help! kenna virus! lots of them!

• asdfzhao

  19 Jan 08, 23:08

  stupid thumbdrives transferred visuses to me again!
  now i think its getting from bad to worse!
• asdfzhao

  19 Jan 08, 23:12

  hjt log
  
  Logfile of HijackThis v1.99.1
  Scan saved at 22:52:39, on 19/01/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Acer\eManager\anbmServ.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\Tablet.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\acer\epm\epm-dm.exe
  C:\PROGRA~1\LAUNCH~1\LManager.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\ObjectDock\ObjectDock.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Program Files\YzShadow\YzShadow.exe
  C:\expose\WinExpose.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\WINDOWS\system32\WTablet\TabUserW.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  C:\isystem\DiscMounter\DiscMounter.exe
  C:\WINDOWS\explorer.exe
  D:\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = by SPHURE
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Loader Class - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - C:\Program Files\findexer\FindeXer.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [tasa] C:\DOCUME~1\zhao\LOCALS~1\Temp\taso.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [ObjectDock] C:\Program Files\ObjectDock\ObjectDock.exe
  O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKCU\..\Run: [Yz Shadow] C:\Program Files\YzShadow\YzShadow.exe
  O4 - HKCU\..\Run: [WinExpose] "C:\expose\WinExpose.exe"
  O4 - HKCU\..\Run: [Iconoid] "C:\Program Files\Iconoid\iconoid.exe"
  O4 - HKCU\..\Run: [DesktopIconToy] C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe
  O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
  O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: DiscMounter.lnk = C:\isystem\DiscMounter\DiscMounter.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
  O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
  O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
  O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {A91DEB0D-AD0D-453E-9AC8-60178EC24212} (VPlayer Control) - http://www.sonypictures.com/movies/casinoroyale/vividas/player/vivid_ocx.jpeg
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
  O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
  O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
  O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.89.cab
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
  
  
• ndmmxiaomayi

  19 Jan 08, 23:21

  Sure got lots these days...
  
  If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
  
  Please download Combofix from Bleeping Computer. Save it to your desktop.
  
  If you can't download it, please try these 2 alternative sites:
  
  Forospyware
  Geeks to Go
  
  Double click to run it. Follow the prompts. Once done, it will reboot and a log will be produced. Please post that log and a new HijackThis log in your next reply.
  
  Do not mouse click on Combofix while it is running. That may cause it to stall.
  
  Post back the Combofix log and a new HijackThis log.
• asdfzhao

  19 Jan 08, 23:44

  ComboFix 08-01-18.5 - zhao 2008-01-19 23:38:27.1 - FAT32x86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.480 [GMT 8:00]
  Running from: C:\Documents and Settings\zhao\Desktop\ComboFix.exe
  * Created a new restore point
  
  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\cup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\customer_cup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\heart.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\menu_down.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\menu_up.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\plates.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\ticket.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\tray.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\music\mainmenumusic.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_bring_check_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_diner.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_food_ready_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_gain_heart_1.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_pencil_write_2.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_rollover_1.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_seat_people_snd.ogg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\choosedifficulty.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\credits.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\flo_lose.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\flo_win.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\help1.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\help2.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\highscores.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelintro.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelintro_mask.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelover.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelover_mask.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\mainmenu.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\popup.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\popup_mask.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upgradegrid.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upgradetitle.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upsell.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowleft_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowleft_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowright_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowright_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\back_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\back_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backchalk.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backchalkup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backtomenu_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backtomenu_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\cancel.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\cancelup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\career.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\career_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\close.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\closeup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\continue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\continueover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\credits_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\credits_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\download_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\download_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\easy.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\easy_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\endlessshift.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\endlessshift_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\hard.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\hard_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\help.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\help_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\highscores.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\highscores_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\instructions_blue.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\instructions_yellow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\letsplay.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\letsplayover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\medium.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\medium_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\moreinfo.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\moreinfoup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\off.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\off_on.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\on.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\on_on.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\pause.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\pauseover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quit.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitgame.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitgameover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\resumegame.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\resumegameover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\submit.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\submitup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\tryagain.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\tryagainover.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\upgrade_over.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\upgrade_up.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewglobal.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewglobalup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewhighscore.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewhighscoreon.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewlocal.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewlocalup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\comics\webcomic.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\career.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\customer.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\endless.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\global.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\powerups.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\cook.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\cook.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\stove.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\arrow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\click.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\click2.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\grab.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\open.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\anim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\anim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\sit_legs.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\idle.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\idle.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\lower.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\lower.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\upper.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\upper.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\fonts\arial.mvec
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\fonts\komikaaxis.mvec
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\chair.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\chair.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dirt2top.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dirt4top.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dishcart.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dishcart.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_off.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_on1.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_on2.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\ticketstation.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\ticketstation.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowdown.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowdownon.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowleft.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowlefton.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowright.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowrighton.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowupon.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\p1icon.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\textedit.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\title.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_a.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_b.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_c.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_a.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_b.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_c.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_d.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_a.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_b.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_c.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_d.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\fifth_level_diner.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\first_level_diner.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\fourth_level_diner.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\second_level_diner.txt
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\playfirst_logo.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\background.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food1.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food1.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food2.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food2.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food3.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food3.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\frames\upgrade_0001.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\2top.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\2top.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\4top.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\4top.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\upgrades.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\tableshadow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\choosedifficulty.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\chooseplayer.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\chooserestaurant.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\credits.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\game.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\gothighscore.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\help.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\help2.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscore.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscoreinfo.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscoresubmit.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\levelintro.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\levelover.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\loading.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\mainloop.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\mainmenu.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\ok.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\pause.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\style.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\tutorialintro.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\upgrade.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\upsell.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\webcomic.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\yesno.lua
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\aol_logo.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\gamelabsplash.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\playfirst_logo.jpg
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\strings.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\angersmoke.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\angersmoke.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\chairflags.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\chairflags.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\check.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\checkmark.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\clock.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\closed.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\closingtime.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\coinflip.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\coinflip.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\dollar.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\coffee.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\tables.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\wallpaper.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\expert.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\expertscore.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\foodpoof.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\foodpoof.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\fork_timer.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\goalcompleted.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\heartgrow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\heartgrow.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\jar.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\jar.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\level.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\level_career.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\score.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\sound.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\staroff.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\staron.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tablenumber.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tablenumberup.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\traynumber.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorial_character.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorialarrow.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorialbox.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgradeanim.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgradeanim.xml
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\drinks.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\maitred.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\oven.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\select.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\shoes.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\stereo.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\table.png
  C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.89\dinerdash.exe
  C:\WINDOWS\setup.exe
  C:\WINDOWS\system32\autorun.ini
  C:\WINDOWS\system32\kavo0.dll
  
  .
  ((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
  .
  
