17 replies to this topic

[dchen]

Many thanks for providing MalwareBytes! I got the "google redirect" problem; installed malwarebytes; and was able to fix my original problem. On subsequent rescans, I notice about 250 new items every time. After quarantine and deletion it seems the file names have changed slightly each time. Attached are the logs...


hijackthis.log
==========
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:45 AM, on 2/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 8639 bytes





mbam-log-2009-02-22 (09-42-09).txt
=============================
Malwarebytes' Anti-Malware 1.34
Database version: 1792
Windows 5.1.2600 Service Pack 3

2/22/2009 9:42:09 AM
mbam-log-2009-02-22 (09-42-09).txt

Scan type: Full Scan (C:\|)
Objects scanned: 215677
Time elapsed: 1 hour(s), 7 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 254

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock v2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Presentation Wizard v2.0.24a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Presto Transfer My Photos 1.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prey iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PrimalScript 4 Professional.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia - The Two Thrones.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones 3RIPS Technic KPS RFG.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\#1 Video Converter 3.8.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\.C.A.R. Squadra Corse Alfa Romeo 2005.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\007 - Live And Let Die ( 1973 ).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\007 Live and Let Die.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 Click DVD COPY 5.0.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper v5.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\100 Hojdare S01E06 PDTV XViD SWEDiSH SQC 3246813....exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Business.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Rtm En Nl.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Unveiled.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP 9 In 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Gold Edition 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Password Administrator 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Pro SP2 OEM Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional Corporate SP2 Octob.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional SP2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP SP3 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.70.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.64.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro v4.0A.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Detector Enterprise v2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.5.0.478.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.8.0.2582 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2603Latest Build.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2621 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v.4.0.0.2613.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.02602.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor ver.5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Die Hard.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Anarchy Texture v2.0 For Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v4.5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Camera Media Studio 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Film Tools EZ Mask v1.01 for Adobe Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1Click DVD Copy Pro 1.x.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\2 Fiddy MP3 Alarm Pro 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\3D Live Pool v2.64.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\A Secret Handshake 2007 DVDRip XviD-VoMiT.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D v8.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Photoshop 8 cs with cracks by lestercity12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Repair v1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v3.5.738..exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Hackman Hex Editor 9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 Collectors Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Nelson 2006 DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 - Digital Zone (ISO), Half-Life 2 Valve.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Episode One iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 4.6.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup v.5.4.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal Rising 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Happy Feet 2006 FS DVDRip XviD-LRC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trillian 3 Pro Alpha 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Pro 3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v. 6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover ver.6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Crime New York City CLONEDVD-PLEX.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Launch Bar v2.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power-on and Shut-down 1.44.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto USdownloder.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoCAD AutoCAD LT All-in-One Desk Reference For Du.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk 3D Studio MAX 9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Alias Studio Tools v13.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Autocad 2007 Professional.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD v.2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Inventor Professional v11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Maya v8.5 - 64 Bits.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Revit Structure 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoDWG DWGSee 2006 v1.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automate unDRM DRM is cracked.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.02 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize Enterprise v7.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoPatcher for Windows XP SP 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 9.64 final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 v9.64.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v10.10.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Powerdesk Pro 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 7 NO Activation or Keygen or Sno..exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Powerful Cookies v1.0.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO v.3.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 5.7.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v.6.2.0.1254.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.3.0.2132.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall v.4.3.268.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinAVI Video Converter V. 7.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Professional v2.1.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinBoost 4.46.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Window Builder Pro v5.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5 Build 49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds v5.02 Golden.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Windows 2003 - Tiny Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Professional 7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Extreme Chickfights 2006 DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Extreme Movie Manager Pro v4.4.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ Extract Resource v1.82.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ Soft MP3 CD Ripper v1.71b1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZB Systems EasyBoot 5.1.0.565.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F-Secure Anti-Virus Client Security v5.55.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R First Encounter Assault Recon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. First Encounter Assault and Recon iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.199c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO - Coffee Cup Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO ASTROLOGICAL SOFT.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO DVD X Studios.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Mobile Phone Unlocker.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Recovery 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO total security PC 2006 NEW.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Air Assault Task Force iSO PC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rock Manager.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa 2007 DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky II.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rogue Remover v1.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\RollerCoaster Tycoon 3 Wild.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rome Season 2 Episode 10 HDTV.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Romeo And Juliet Sealed With A Kiss.DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Room 6 2006 DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Charm DVD To Real Converter v5.9.