.fil
    c:\$avg\$VAULT\V_00008902.fil
    c:\$avg\$VAULT\V_00008903.fil
    c:\$avg\$VAULT\V_00008904.fil
    c:\$avg\$VAULT\V_00008905.fil
    c:\$avg\$VAULT\V_00008906.fil
    c:\$avg\$VAULT\V_00008907.fil
    c:\$avg\$VAULT\V_00008908.fil
    c:\$avg\$VAULT\V_00008909.fil
    c:\$avg\$VAULT\V_00008910.fil
    c:\$avg\$VAULT\V_00008911.fil
    c:\$avg\$VAULT\V_00008912.fil
    c:\$avg\$VAULT\V_00008913.fil
    c:\$avg\$VAULT\V_00008914.fil
    c:\$avg\$VAULT\V_00008915.fil
    c:\$avg\$VAULT\V_00008916.fil
    c:\$avg\$VAULT\V_00008917.fil
    c:\$avg\$VAULT\V_00008918.fil
    c:\$avg\$VAULT\V_00008919.fil
    c:\$avg\$VAULT\V_00008920.fil
    c:\$avg\$VAULT\V_00008921.fil
    c:\$avg\$VAULT\V_00008922.fil
    c:\$avg\$VAULT\V_00008923.fil
    c:\$avg\$VAULT\V_00008924.fil
    c:\$avg\$VAULT\V_00008925.fil
    c:\$avg\$VAULT\V_00008926.fil
    c:\$avg\$VAULT\V_00008927.fil
    c:\$avg\$VAULT\V_00008928.fil
    c:\$avg\$VAULT\V_00008929.fil
    c:\$avg\$VAULT\V_00008930.fil
    c:\$avg\$VAULT\V_00008931.fil
    c:\$avg\$VAULT\V_00008932.fil
    c:\$avg\$VAULT\V_00008933.fil
    c:\$avg\$VAULT\V_00008934.fil
    c:\$avg\$VAULT\V_00008935.fil
    c:\$avg\$VAULT\V_00008936.fil
    c:\$avg\$VAULT\V_00008937.fil
    c:\$avg\$VAULT\V_00008938.fil
    c:\$avg\$VAULT\V_00008939.fil
    c:\$avg\$VAULT\V_00008940.fil
    c:\$avg\$VAULT\V_00008941.fil
    c:\$avg\$VAULT\V_00008942.fil
    c:\$avg\$VAULT\V_00008943.fil
    c:\$avg\$VAULT\V_00008944.fil
    c:\$avg\$VAULT\V_00008945.fil
    c:\$avg\$VAULT\V_00008946.fil
    c:\$avg\$VAULT\V_00008947.fil
    c:\$avg\$VAULT\V_00008948.fil
    c:\$avg\$VAULT\V_00008949.fil
    c:\$avg\$VAULT\V_00008950.fil
    c:\$avg\$VAULT\V_00008951.fil
    c:\$avg\$VAULT\V_00008952.fil
    c:\$avg\$VAULT\V_00008953.fil
    c:\$avg\$VAULT\V_00008954.fil
    c:\$avg\$VAULT\V_00008955.fil
    c:\$avg\$VAULT\V_00008956.fil
    c:\$avg\$VAULT\V_00008957.fil
    c:\$avg\$VAULT\V_00008958.fil
    c:\$avg\$VAULT\vvfolder.idx
    c:\documents and settings\All Users\Application Data\Common Files
    c:\documents and settings\All Users\Application Data\Common Files\50A4591A-6D8E-5FB8-EDB2-C8361FB60DE4.dat
    c:\documents and settings\Richard\Application Data\AVG10
    c:\documents and settings\Richard\Application Data\AVG10\cfgall\usergui.cfg
    c:\program files\AVG
    c:\program files\AVG\AVG10\avgam\avgam.lck
    c:\program files\AVG\AVG10\cfg\changecfgreg.cfg
    c:\program files\AVG\AVG10\cfg\csl.cfg
    c:\program files\AVG\AVG10\cfg\krnl.cfg
    c:\program files\AVG\AVG10\cfg\mail.cfg
    c:\program files\AVG\AVG10\cfg\mailsrv.cfg
    c:\program files\AVG\AVG10\cfg\mailsrvvsapi.cfg
    c:\program files\AVG\AVG10\cfg\malrep.cfg
    c:\program files\AVG\AVG10\cfg\sched.cfg
    c:\program files\AVG\AVG10\cfg\spsrv.cfg
    c:\program files\AVG\AVG10\Identity Protection\Agent\log\AVGIDSAgent_boot.log
    c:\program files\AVG\AVG10\log\IDP\log\avgam_idp_SYSTEM.log
    c:\program files\AVG\AVG10\log\IDP\log\avgwdsvc_idp_SYSTEM.log
    c:\program files\AVG\AVG10\scanlogs\I_00000001.log
    c:\program files\Norton Security Scan
    c:\program files\Norton Security Scan\Engine\3.0.1.8\BilBDRes.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ccL100U.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ccScanw.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ccVrTrst.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\Config.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\dec_abi.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\DefLoad.exe
    c:\program files\Norton Security Scan\Engine\3.0.1.8\DefUtDCD.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\diLueCbk.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ecmldr32.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\HeartBt.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\InstWrap.exe
    c:\program files\Norton Security Scan\Engine\3.0.1.8\InstWRes.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\Microsoft.VC90.CRT.manifest
    c:\program files\Norton Security Scan\Engine\3.0.1.8\msl.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\msvcp90.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\msvcr90.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\Nss.exe
    c:\program files\Norton Security Scan\Engine\3.0.1.8\patch25d.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\PrdDtRes.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\RevList.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\RptCdRes.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SAUpdt.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ScanCore.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ScanRes.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\ScanText.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SKU.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SKURes.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\symbos.exe
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SymCCIS.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SymCCISE.exe
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SymDltCl.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SymHTML.dll
    c:\program files\Norton Security Scan\Engine\3.0.1.8\SymInstallStub.exe
    c:\program files\Norton Security Scan\isolate.ini
    c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    c:\windows\system32\drivers\NSS
    c:\windows\system32\drivers\NSS\0300010.008\isolate.ini