  2008-01-19 23:37 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
  2008-01-19 01:55 . 2008-01-19 01:55 895,842 --a------ C:\WINDOWS\N705i_style_win.scr
  2008-01-19 01:55 . 2008-01-19 01:55 542,292 --a------ C:\WINDOWS\N705i_style_winUninst.exe
  2008-01-11 23:32 . 2008-01-11 23:32 d-------- C:\PFiles
  2008-01-08 23:46 . 2008-01-08 23:46 d-------- C:\WINDOWS\system32\NtmsData
  2007-12-29 00:35 . 2007-12-29 00:35 d-------- C:\WINDOWS\ndssaver01 dir
  2007-12-29 00:35 . 2007-12-29 00:35 191,488 --a------ C:\WINDOWS\ndssaver01.scr
  2007-12-25 13:53 . 2007-12-25 13:53 d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
  2007-12-19 15:08 . 2008-01-12 00:43 512 --a------ C:\drmHeader.bin
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2007-12-28 16:35 545,280 ----a-w C:\WINDOWS\flashax.exe
  2007-12-28 16:35 12,288 ----a-w C:\WINDOWS\impborl.dll
  2007-12-08 16:37 --------- d-----w C:\Program Files\VideoLAN
  2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
  2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
  2007-11-24 17:41 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
  2007-11-24 17:41 249,856 ------w C:\WINDOWS\Setup1.exe
  2007-11-24 17:41 --------- d-----w C:\Program Files\Date Cracker 2000
  2007-11-14 07:26 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
  2007-11-08 07:21 39,424 ----a-w C:\WINDOWS\zipinst.exe
  2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
  2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
  2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
  2007-10-30 10:16 3,137,024 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
  2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
  2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
  2007-10-27 09:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
  2007-10-27 09:40 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
  2007-10-26 03:36 8,256,000 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
  2006-10-10 03:03 1,554 ----a-w C:\Documents and Settings\zhao\Application Data\wklnhst.dat
  2006-04-06 17:30 696,320 ----a-w C:\Program Files\FORMAT.EXE
  2006-04-06 17:30 584,379 ----a-w C:\Program Files\Manual- English.pdf
  2006-04-06 04:32 0 ----a-w C:\Documents and Settings\my com\Application Data\wklnhst.dat
  1996-11-14 16:58 23,808 ----a-r C:\WINDOWS\Fonts\ARABB___.SCR
  1996-11-14 16:58 23,680 ----a-r C:\WINDOWS\Fonts\ARABA___.SCR
  1996-11-14 16:58 23,168 ----a-r C:\WINDOWS\Fonts\RCOC____.SCR
  1996-11-14 16:58 21,504 ----a-r C:\WINDOWS\Fonts\RCOA____.SCR
  1996-11-14 16:58 19,456 ----a-r C:\WINDOWS\Fonts\RCOB____.SCR
  1996-11-14 16:58 15,232 ----a-r C:\WINDOWS\Fonts\ARABC___.SCR
  1999-07-07 00:00 6 --sh--r C:\WINDOWS\@@desktop.dat
  2004-10-13 16:24 1,694,208 --sha-w C:\WINDOWS\FlyakiteOSX\Backup\msmsgs.exe
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 11:37 8818688]
  "ObjectDock"="C:\Program Files\ObjectDock\ObjectDock.exe" [2007-04-30 19:43 3450608]
  "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-02-24 08:32 188416]
  "Yz Shadow"="C:\Program Files\YzShadow\YzShadow.exe" [2006-02-24 10:51 172032]
  "WinExpose"="C:\expose\WinExpose.exe" [2006-11-25 14:20 301056]
  "Iconoid"="C:\Program Files\Iconoid\iconoid.exe" [2007-02-03 18:38 274432]
  "DesktopIconToy"="C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe" [ ]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" []
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-07 16:17 102491]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-07 16:16 692315]
  "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 05:00 208952]
  "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
  "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00 455168]
  "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00 455168]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 19:31 126976]
  "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07 32768]
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-24 21:22 5566464]
  "nwiz"="nwiz.exe" [2005-03-24 21:22 1495040 C:\WINDOWS\system32\nwiz.exe]
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-24 21:22 98304]
  "SoundMan"="SOUNDMAN.EXE" [2004-12-01 15:54 77824 C:\WINDOWS\soundman.exe]
  "AGRSMMSG"="AGRSMMSG.exe" [2005-04-15 11:45 88202 C:\WINDOWS\AGRSMMSG.exe]
  "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 110592 C:\WINDOWS\system32\bthprops.cpl]
  "EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-04-21 10:13 188416]
  "ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
  "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2005-10-14 15:38 487424]
  "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
  "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-24 11:20 579072]
  "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
  "System Files Updater"="C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe" [2006-02-26 07:41 118485]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-19 20:16 286720]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-27 14:21 219136]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "RunNarrator"="Narrator.exe" [2006-10-04 16:48 48128 C:\WINDOWS\system32\narrator.exe]
  
  C:\Documents and Settings\zhao\Start Menu\Programs\Startup\
  wkcalrem.LNK - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2005-08-18 19:44:26]
  Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
  DiscMounter.lnk - C:\isystem\DiscMounter\DiscMounter.exe [2007-10-28 22:50:27]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-16 14:06:22]
  TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2007-07-16 14:14:11]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 01000000
  "NoSMHelp"= 01000000
  