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter Pro v5.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\CheckMail v.3.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Nvidia DVD Player New.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA Gelato v2.0 R1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA PureVideo Decoder v1 02 233.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O DIA DA PROVAÇÃO rar rar.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O Defrag Professional 6.5.851.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O UnErase V4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\ObjectRescue AnyReader v2.0.85.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\ObjectWipe 1.5.88.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Tenacious D CAM Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Test Drive AMG 2005 avi.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Texas Calculatem 4.2.33.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Texas Chainsaw MassacreThe Beginning DVDrip 2006 UNR.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Text To Speech Maker V1.3.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Textaloud Mp3 2.150.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\007 DVD Copy v5.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\10 Items Or Less LIMITED DVD SCREENER XviD-VideoCD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\123 Flash Image Extractor 1.20.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Macromedia Adobe Fireworks 8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Macromedia Dreamweaver v. 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Audio Converter v8.3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Copier 3.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Ripper 4.3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Image Resizer v1.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Mp3 CD Burner v3.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Translator v6.00.5777.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2006 4.22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2007 5.01.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Video Converter 8.0.1.18.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\StudioLine Photo Basic 3.4.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Sublime dvdrip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Sudoku Maya Gold v1.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Doctor in Distress.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Doom 3 Resurrection of Evil iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Download Accelerator 4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Download Accelerator Plus Premium v8.121.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr Explain 1.5.36.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr. Explain v2.0.60 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr.Web 4.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\A Bugs Life.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Adobe FrameMaker v7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Advanced File Worker v2.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AI Roboform v6.59.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alien Skin Software Collection - Plugins for Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Apollo DVD Creator v2.9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Arial Audio Converter v2.3.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Ashampoo Burning Studio 5 5.0.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Audio CD Toolkit 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Aurora MPEG To DVD Burner 4.7.5.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AutoUpdate Plus v2.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Pixarra TwistedBrush v11.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD Copy v6.68.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD Ripper 5.63.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD to MP3 Ripper v4.41.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Video Joiner v3.48.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Batch and Print Pro v2.03.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Batch Video Converter v2.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Battlefront-HATRED iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\BearShare PRO 5.2.4 FULL with CRACK.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Undergångenl Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Unreal Tournament 2004.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\URL Helper v2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Golden FTP Server Pro 2.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Google Earth 4 Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Google SketchUp Pro v6.0.312.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Graphics Converter Pro v6.36.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Saw 3 CAM SVCD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Sci Fi Inside Sci Fi Friday 2005 (XSVCD).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Screen Virtuoso Pro 2.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\WWW File Share Pro v3.20.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\X Men [192K].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\X-Men 3 The Last Stand DVDrip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\CHM Editor 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\City Hunter Episode 01 [Remastered R2J] mkv.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Civilization IV PC iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Disk Security v7.58.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\CleanCenter 1.34.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clipboard Box 3.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clock Tray Skins v2.85.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clone DVD -Version- 4.01.2516.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AIO CoffeeCup_design.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AIO Security Pack.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Air Force One (1997).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alarm Master Plus v4.14.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alias S05E02 HR HDTV AC3 5 1 XviD NBS.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7 Ultra Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Burning ROM 6.6.0.14.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero MediaPlayer v1.4.0.33.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Premium 7.5.9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero SIPPS v2.1.3.15.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero7 Premium Reloaded v.7.5.02 - ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Net Limiter v.2.0 alpha 4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\NetConceal Anonymizer 3.6.41.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\NetScream 1.12.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Network LookOut Administrator v2.01.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\ExpressionEngine 1.4.1.2006.01.11, NULL SCRiPTMAFiA.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Extra Drive Creator Pro v6.3 Rus.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Extreme ChickFight DVDRip - RS.com links.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Ez Mp3 Creator V1.3.9.390.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\FairStars Recorder 2.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Family Guy Live in Vegas.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Fantastic Four.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Network Tools Collection.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Cleaner.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Accelerator 5.0.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Accelerator v5.2.1.1057.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.02 Build 14.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager V 5.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.02.09.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.043.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Explorer 7 Beta 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Password Lock v2.3.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\InterVideo MP3 dvd Xpack Plugin for Windows Media Playe.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Intervideo WinDVD Platinum v8.0 Build 06.104 Release 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Sims2 + all 3 expansions.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Southpark Collection 1, 2, 3, 4, 5, 6, 7, 8, 9, 10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Storm Eye Of The Storm 1995 iONx 3376789 TPB.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Tooth Fairy German 2006 DVDRiP XviD-FmE.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Ultimate Pub Challenge Interactive Quiz.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Ward.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Wicker Man 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Year Without a Santa Claus 2006 DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