    .
    ((((((((((((((((((((((((( Files Created from 2011-01-12 to 2011-02-12 )))))))))))))))))))))))))))))))
    .

    2011-02-09 23:32 . 2011-01-13 08:41 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2011-02-09 23:32 . 2011-01-13 08:37 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2011-02-09 23:32 . 2011-01-13 08:37 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2011-02-09 23:32 . 2011-01-13 08:40 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2011-02-09 23:32 . 2011-01-13 08:40 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2011-02-09 23:32 . 2011-01-13 08:39 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2011-02-09 23:32 . 2011-01-13 08:37 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2011-02-09 23:31 . 2011-01-13 08:47 38848 ----a-w- c:\windows\avastSS.scr
    2011-02-09 23:31 . 2011-01-13 08:47 188216 ----a-w- c:\windows\system32\aswBoot.exe
    2011-02-09 23:31 . 2011-02-09 23:31 -------- d-----w- c:\program files\Alwil Software
    2011-02-09 23:31 . 2011-02-09 23:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2011-02-09 22:14 . 2011-02-09 22:14 -------- d-----w- c:\program files\Perfect Uninstaller
    2011-02-09 17:45 . 2011-02-09 17:45 -------- d-----w- c:\documents and settings\Richard\Local Settings\Application Data\VS Revo Group
    2011-02-09 17:44 . 2009-12-30 11:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
    2011-02-09 17:44 . 2011-02-09 17:44 -------- d-----w- c:\program files\VS Revo Group
    2011-02-09 15:54 . 2011-02-09 15:54 -------- d-----w- c:\program files\ESET
    2011-02-06 18:42 . 2011-02-06 18:43 -------- d-----w- c:\program files\CCleaner
    2011-02-03 20:48 . 2010-12-20 18:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-03 20:47 . 2010-12-20 18:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-03 20:25 . 2011-02-03 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2011-02-03 20:21 . 2011-02-05 14:54 -------- d-----w- c:\program files\SopCast
    2011-02-02 17:10 . 2011-02-02 17:10 -------- d-----w- c:\documents and settings\Richard\Application Data\Malwarebytes
    2011-02-02 17:09 . 2011-02-02 17:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-02-02 17:09 . 2011-02-03 20:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 20:15 . 2011-02-01 20:15 -------- d-----w- c:\documents and settings\Richard\Application Data\SUPERAntiSpyware.com
    2011-02-01 20:11 . 2011-02-06 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-02-01 19:28 . 2011-02-01 19:28 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
    2011-01-30 14:57 . 2011-01-30 14:57 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2011-01-30 12:24 . 2011-01-30 12:29 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-29 17:38 . 2010-11-29 17:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 17:38 . 2010-11-29 17:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2008-04-30 16:09 . 2008-07-26 17:04 3187458 ----a-w- c:\program files\Setup-SopCast-3.0.3-2008-4-30.exe
    2006-07-08 21:28 . 2006-07-08 21:28 37518744 ----a-w- c:\program files\iTunesSetup.exe
    2008-06-30 12:44 . 2008-07-31 20:05 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
    .