  R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
  R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
  R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
  R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
  R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
  R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
  R4 DritekPortIO;Dritek General Port I/O;C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2005-10-14 15:41]
  S3 pacdcacm;pacdcacm;C:\WINDOWS\system32\DRIVERS\pacdcacm.sys [2005-08-22 01:45]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{138661a0-a856-11dc-9e8a-00166f676599}]
  \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
  \Shell\Explore\command - F:\Flash.10.Setup.exe
  \Shell\Open\command - F:\Flash.10.Setup.exe
  \Shell\Scan for Viruses\command - F:\Scanner.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2454d208-8378-11dc-9e42-00166f676599}]
  \Shell\AutoRun\command - I:\copetttt.com
  \Shell\explore\Command - I:\copetttt.com
  \Shell\open\Command - I:\copetttt.com
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49fd50ea-2125-11db-9c0f-00166f676599}]
  \Shell\AutoRun\command - ntdelect.com
  \Shell\explore\Command - ntdelect.com
  \Shell\open\Command - ntdelect.com
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5397c8bb-1300-11dc-9dcc-00166f676599}]
  \Shell\AutoRun\command - sysboot.scr
  \Shell\open\Command - sysboot.scr
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b1807b4-0b0a-11db-9bda-00166f676599}]
  \Shell\AutoRun\command - F:\copetttt.com
  \Shell\explore\Command - F:\copetttt.com
  \Shell\open\Command - F:\copetttt.com
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a066964a-4013-11dc-9de7-00166f676599}]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8bbed92-a86a-11dc-9e8b-00166f676599}]
  \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe
  \Shell\Explore\command - F:\Flash.10.Setup.exe
  \Shell\Open\command - F:\Flash.10.Setup.exe
  \Shell\Scan for Viruses\command - F:\Scanner.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc43285c-925a-11dc-9e6a-00166f676599}]
  \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e
  \Shell\Open\command - F:\Boot.exe e
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d94898bb-2aa5-11dc-9dd9-00166f676599}]
  \Shell\Auto\command - OSO.exe
  \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f135e94a-a44b-11db-9d0e-00166f676599}]
  \Shell\AutoRun\command - F:\copetttt.com
  \Shell\explore\Command - F:\copetttt.com
  \Shell\open\Command - F:\copetttt.com
  
  *Newly Created Service* - INT15.SYS
  *Newly Created Service* - PROCEXP90
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-01-15 06:13:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-01-19 23:42:34
  Windows 5.1.2600 Service Pack 2 FAT NTAPI
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-01-19 23:42:56
  ComboFix-quarantined-files.txt 2008-01-19 15:42:56
  .
  2008-01-09 17:01:30 --- E O F ---
  
• asdfzhao

  19 Jan 08, 23:46

  hjt log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 23:45:21, on 19/01/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Acer\eManager\anbmServ.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\Tablet.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\acer\epm\epm-dm.exe
  C:\PROGRA~1\LAUNCH~1\LManager.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\ObjectDock\ObjectDock.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Program Files\YzShadow\YzShadow.exe
  C:\expose\WinExpose.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\WINDOWS\system32\WTablet\TabUserW.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  C:\isystem\DiscMounter\DiscMounter.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\notepad.exe
  D:\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Loader Class - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - C:\Program Files\findexer\FindeXer.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [ObjectDock] C:\Program Files\ObjectDock\ObjectDock.exe
  O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKCU\..\Run: [Yz Shadow] C:\Program Files\YzShadow\YzShadow.exe
  O4 - HKCU\..\Run: [WinExpose] "C:\expose\WinExpose.exe"
  O4 - HKCU\..\Run: [Iconoid] "C:\Program Files\Iconoid\iconoid.exe"
  O4 - HKCU\..\Run: [DesktopIconToy] C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe
  O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: DiscMounter.lnk = C:\isystem\DiscMounter\DiscMounter.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
  O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
  O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
  O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {A91DEB0D-AD0D-453E-9AC8-60178EC24212} (VPlayer Control) - http://www.sonypictures.com/movies/casinoroyale/vividas/player/vivid_ocx.jpeg
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
  O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
  O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
  O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.89.cab
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
  
  
• Manager433

  19 Jan 08, 23:54

  You using wat anti-virus software?
• ndmmxiaomayi

  20 Jan 08, 00:10

  Please go to Virus Total or Jotti and upload C:\WINDOWS\flashax.exe for scanning.
  
  For Virus Total
  
  

  [*]Please copy and paste C:\WINDOWS\flashax.exe in the text box next to the Browse button.
  [*]Click on Send File.

  
  
  For Jotti
  
  

  [*]Please copy and paste C:\WINDOWS\flashax.exe in the text box next to the Browse button.
  [*]Click on Submit.

  
  
  Repeat for these files:
  
  1. C:\WINDOWS\impborl.dll
  2. C:\WINDOWS\Setup1.exe
  
  Next...
  
  Copy and paste the following in blue into Notepad:
  
  DirLook::
  C:\PFiles
  C:\WINDOWS\system32\NtmsData
  C:\WINDOWS\ndssaver01 dir
  
  FileLook::
  C:\WINDOWS\Setup1.exe
  C:\WINDOWS\Fonts\ARABB___.SCR
  C:\WINDOWS\Fonts\ARABA___.SCR
  C:\WINDOWS\Fonts\RCOC____.SCR
  C:\WINDOWS\Fonts\RCOA____.SCR
  C:\WINDOWS\Fonts\RCOB____.SCR
  C:\WINDOWS\Fonts\ARABC___.SCR
  
  Registry::
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{138661a0-a856-11dc-9e8a-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2454d208-8378-11dc-9e42-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49fd50ea-2125-11db-9c0f-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5397c8bb-1300-11dc-9dcc-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b1807b4-0b0a-11db-9bda-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8bbed92-a86a-11dc-9e8b-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc43285c-925a-11dc-9e6a-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d94898bb-2aa5-11dc-9dd9-00166f676599}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f135e94a-a44b-11db-9d0e-00166f676599}]
  
  Save it as CFScript.txt. Don't change the file name.
  
  Drag CFScript into Combofix. Combofix will start running. When done, a log will be produced. Please post this log as well as a new HijackThis log in your next reply.
  
  Do not mouse click on Combofix while it is running. That may cause it to stall.
  
  Also do the following:
  
  

  [*]Please download Flash_Disinfector and save it to your desktop.
  [*]Double click to run it.
  [*]You will be prompted to plug in your flash drive. Plug it in.
  [*]Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime.
  [*]When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager.
  [*]Click on File > New Task (Run...). Type in explorer.exe and press Enter. Your desktop should now appear.