[AdvancedSetup]

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA
When we're done you can go back and install the latest version but for now please do not install any.

Then run this tool to help cleanup any left over Java
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please download JavaRa and unzip it to your desktop.
***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java

Then run the following tool

Download and install CCleaner

• CCleaner
  
• Double-click on the downloaded file "ccsetup216.exe" and install the application.
  
• Keep the default installation folder "C:\Program Files\CCleaner"
  
• Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
  
• Click finish when done and close ALL PROGRAMS
  
• Start the CCleaner program.
  
• Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  
• Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  
• Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  
• Click on Run Cleaner button on the bottom right side of the program.
  
• Click OK to any prompts

Then run this tool

[indent]Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.
Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:
ComboFix.exe
ComboFix.exe
ComboFix.exe


Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Yes to allow ComboFix to continue scanning for malware.
  
• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

[/indent]

[dchen]

Ran all programs as suggested--took about 2 hours to do. Posting logs ...
Thanks for the help!
-dchen


=====================

ComboFix 09-02-21.01 - david 2009-02-23 22:50:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.245 [GMT -5:00]
Running from: c:\documents and settings\david\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\winupdates
c:\program files\winupdates\a.zip
c:\windows\IE4 Error Log.txt
c:\windows\system32\bszip.dll
c:\windows\system32\taskkill.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))
.

2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner
2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-20 20:11 . 2009-02-20 20:11 0 --a------ c:\windows\system32\drivers\nfr.dll.gpref

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 03:26 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-21 02:25 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-17 00:46 --------- d-----w c:\program files\Google
2008-12-29 03:52 --------- d-----w c:\documents and settings\david\Application Data\U3
2008-12-27 20:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-27 20:01 --------- d-----w c:\program files\Canon
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:nfr
"7070:TCP"= 7070:TCP:nfr

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]
R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]
R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]
R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]
R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]
R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]
\Shell\Auto\command - E:\winsys2.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL winsys2.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://slashdot.org/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-23 22:56:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-23 23:01:42
ComboFix-quarantined-files.txt 2009-02-24 04:00:42

Pre-Run: 31,987,781,632 bytes free
Post-Run: 34,698,899,456 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

123 --- E O F --- 2009-02-11 08:03:24



========================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:44 PM, on 2/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 7909 bytes

[dchen]

Re-ran the malwarebytes scan (updated first) -- Trojan.Dropper still seems to be active! Attached is the log, and from HijackThis.
Thanks!
-dchen


=====================
Malwarebytes' Anti-Malware 1.34
Database version: 1798
Windows 5.1.2600 Service Pack 3

2/24/2009 6:08:31 AM
mbam-log-2009-02-24 (06-08-31).txt

Scan type: Full Scan (C:\|)
Objects scanned: 161035
Time elapsed: 33 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 217