    ------- Sigcheck -------

    [7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys
    [-] 2008-06-20 . 01D5EAAFF224415A7FF513E4C882BE30 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys
    [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [7] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
    [7] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
    [7] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
    [7] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
    [7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
    [-] 2002-08-29 . 244A2F9816BC9B593957281EF577D976 . 332928 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-01-13 2424560]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer"="VTTimer.exe" [2004-03-26 49152]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-26 65024]
    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2004-01-30 81920]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-02-11 198160]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
    "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

    c:\documents and settings\Richard\Start Menu\Programs\Startup\
    autobahn.lnk - c:\documents and settings\Richard\Local Settings\Application Data\Autobahn\autobahn.exe [2009-4-2 710360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SPTISRV"=3 (0x3)
    "PACSPTISVR"=3 (0x3)
    "MSCSPTISRV"=3 (0x3)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
    "c:\\Program Files\\PPStream\\PPStream.exe"=
    "c:\\Program Files\\PPStream\\PPSAP.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/2/2010 7:10 PM 64288]
    R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [10/3/2010 10:43 PM 59240]
    R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [7/28/2004 7:30 AM 11264]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2/9/2011 11:32 PM 294608]
    R1 RapportCerberus_19917;RapportCerberus_19917;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [10/3/2010 10:54 PM 34792]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 6:25 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 6:41 PM 67656]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/9/2011 11:32 PM 17744]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/6/2010 5:28 PM 1405384]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [10/3/2010 10:43 PM 767208]
    R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2/3/2010 6:52 AM 27632]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/7/2010 6:50 PM 135664]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/17/2010 5:33 AM 15232]
    S3 RapportIaso;RapportIaso;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\21923\RapportIaso.sys [1/5/2011 10:43 AM 12928]
    S3 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [10/3/2010 10:43 PM 169320]
    S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2/9/2011 5:44 PM 27064]
    S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [8/30/2004 10:31 AM 72576]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    vvdsvc REG_MULTI_SZ vvdsvc
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-06 12:55]

    2011-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]

    2011-02-12 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-02 10:15]

    2011-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-07 18:50]

    2011-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-07 18:50]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    DPF: DigiChat Applet - hxxp://host19.digichat.com/DigiChat/DigiClasses/Client_IE.cab
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
    FF - ProfilePath - c:\documents and settings\Richard\Application Data\Mozilla\Firefox\Profiles\qjolvo62.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-12 12:54
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(664)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    Completion time: 2011-02-12 13:00:15
    ComboFix-quarantined-files.txt 2011-02-12 13:00
    ComboFix2.txt 2011-02-10 16:43
    ComboFix3.txt 2011-02-09 23:13

    Pre-Run: 41,258,741,760 bytes free
    Post-Run: 41,224,478,720 bytes free

    - - End Of File - - AC0A8437714F4182B5916BBAC0CB3EFF
  21. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 2:52:50 PM, on 2/12/2011
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Apps\Powercinema\PCMService.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\DivX\DivX Update\DivXUpdate.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Alwil Software\Avast5\avastUI.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Richard\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: autobahn.lnk = C:\Documents and Settings\Richard\Local Settings\Application Data\Autobahn\autobahn.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
    O16 - DPF: DigiChat Applet - http://host19.digichat.com/DigiChat/DigiClasses/Client_IE.cab
    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} - https://signup.msn.com/pages/MsnInstC.cab
    O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1094347499875
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - http://dl.uc.sina.com/cab/downloader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} - https://a248.e.akamai.net/f/248/546...img/operations/symbizpr/xcontrol/SymDlBrg.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553534400} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} (VodClient Control Class) - http://www.vexcast.com/download/vexcast.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://chat.msn.com/bin/msnchat45.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

    --
    End of file - 8647 bytes

    I have an external drive that I use to store music and videos that now has $AVG folder and a Recycler folder that weren't there b4 my issues with computer should this be a cause for concern ?
  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Regarding Hitman Pro: you made an assumption that was based on incorrect data> you 'assumed' that because Hitman Pro brought these processes up that they were 'bad' and causing your problems:
    FYI:
    1. bsdiff and bspatch are tools for building and applying patches to binary files

    2. libexpatw.dll is part of HP Photosmart C6180 All-In-One printer/scanner/fax/copier

    3. ssleay32.dll is a module associated with The OpenSSL Toolkit from The OpenSSL Project, http://www.openssl.org/

    4. msmsgs.exe is Related to Microsoft's Windows Messenger. Here is what it deleted:
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    5. tkjvrup.exe is the only process I cannot identify with only the file information. I would have 'looked' at the file first. It could have or may not have been malware.