  
  
  Post back the following:
  
  1. Virus Total or Jotti's scan results of the 3 files
  
  2. Combofix log
  
  3. A new HijackThis log
• ndmmxiaomayi

  20 Jan 08, 00:11

  Originally posted by Manager433:

  You using wat anti-virus software?

  AVG as seen in the logs.
• asdfzhao

  20 Jan 08, 00:19

  flashax.exe
  MD5: 5d40463ffe13845fd7be05582ee536f7
  Date: 10.11.2007 03:49:57 (CET) [>100D]
  Results: 1/32
  Permalink: analisis/fb47e2c2787dcf5fc7a7ce90cb4b7c6b
  
  impborl.dll
  MD5: 23a38a0f3b5fb112809c339725a9e318
  Date: 06.16.2007 14:07:30 (CET) [>217D]
  Results: 2/31
  Permalink: analisis/2ae427c0132371df498ed9863662ce08
  
  setup1.exe
  MD5: b9917fc4c836776765e311fff84dd534
  Date: 01.19.2008 06:52:31 (CET) [<1D]
  Results: 0/32
  Permalink: analisis/226f5170c5c9c94c7e040d7613219bd3
• asdfzhao

  20 Jan 08, 00:24

  combofix:
  
  ComboFix 08-01-18.5 - zhao 2008-01-20 0:20:48.2 - FAT32x86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.392 [GMT 8:00]
  Running from: C:\Documents and Settings\zhao\Desktop\ComboFix.exe
  Command switches used :: C:\Documents and Settings\zhao\Desktop\CFScript.txt
  * Created a new restore point
  
  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
  .
  
  ((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
  .
  
  2008-01-19 23:37 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
  2008-01-19 01:55 . 2008-01-19 01:55 895,842 --a------ C:\WINDOWS\N705i_style_win.scr
  2008-01-19 01:55 . 2008-01-19 01:55 542,292 --a------ C:\WINDOWS\N705i_style_winUninst.exe
  2008-01-11 23:32 . 2008-01-11 23:32 d-------- C:\PFiles
  2008-01-08 23:46 . 2008-01-08 23:46 d-------- C:\WINDOWS\system32\NtmsData
  2007-12-29 00:35 . 2007-12-29 00:35 d-------- C:\WINDOWS\ndssaver01 dir
  2007-12-29 00:35 . 2007-12-29 00:35 191,488 --a------ C:\WINDOWS\ndssaver01.scr
  2007-12-25 13:53 . 2007-12-25 13:53 d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
  2007-12-19 15:08 . 2008-01-12 00:43 512 --a------ C:\drmHeader.bin
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2007-12-28 16:35 545,280 ----a-w C:\WINDOWS\flashax.exe
  2007-12-28 16:35 12,288 ----a-w C:\WINDOWS\impborl.dll
  2007-12-08 16:37 --------- d-----w C:\Program Files\VideoLAN
  2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
  2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
  2007-11-24 17:41 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
  2007-11-24 17:41 249,856 ------w C:\WINDOWS\Setup1.exe
  2007-11-24 17:41 --------- d-----w C:\Program Files\Date Cracker 2000
  2007-11-14 07:26 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
  2007-11-08 07:21 39,424 ----a-w C:\WINDOWS\zipinst.exe
  2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
  2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
  2007-10-30 17:20 360,064 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
  2007-10-30 10:16 3,137,024 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
  2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
  2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
  2007-10-27 09:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
  2007-10-27 09:40 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
  2007-10-26 03:36 8,256,000 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
  2006-10-10 03:03 1,554 ----a-w C:\Documents and Settings\zhao\Application Data\wklnhst.dat
  2006-04-06 17:30 696,320 ----a-w C:\Program Files\FORMAT.EXE
  2006-04-06 17:30 584,379 ----a-w C:\Program Files\Manual- English.pdf
  2006-04-06 04:32 0 ----a-w C:\Documents and Settings\my com\Application Data\wklnhst.dat
  1996-11-14 16:58 23,808 ----a-r C:\WINDOWS\Fonts\ARABB___.SCR
  1996-11-14 16:58 23,680 ----a-r C:\WINDOWS\Fonts\ARABA___.SCR
  1996-11-14 16:58 23,168 ----a-r C:\WINDOWS\Fonts\RCOC____.SCR
  1996-11-14 16:58 21,504 ----a-r C:\WINDOWS\Fonts\RCOA____.SCR
  1996-11-14 16:58 19,456 ----a-r C:\WINDOWS\Fonts\RCOB____.SCR
  1996-11-14 16:58 15,232 ----a-r C:\WINDOWS\Fonts\ARABC___.SCR
  1999-07-07 00:00 6 --sh--r C:\WINDOWS\@@desktop.dat
  2004-10-13 16:24 1,694,208 --sha-w C:\WINDOWS\FlyakiteOSX\Backup\msmsgs.exe
  .
  
  (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  - Not a PE file.
  
  - Not a PE file.
  
  - Not a PE file.
  
  - Not a PE file.
  
  - Not a PE file.
  
  - Not a PE file.
  
  ---- C:\WINDOWS\Setup1.exe ----
  
  Company: Microsoft Corporation
  File Description: Visual Basic 6.0 Setup Toolkit
  File Version: 6.00.8804
  Product Name: Visual Basic
  Copyright: Copyright (C) 1987-1999 Microsoft Corporation
  Original file name: setup1.exe
  
  ---- Directory of C:\PFiles ----
  
  2007-04-10 17:21 163256 --a------ C:\PFiles\Plugins\np-mswmp.dll
  2007-03-30 10:43 3352 --a------ C:\PFiles\Plugins\WMP Firefox Plugin RelNotes.txt
  2007-03-30 10:43 149569 --a------ C:\PFiles\Plugins\WMP Firefox Plugin License.rtf
  