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock 2.42.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Presentation Wizard 2.0a patch 47.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prey full ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince Of Persia - 4 Version.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia Sands of Time-TECHNiC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\#1 DVD Ripper ver. 5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\(ø¨÷ 12¤ë§@«~)Ãu¤á´f¤l¡B¥ß³¥¥ú ªñ¿Ë¬Û«Á¨t¦C,²]....exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\007 - For Your Eyes Only DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\007 DVD Maker v3.72.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 click and lock 3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper 5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\100 Girls 2000 Unrated DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Build 5381.1 32Bit DVD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Final RTM All Versions 3 Mirror.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista RC2 Build 5744 +Crack + RUS + T.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Ultimate X86 Preactivated DVD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP 64 Bit Retail.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Xp From Usb-stick Edition Win Xp P.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Media Center Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Pro SP2 Corporate.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional Corp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional SP2 Corporate + Keys.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP ServicePack 4 Build X.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.25.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.65.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.44.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro 5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware and Adware Removal v3.0d.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.2.1.359.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.8.0.2575 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2603 + Reg fix + Cracked EXE.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2620 for Windows-New Version.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 5.0.0.186.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.8.0.2575.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.0.2620.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor ver. 4.0.0.2613 8.99 Mb.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Die Hard DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Anarchy BackDrop v1.0 For Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v2.9.6.495.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor ver.7.8.5 build 550.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Film Tools EZ Mask for Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1CLICK DVD Copy 5.2.2.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\2 Fast 2 Real II 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\3D Its me v.2.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\A Scanner Darkly DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1 Workstation Enterprise Server.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D v7.0.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Photoshop 7.0 Classroom in a Book.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Password Recovery.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v3.0.530..exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 Episode One iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 Episode one with update 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\half life.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Episode 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Episode 1 iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 5.x.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Taskman S60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal DVD RIP.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Happy Feet - RELOADED iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Pro 3.1.121.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.0.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v6.54.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Crime Streets of LA iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Image Workstation v9.1.3718 Retail.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power-on & Shut-down 1.42.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Shutdown Timer - EasySleep.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk 3D Studio MAX 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk 3DS Max V9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Autocad 2007 Crack.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD Mechanical v2007 New Link.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Inventor 10 Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk MAYA v.8.5 Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Revit Building v.9.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoDWG Attribute Extractor v2.653.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 6.28 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.32 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoPatcher for Windows XP SP 2 (32-bit).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 9.63.01.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 v9.62.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v10.00.36-FIXED.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 7 Deluxe + Keygen.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Powerful Cookies 1.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO 3.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 6.3.1 Build 2402.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.2.1 Build 1663.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall 4.3.246.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinAVI Video Converter 8.0 Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Pro v2.1.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Window Blinds Enhanced 5.01.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Window Washer Computer Privacy 3.1.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Windowblinds v4.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Windows 100 Genuine in 2 seconds.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Professional 4.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\eXtreme Movie Manager 5.7.5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ Backup Office Premium v.4.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ Screen Recorder v2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F E A R Multiplayer closed Beta 3318549 TPB.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F-Secure Anti Virus For Workstations V7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R Combat v1.07.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. Extraction Point 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.162.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO - 40 Hack tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Anonymous IP Toolz.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Defragment Ashampoo OO Defrag etc.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO ISO Virtual Drive Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Quick Apps 40in1 Dec 2006 all Newest Versions.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Steganos.com 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Air America Radio The Rachel Maddow Show 02 27 06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rock Album.