    The only questionable entry is #5. The others weren't malware.
    ===========================================
    Regarding the AVG Virus Vault or any quarantine folder in an antivirus program:
    Once an entry is found and quarantined, it is no longer active in the system

    Connect the drive> do a right click> Delete on the $AVG folder
    Try using the same directions I gave you for removing the files in the Recycler. Remember, you are only looking for the SID number I gave you and the Recycle Bin must be empty before deleting the file.
    ====================================
    Please reopen HijackThis to 'do system scan only.' Check each of the following, if present:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com...r/fix_homepage
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as5/asinst.cab


    Close all Windows except HijackThis and click on "Fix Checked."
  23. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    as u can probably tell from our interaction I don't have a great deal of knowledge about the problems I am having as have never encountered them until I was trying to sort out a friends pc who has even less knowledge than me. He didn't have any sort of anti virus/malware/spyware protection and whilst trying to use my limited know how to resolve his issues i made the stupid mistake of transporting programs from mine to his via a usb storage device that would have been ok if i hadn't in a moment of tremendous stupidity i plugged the same usb device back into my pc. My computer then started making strange noises and wasn't functioning as normal. I managed to rid myself of some of the issues with Superantispyware and malwarebytes but then i stupidly did a system restore and my internal hard drive was making a strange noise every four seconds and my pc was very slow, after i ran hitman pro 3.5 the hard drive stopped making noises and my pc seemed more healthy thus my false assumptions that the software was trustworthy. I know better now. Do you think that the files it has deleted has anything to do with Windows installer appearing a lot of the time when it isn't needed ? I got rid of the avg vault from my external drive and the recycler file still wont let me delete it but you said it want much to worry about so am happy with that. All the lines that u listed where in the system scan in hijack this so done as you instructed and Fix checked. Thanks
  24. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Rich, if you have problems in the future, it's always best to give as much information as you can. Telling us the malware came from an infected flash drive. There are some types of malware with a frequent transmission by flash drives. Although you did so in good faith, connecting to a computer with no security with a flash drive is not something you want to do.

    I cannot tell you what the significance of the file removals by Hitman were because I don't have enough information.

    When you try the Recycler again, after showing the hidden files, double click on Recycler and see if more than 1 SID is showing. If so, you need to look for the SID I gave you.

    Removing all of the tools we used and the files and folders they created
    • Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    • Download OTCleanIt by OldTimer and save it to your Desktop.
    • Double click OTCleanIt.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.

    Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
    • You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
    • Go to Start > All Programs > Accessories > System Tools
    • Click "System Restore".
    • Choose "Create a Restore Point" on the first screen then click "Next".
    • Give the Restore Point a name> click "Create".
    • Go back and follow the path to > System Tools.
      [*]Choose Disc Cleanup
      [*]Click "OK" to select the partition or drive you want.
      [*]Click the "More Options" Tab.
      [*]Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.


    Empty the Recycle Bin
    Lt me know if you have any more questions.
  25. Rich108

    Rich108 Newcomer, in training Topic Starter Posts: 18

    I am sorry that I didn't provide you with a fuller accurate description of how my system became infected in the first place. I am extremely grateful that you have given your valuable time and expertise to resolve the issues I have been having. I was in a mad rush the day that I made the mistake that infected my machine under normal circumstances i would not have done something so stupid. I have followed your instructions in your last post regarding combofix, OTCleanlt and have set a new clean restore point. Does this now mean that my initial issues have been resolved ? The file with the name SID S-1-5-21-1495889697-3474788689-3807336589-1009 is still present in the recycler in my C, E and G drives but it will not let me delete it as said before even with the recycle bin being empty before I delete it. As you have said before this isn't that much of an issue. The only other issues I have are to do with windows installer always appearing at start-up and when software is opening up, that wasn't happening before my problems and something to do withe jusched.exe has encountered a problem and needs to close dialog box that comes up whenever my computer starts that has been present ever since tried to get rid of previous Java updates. I realise that these problems are probably better suited to a different section of the forum so maybe i should post the last two problems there
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.