  ---- Directory of C:\WINDOWS\ndssaver01 dir ----
  
  2007-12-29 00:35 805500 --a------ C:\WINDOWS\ndssaver01 dir\ndssaver01.swf
  2007-12-29 00:35 805500 --a------ C:\WINDOWS\ndssaver01 dir\installer.swf
  2007-12-29 00:35 36864 --a------ C:\WINDOWS\ndssaver01 dir\saver1.dll
  2007-12-29 00:35 18192 --a------ C:\WINDOWS\ndssaver01 dir\saver2.dll
  2007-12-29 00:35 1404 --a------ C:\WINDOWS\ndssaver01 dir\expire.scf
  2007-12-29 00:35 1240 --a------ C:\WINDOWS\ndssaver01 dir\saver.dat
  
  ---- Directory of C:\WINDOWS\system32\NtmsData ----
  
  2008-01-08 23:47 84392 --a------ C:\WINDOWS\system32\NtmsData\NTMSIDX
  2008-01-08 23:47 118784 --a------ C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK
  2008-01-08 23:47 118784 --a------ C:\WINDOWS\system32\NtmsData\NTMSDATA
  2008-01-08 23:46 816 --a------ C:\WINDOWS\system32\NtmsData\NTMSREG
  
  ((((((((((((((((((((((((((((( snapshot@2008-01-19_23.42.39.82 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-01-19 15:38:14 1,138,688 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
  + 2008-01-19 16:20:42 1,138,688 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
  - 2008-01-19 15:38:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
  + 2008-01-19 16:20:42 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
  - 2008-01-19 15:38:14 1,142,784 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
  + 2008-01-19 16:20:42 1,142,784 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
  - 2008-01-19 15:38:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
  + 2008-01-19 16:20:42 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
  - 2008-01-19 15:38:14 10,547,200 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
  + 2008-01-19 16:20:42 10,563,584 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
  - 2008-01-19 15:38:14 172,032 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
  + 2008-01-19 16:20:42 172,032 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
  + 2000-08-31 00:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
  .
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 11:37 8818688]
  "ObjectDock"="C:\Program Files\ObjectDock\ObjectDock.exe" [2007-04-30 19:43 3450608]
  "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-02-24 08:32 188416]
  "Yz Shadow"="C:\Program Files\YzShadow\YzShadow.exe" [2006-02-24 10:51 172032]
  "WinExpose"="C:\expose\WinExpose.exe" [2006-11-25 14:20 301056]
  "Iconoid"="C:\Program Files\Iconoid\iconoid.exe" [2007-02-03 18:38 274432]
  "DesktopIconToy"="C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe" [ ]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "LaunchApp"="Alaunch" []
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-07 16:17 102491]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-07 16:16 692315]
  "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 05:00 208952]
  "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 05:00 59392]
  "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00 455168]
  "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 05:00 455168]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 19:31 126976]
  "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07 32768]
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-24 21:22 5566464]
  "nwiz"="nwiz.exe" [2005-03-24 21:22 1495040 C:\WINDOWS\system32\nwiz.exe]
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-24 21:22 98304]
  "SoundMan"="SOUNDMAN.EXE" [2004-12-01 15:54 77824 C:\WINDOWS\soundman.exe]
  "AGRSMMSG"="AGRSMMSG.exe" [2005-04-15 11:45 88202 C:\WINDOWS\AGRSMMSG.exe]
  "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 110592 C:\WINDOWS\system32\bthprops.cpl]
  "EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-04-21 10:13 188416]
  "ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
  "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2005-10-14 15:38 487424]
  "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
  "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-24 11:20 579072]
  "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
  "System Files Updater"="C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe" [2006-02-26 07:41 118485]
  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-19 20:16 286720]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-27 14:21 219136]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "RunNarrator"="Narrator.exe" [2006-10-04 16:48 48128 C:\WINDOWS\system32\narrator.exe]
  
  C:\Documents and Settings\zhao\Start Menu\Programs\Startup\
  wkcalrem.LNK - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2005-08-18 19:44:26]
  Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
  DiscMounter.lnk - C:\isystem\DiscMounter\DiscMounter.exe [2007-10-28 22:50:27]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-16 14:06:22]
  TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2007-07-16 14:14:11]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 01000000
  "NoSMHelp"= 01000000
  
  R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
  R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
  R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
  R2 int15.sys;int15.sys;C:\Acer\Empowering Technology\eRecovery\int15.sys [2005-01-13 14:46]
  R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
  R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
  R4 DritekPortIO;Dritek General Port I/O;C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2005-10-14 15:41]
  S3 pacdcacm;pacdcacm;C:\WINDOWS\system32\DRIVERS\pacdcacm.sys [2005-08-22 01:45]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a066964a-4013-11dc-9de7-00166f676599}]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  *Newly Created Service* - INT15.SYS
  *Newly Created Service* - PROCEXP90
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-01-15 06:13:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-01-20 00:23:17
  Windows 5.1.2600 Service Pack 2 FAT NTAPI
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  --------------------- DLLs Loaded Under Running Processes ---------------------
  
  PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
  -> C:\Program Files\ObjectDock\DockShellHook.dll
  -> C:\Program Files\UberIcon\UberIcon.dll
  .
  Completion time: 2008-01-20 0:23:57
  ComboFix-quarantined-files.txt 2008-01-19 16:23:56
  ComboFix2.txt 2008-01-19 15:42:58
  .
  2008-01-09 17:01:30 --- E O F ---
  
• ndmmxiaomayi

  20 Jan 08, 00:24

  Can you rescan the files. I don't want old results as scanners are updated all the time.
• asdfzhao