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa 2006 DVDSCR XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa XViD DVDScreener-Distill.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\RollerCoaster Tycoon 3 Soaked.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rome s2 e3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Room 6 ( 2006 )DVD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter Pro 6.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.41.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\CheckMail 2.3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA DVD Decoder 1.00.58.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA Gelato Pro v2.0.R4 + Crack.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA PureVideo Decoder 1.02.223.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O Defrag Pro 8.0.1398.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O UnErase 2.0.945.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\ObjectDock 1.3 released.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\ObjectRescue Pro v4.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Ten Thumbs Typing Tutor v4.3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Texas Chainsaw Massacre The Begining.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Text To Speech Live Player 1.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\TextAloud 2.194.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\007 DVD Copy 5.17.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\123 DVD Converter v3.8.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Macromedia Dreamweaver 8.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic ASCII art gen.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic C Plus Plus v3.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Ripper 3.6.1 + Keygen.rar.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Ripper v4.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Iso Maker V5.2.0 Build 191.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\MAGiC TRACER v1.5.006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2005 v3.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2006 v4.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\MAGic v10.00.867.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Download Amadis Apple TV Converter v1.0.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Download Accelerator Plus Premium 8.1..exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr. Dolittle 3 DVDRip Xvid - 26 03 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr.Hardware 2007 Premium Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\A Beautiful Mind.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Adobe Flex Builder v2.0.143459.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Advanced File Lock v5.0.2650.40550.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AI Roboform Pro v6.9.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alien Skin Exposure v1.0 for Adobe Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Apollo DVD Creator v2.2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Arial Audio Converter 2.3.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Ashampoo Burn Ya Audio CD 2.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Audio Capture v1.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Aurora Media Workshop ver. 3.3.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Pixarra TwistedBrush v10.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Dvd Copy 4.57.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD Ripper 4.33.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD to MP3 Ripper 4.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Video Creator v3.16.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Batch Rename Pro v3.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Battlefield 2142 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\BearShare Pro 5.2.0.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Unreal 2 The Awakening.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\URL Explorer 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Golden Eye 4.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Google Desktop v4.2006.623.2309.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Google Earth Professional 4.0.2737 Included Patch.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Graphics Converter Pro 6.80.70112.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Screen Saver Construction Set v2.0.19a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\WWW File Share Pro 5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\X Codec Pack 1.8.0.141.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Civilisation IV.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Disk Security v7.5 DateCode 080420.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Space v9.65.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clip Console 1.1.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clock Machine v3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AIO - XBOX SOFTMODDING [2006].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AIO Printers Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Air Assault 3D.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alarm for Cobra 11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alias Maya Unlimited 7.0.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7 Premium v7.2.3.2b.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Media Player 1.4.0.25.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Premium 7 0 1 4 N MULTiLANGUAGE iSO MATRiX.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Premium v7.0.8.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero v7.0.1.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Net Control 2 v4.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Network LookOut Administrator Pro v2.0.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Express Plus v2.1.2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\EZ Extract Resource v1.82.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\FairStars Audio Converter v1.54.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Family Guy - Happy Freakin Christmas 2006 DVDRip XVID.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Fantastic Flame v3.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\International Volleyball 2006 FRENCH-CoNsTaNtInE.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Business Promoter.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Accelerator 4.1.2.845.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Accelerator v5.1.1.1045.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.01.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.08.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.01.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.02.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Kiosk Pro v2.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Intervideo iVideoToGo PSP v4 5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Intervideo WinDVD Platinum 8.0 Build 06.101.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Sims 8in1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Sopranos - Seasons 1 - 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Stalin Subway.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Third Wave.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Ultimate Football Interactive Quiz.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Village.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Wickeds 2005.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The X - Files (9 Seasons).exe (Trojan.Dropper) -> Quarantined and deleted successfully.