  20 Jan 08, 01:30

  File Setup1.exe received on 01.19.2008 17:17:56 (CET)
  Current status: finished
  Result: 0/32 (0%)
  Compact
  Print results Antivirus Version Last Update Result
  AhnLab-V3 2008.1.19.10 2008.01.18 -
  AntiVir 7.6.0.48 2008.01.18 -
  Authentium 4.93.8 2008.01.19 -
  Avast 4.7.1098.0 2008.01.19 -
  AVG 7.5.0.516 2008.01.18 -
  BitDefender 7.2 2008.01.19 -
  CAT-QuickHeal 9.00 2008.01.19 -
  ClamAV 0.91.2 2008.01.19 -
  DrWeb 4.44.0.09170 2008.01.19 -
  eSafe 7.0.15.0 2008.01.16 -
  eTrust-Vet 31.3.5470 2008.01.18 -
  Ewido 4.0 2008.01.19 -
  FileAdvisor 1 2008.01.19 -
  Fortinet 3.14.0.0 2008.01.19 -
  F-Prot 4.4.2.54 2008.01.19 -
  F-Secure 6.70.13260.0 2008.01.18 -
  Ikarus T3.1.1.20 2008.01.19 -
  Kaspersky 7.0.0.125 2008.01.19 -
  McAfee 5211 2008.01.18 -
  Microsoft 1.3109 2008.01.19 -
  NOD32v2 2807 2008.01.19 -
  Norman 5.80.02 2008.01.18 -
  Panda 9.0.0.4 2008.01.19 -
  Prevx1 V2 2008.01.19 -
  Rising 20.27.50.00 2008.01.19 -
  Sophos 4.24.0 2008.01.19 -
  Sunbelt 2.2.907.0 2008.01.17 -
  Symantec 10 2008.01.19 -
  TheHacker 6.2.9.191 2008.01.18 -
  VBA32 3.12.2.5 2008.01.19 -
  VirusBuster 4.3.26:9 2008.01.18 -
  Webwasher-Gateway 6.6.2 2008.01.18 -
  Additional information
  File size: 249856 bytes
  MD5: b9917fc4c836776765e311fff84dd534
  SHA1: 63cf6b3992f2058f6a5995293e1017627569f8b5
  PEiD: -
  
  File impborl.dll received on 01.19.2008 17:40:37 (CET)
  Current status: finished
  Result: 0/32 (0%)
  Compact
  Print results Antivirus Version Last Update Result
  AhnLab-V3 2008.1.19.10 2008.01.18 -
  AntiVir 7.6.0.48 2008.01.18 -
  Authentium 4.93.8 2008.01.19 -
  Avast 4.7.1098.0 2008.01.19 -
  AVG 7.5.0.516 2008.01.18 -
  BitDefender 7.2 2008.01.19 -
  CAT-QuickHeal 9.00 2008.01.19 -
  ClamAV 0.91.2 2008.01.19 -
  DrWeb 4.44.0.09170 2008.01.19 -
  eSafe 7.0.15.0 2008.01.16 -
  eTrust-Vet 31.3.5470 2008.01.18 -
  Ewido 4.0 2008.01.19 -
  FileAdvisor 1 2008.01.19 -
  Fortinet 3.14.0.0 2008.01.19 -
  F-Prot 4.4.2.54 2008.01.19 -
  F-Secure 6.70.13260.0 2008.01.18 -
  Ikarus T3.1.1.20 2008.01.19 -
  Kaspersky 7.0.0.125 2008.01.19 -
  McAfee 5211 2008.01.18 -
  Microsoft 1.3109 2008.01.19 -
  NOD32v2 2807 2008.01.19 -
  Norman 5.80.02 2008.01.18 -
  Panda 9.0.0.4 2008.01.19 -
  Prevx1 V2 2008.01.19 -
  Rising 20.27.50.00 2008.01.19 -
  Sophos 4.24.0 2008.01.19 -
  Sunbelt 2.2.907.0 2008.01.17 -
  Symantec 10 2008.01.19 -
  TheHacker 6.2.9.191 2008.01.18 -
  VBA32 3.12.2.5 2008.01.19 -
  VirusBuster 4.3.26:9 2008.01.18 -
  Webwasher-Gateway 6.6.2 2008.01.18 -
  Additional information
  File size: 12288 bytes
  MD5: 23a38a0f3b5fb112809c339725a9e318
  SHA1: 165dc2cb79d167b53bd35d42eb9ff33087040a19
  PEiD: -
  
  File flashax.exe received on 01.19.2008 18:17:45 (CET)
  Current status: finished
  Result: 1/32 (3.13%)
  Compact
  Print results Antivirus Version Last Update Result
  AhnLab-V3 2008.1.19.10 2008.01.18 -
  AntiVir 7.6.0.48 2008.01.18 -
  Authentium 4.93.8 2008.01.19 -
  Avast 4.7.1098.0 2008.01.19 -
  AVG 7.5.0.516 2008.01.18 -
  BitDefender 7.2 2008.01.19 -
  CAT-QuickHeal 9.00 2008.01.19 -
  ClamAV 0.91.2 2008.01.19 -
  DrWeb 4.44.0.09170 2008.01.19 -
  eSafe 7.0.15.0 2008.01.16 -
  eTrust-Vet 31.3.5470 2008.01.18 -
  Ewido 4.0 2008.01.19 -
  FileAdvisor 1 2008.01.19 -
  Fortinet 3.14.0.0 2008.01.19 -
  F-Prot 4.4.2.54 2008.01.19 -
  F-Secure 6.70.13260.0 2008.01.18 -
  Ikarus T3.1.1.20 2008.01.19 -
  Kaspersky 7.0.0.125 2008.01.19 -
  McAfee 5211 2008.01.18 -
  Microsoft 1.3109 2008.01.19 -
  NOD32v2 2807 2008.01.19 -
  Norman 5.80.02 2008.01.18 -
  Panda 9.0.0.4 2008.01.19 -
  Prevx1 V2 2008.01.19 -
  Rising 20.27.50.00 2008.01.19 -
  Sophos 4.24.0 2008.01.19 -
  Sunbelt 2.2.907.0 2008.01.17 -
  Symantec 10 2008.01.19 -
  TheHacker 6.2.9.191 2008.01.18 -
  VBA32 3.12.2.5 2008.01.19 -
  VirusBuster 4.3.26:9 2008.01.18 -
  Webwasher-Gateway 6.6.2 2008.01.18 Win32.Malware.gen#ASPack (suspicious)
  Additional information
  File size: 545280 bytes
  MD5: 5d40463ffe13845fd7be05582ee536f7
  SHA1: b9ed361dd140b5bbf09406e3d8a9c5ffd64cd352
  PEiD: -
  packers: Aspack
  packers: ASPack
• asdfzhao

  20 Jan 08, 01:32

  hjt log
  
  Logfile of HijackThis v1.99.1
  Scan saved at 01:31:39, on 20/01/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Acer\eManager\anbmServ.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\Tablet.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\acer\epm\epm-dm.exe
  C:\PROGRA~1\LAUNCH~1\LManager.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\ObjectDock\ObjectDock.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Program Files\YzShadow\YzShadow.exe
  C:\expose\WinExpose.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\WINDOWS\system32\WTablet\TabUserW.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  C:\isystem\DiscMounter\DiscMounter.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\notepad.exe
  D:\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Loader Class - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - C:\Program Files\findexer\FindeXer.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [ObjectDock] C:\Program Files\ObjectDock\ObjectDock.exe
  O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKCU\..\Run: [Yz Shadow] C:\Program Files\YzShadow\YzShadow.exe
  O4 - HKCU\..\Run: [WinExpose] "C:\expose\WinExpose.exe"
  O4 - HKCU\..\Run: [Iconoid] "C:\Program Files\Iconoid\iconoid.exe"
  O4 - HKCU\..\Run: [DesktopIconToy] C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe
  O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: DiscMounter.lnk = C:\isystem\DiscMounter\DiscMounter.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
  O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
  O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
  O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {A91DEB0D-AD0D-453E-9AC8-60178EC24212} (VPlayer Control) - http://www.sonypictures.com/movies/casinoroyale/vividas/player/vivid_ocx.jpeg
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
  O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
  O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
  O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.89.cab
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
  
  
• ndmmxiaomayi

  20 Jan 08, 01:51

  Please download Ewido Micro Scanner and save it to your desktop.
  
  Double click to run it. It will start downloading the signatures. If your firewall prompts, please allow it.
  
  Once the signatures are downloaded, click on Start Scan.
  
  Once done, click on Save Report. Save it to your desktop.
  
  Please post back this log in your next reply.
• asdfzhao

  21 Jan 08, 11:30

  __________________________________________________
  ewido anti-spyware online scanner
  http://www.ewido.net
  __________________________________________________
  
  Name: TrackingCookie.Tribalfusion
  Path: C:\Documents and Settings\zhao\Cookies\zhao@tribalfusion[1].txt
  Risk: Medium
  
  Name: TrackingCookie.Adbrite
  Path: C:\Documents and Settings\zhao\Cookies\zhao@adbrite[2].txt
  Risk: Medium
  
  Name: TrackingCookie.2o7
  Path: C:\Documents and Settings\zhao\Cookies\zhao@2o7[2].txt
  Risk: Medium
  
  Name: TrackingCookie.Adbrite
  Path: C:\Documents and Settings\zhao\Cookies\[email protected][1].txt
  Risk: Medium
  
  Name: TrackingCookie.2o7
  Path: C:\Documents and Settings\zhao\Cookies\[email protected][1].txt
  Risk: Medium
  
  Name: TrackingCookie.Netflame
  Path: C:\Documents and Settings\zhao\Cookies\[email protected][1].txt
  Risk: Medium
  
  Name: TrackingCookie.Euroclick
  Path: C:\Documents and Settings\zhao\Cookies\[email protected][1].txt
  Risk: Medium
  
  Name: TrackingCookie.Questionmarket
  Path: C:\Documents and Settings\zhao\Cookies\zhao@questionmarket[2].txt
  Risk: Medium
  
  Name: TrackingCookie.2o7
  Path: C:\Documents and Settings\my com\Cookies\my [email protected][1].txt
  Risk: Medium
  
  Name: TrackingCookie.Msn
  Path: C:\Documents and Settings\my com\Cookies\my [email protected][2].txt
  Risk: Medium
  
  Name: TrackingCookie.Netflame
  Path: C:\Documents and Settings\my com\Cookies\my [email protected][2].txt
  Risk: Medium
  
  Name: TrackingCookie.Statcounter
  Path: C:\Documents and Settings\my com\Cookies\my com@statcounter[1].txt
  Risk: Medium
  
  Name: TrackingCookie.2o7
  Path: C:\Documents and Settings\my com\Cookies\my com@2o7[2].txt
  Risk: Medium
  
  Name: TrackingCookie.Atdmt
  Path: C:\Documents and Settings\my com\Cookies\my com@atdmt[1].txt
  Risk: Medium
  
  Name: TrackingCookie.Doubleclick
  Path: C:\Documents and Settings\my com\Cookies\my com@doubleclick[1].txt
  Risk: Medium
  
  Name: TrackingCookie.Questionmarket
  Path: C:\Documents and Settings\my com\Cookies\my com@questionmarket[1].txt
  Risk: Medium
  
  Name: TrackingCookie.Revsci
  Path: C:\Documents and Settings\my com\Cookies\my com@revsci[1].txt
  Risk: Medium
  
  
• ndmmxiaomayi

  21 Jan 08, 11:36

  Please go to Kaspersky website and perform an online antivirus scan. Please use Internet Explorer as it uses ActiveX.
  
  

  [*]Click on Kaspersky Online Scanner button.
  [*]Read through the requirements and privacy statement and click on Accept button.
  [*]It will start downloading and installing the scanner and virus definitions. You will be prompted to install an ActiveX from Kaspersky. Click Yes.
  [*]When the downloads have finished, click on Next button.
  [*]Click on Scan Settings button.
  [*]Select extended under Scan using the following antivirus database:
  [*]Check (tick) these boxes under Scan options:
  [*]Scan Archives
  [*]Scan Mail Bases
  [*]Click OK
  [*]Click on My Computer under Please select a target to scan:
  [*]Once the scan is complete it will display if your system has been infected. Click on Save as text button and save it to your desktop.
  [*]Copy and paste this log in your next reply.
• <Precious>

  21 Jan 08, 11:39

  TS must be surfing porn........
• metalcar

  21 Jan 08, 11:40

  Originally posted by asdfzhao:

  stupid thumbdrives transferred visuses to me again!
  now i think its getting from bad to worse!

  i tink u cant be worst than me.. i cannot use control panel.. cannot use ctrl+alt+delete.. cannot use clock.. cannot set a wallpaper.. no screensavers
• [email protected]

  21 Jan 08, 12:03

  Originally posted by :

  TS must be surfing porn........

  I think so too..
• maurizio13

  21 Jan 08, 12:05

  I'd rather fdisk and format /u.
  
  That way I can ensure total annihilation of all the virus.
• ndmmxiaomayi

  21 Jan 08, 12:12

  Originally posted by metalcar:

  i tink u cant be worst than me.. i cannot use control panel.. cannot use ctrl+alt+delete.. cannot use clock.. cannot set a wallpaper.. no screensavers

  Ultimate!
  
  I roughly know what infections you have.
• asdfzhao

  21 Jan 08, 13:18

  Originally posted by :

  TS must be surfing porn........

  when your com kenna virus from other ppl's thumbdrive i will laugh at you!
• asdfzhao

  21 Jan 08, 13:21

  Originally posted by maurizio13:

  I'd rather fdisk and format /u.
  
  That way I can ensure total annihilation of all the virus.

  can't format. too much of my precious data inside.
  n format too many times no good for the hdd.
• maurizio13

  21 Jan 08, 13:24

  Originally posted by asdfzhao:

  can't format. too much of my precious data inside.
  n format too many times no good for the hdd.

  1) Get another hard disk
  
  2) Install an operating system there
  
  3) Set your newly installed hard disk as boot
  
  4) Copy files over from old hard disk
  
  5) Get an anti virus to do a thorough scan
  
  6) After you sure your data is safe, you can format your old hard disk
  
  Hard disk are cheap these days.
• asdfzhao

  21 Jan 08, 15:50

  KASPERSKY ONLINE SCANNER REPORT
  Monday, January 21, 2008 3:47:45 PM
  Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
  Kaspersky Online Scanner version: 5.0.98.0
  Kaspersky Anti-Virus database last update: 21/01/2008
  Kaspersky Anti-Virus database records: 525364
  
  Scan Settings
  Scan using the following antivirus database extended
  Scan Archives true
  Scan Mail Bases true
  
  Scan Target My Computer
  C:\
  D:\
  E:\
  F:\
  
  Scan Statistics
  Total number of scanned objects 146110
  Number of viruses found 4
  Number of infected objects 12
  Number of suspicious objects 0
  Duration of the scan process 01:05:55
  
  Infected Object Name Virus Name Last Action
  C:\WINDOWS\system32\config\system.LOG Object is locked skipped
  
  C:\WINDOWS\system32\config\software.LOG Object is locked skipped
  
  C:\WINDOWS\system32\config\default.LOG Object is locked skipped
  
  C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
  
  C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
  
  C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
  
  C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
  
  C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
  
  C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
  
  C:\WINDOWS\system32\config\SECURITY Object is locked skipped
  
  C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
  
  C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
  
  C:\WINDOWS\system32\config\SAM Object is locked skipped
  
  C:\WINDOWS\system32\drivers\sptddrv1.sys Object is locked skipped
  
  C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
  
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
  
  C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
  
  C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
  
  C:\WINDOWS\system32\h323log.txt Object is locked skipped
  
  C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
  
  C:\WINDOWS\wiaservc.log Object is locked skipped
  
  C:\WINDOWS\SoftwareDistribution\EventCache\{A04FAD7D-0ED8-4BC6-8877-DA39A35C0AD9}.bin Object is locked skipped
  
  C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
  
  C:\WINDOWS\wiadebug.log Object is locked skipped
  
  C:\WINDOWS\Sti_Trace.log Object is locked skipped
  
  C:\WINDOWS\TempFile Object is locked skipped
  
  C:\WINDOWS\WindowsUpdate.log Object is locked skipped
  
  C:\WINDOWS\SchedLgU.Txt Object is locked skipped
  
  C:\WINDOWS\FlyakiteOSX\Tools\wfpdisable.exe Infected: not-a-virus:RiskTool.Win32.WFPDisabler.a skipped
  
  C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
  
  C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
  
  C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
  
  C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
  
  C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  
  C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
  
  C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
  
  C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
  
  C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
  
  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  
  C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
  
  C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
  
  C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\ntuser.dat.LOG Object is locked skipped
  
  C:\Documents and Settings\zhao\Local Settings\History\History.IE5\index.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  
  C:\Documents and Settings\zhao\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Cookies\index.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\Application Data\Opera\Opera\mail\indexer\indexer_512.dat Object is locked skipped
  
  C:\Documents and Settings\zhao\ntuser.dat Object is locked skipped
  
  C:\Program Files\Sygate\SPF\debug.log Object is locked skipped
  
  C:\Program Files\Sygate\SPF\syslog.log Object is locked skipped
  
  C:\Program Files\Sygate\SPF\seclog.log Object is locked skipped
  
  C:\Program Files\Sygate\SPF\tralog.log Object is locked skipped
  
  C:\Program Files\Sygate\SPF\rawlog.log Object is locked skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP331\A0120231.exe Infected: Worm.Win32.RJump.a skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP344\A0123901.exe Infected: not-a-virus:RiskTool.Win32.WFPDisabler.a skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP347\A0125098.exe/stream/data0023 Infected: not-a-virus:RiskTool.Win32.WFPDisabler.a skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP347\A0125098.exe/stream Infected: not-a-virus:RiskTool.Win32.WFPDisabler.a skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP347\A0125098.exe NSIS: infected - 2 skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP359\A0126198.DLL Infected: Trojan-PSW.Win32.OnLineGames.nsl skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP361\A0126288.dll Infected: Trojan-PSW.Win32.OnLineGames.nsl skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP361\A0126289.com Object is locked skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP362\A0126374.dll Infected: Trojan-PSW.Win32.OnLineGames.nvn skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP363\A0126435.dll Infected: Trojan-PSW.Win32.OnLineGames.nvn skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP363\A0126438.com Object is locked skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP363\A0126440.exe Object is locked skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP364\A0126450.dll Infected: Trojan-PSW.Win32.OnLineGames.nvn skipped
  
  C:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP365\change.log Object is locked skipped
  
  C:\QooBox\Quarantine\C\WINDOWS\system32\kavo0.dll.vir Infected: Trojan-PSW.Win32.OnLineGames.nvn skipped
  
  D:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP361\A0126290.com Object is locked skipped
  
  D:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP363\A0126439.com Object is locked skipped
  
  D:\System Volume Information\_restore{5A642873-CC12-4861-8594-8E802081E708}\RP365\change.log Object is locked skipped
  
  F:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped
  
  Scan process completed.