=========================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:08 AM, on 2/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 7875 bytes

[AdvancedSetup]

Sorry quite late here now and I need some sleep. Will review tomorrow and provide more feedback.

[dchen]

Hi AdvancedSetup, do you have anything new that I can try to remove the Trojan.Dropper? I've been running malwarebytes regularly with the updates with no luck.
Many Thanks!
-dchen

[AdvancedSetup]

I'm sorry dchen. If I've not replied back within 24 hours please post again - sometimes I get busy and miss getting back to the post because I don't see it as new.


Let's try a new approach.

STEP 01
[indent]Download DDS and save it to your desktop
http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.
Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr to run the tool.
When done, the DDS.txt will open.
Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

• DDS.txt
  
• Attach.txt

• Save both reports to your desktop
  
• Please include the following logs in your next reply: DDS.txt and Attach.txt

[/indent]

STEP 02

Please create a BOOTLOG

• Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  
• Select "Enable Boot Logging" option and press enter.
  
• Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  
• This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
  
  If you're already running inside Windows you can enable it the following way.
  
  
• Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
  
• Click on OK and you will be prompted to RESTART Windows. Please do restart now.
  
• After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
  
• From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.

STEP 03
Delete your current copy of Combofix.exe and download a NEW fresh copy and run that and post back it's log.

Additional links to download the tool:
ComboFix.exe
ComboFix.exe
ComboFix.exe

[dchen]

Hi AdvancedSetup, thanks for the new instructions!
I have included the DDS files as attachments.
-dchen



The BOOTLOG file is below:
=====================
Service Pack 3 3 1 2009 19:55:40.375
Loaded driver \WINDOWS\system32\ntoskrnl.exe
Loaded driver \WINDOWS\system32\hal.dll
Loaded driver \WINDOWS\system32\KDCOM.DLL
Loaded driver \WINDOWS\system32\BOOTVID.dll
Loaded driver ACPI.sys
Loaded driver \WINDOWS\System32\DRIVERS\WMILIB.SYS
Loaded driver pci.sys
Loaded driver isapnp.sys
Loaded driver pciide.sys
Loaded driver \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Loaded driver MountMgr.sys
Loaded driver ftdisk.sys
Loaded driver PartMgr.sys
Loaded driver VolSnap.sys
Loaded driver atapi.sys
Loaded driver disk.sys
Loaded driver \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Loaded driver fltmgr.sys
Loaded driver sr.sys
Loaded driver PxHelp20.sys
Loaded driver KSecDD.sys
Loaded driver PenClass.sys
Loaded driver Ntfs.sys
Loaded driver NDIS.sys
Loaded driver Mup.sys
Loaded driver agp440.sys
Loaded driver \SystemRoot\System32\DRIVERS\intelppm.sys
Loaded driver \SystemRoot\System32\DRIVERS\nv4_mini.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbuhci.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbehci.sys
Loaded driver \SystemRoot\system32\DRIVERS\HSFHWBS2.sys
Loaded driver \SystemRoot\system32\DRIVERS\HSF_DP.sys
Loaded driver \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
Loaded driver \SystemRoot\System32\Drivers\Modem.SYS
Loaded driver \SystemRoot\System32\DRIVERS\bcm4sbxp.sys
Loaded driver \SystemRoot\System32\DRIVERS\i8042prt.sys
Loaded driver \SystemRoot\System32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\point32.sys
Loaded driver \SystemRoot\System32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\System32\DRIVERS\parport.sys
Loaded driver \SystemRoot\System32\DRIVERS\imapi.sys
Loaded driver \SystemRoot\System32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\System32\DRIVERS\redbook.sys
Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys
Loaded driver \SystemRoot\system32\drivers\smwdm.sys
Loaded driver \SystemRoot\system32\drivers\aeaudio.sys
Loaded driver \SystemRoot\System32\DRIVERS\audstub.sys
Loaded driver \SystemRoot\System32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspppoe.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\System32\DRIVERS\msgpc.sys
Loaded driver \SystemRoot\System32\DRIVERS\psched.sys
Loaded driver \SystemRoot\System32\DRIVERS\ptilink.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspti.sys
Loaded driver \SystemRoot\system32\DRIVERS\pvsvnic.sys
Loaded driver \SystemRoot\System32\DRIVERS\termdd.sys
Loaded driver \SystemRoot\System32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\System32\DRIVERS\update.sys
Loaded driver \SystemRoot\System32\DRIVERS\mssmbios.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\System32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\system32\drivers\MODEMCSA.sys
Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS
Did not load driver \SystemRoot\System32\Drivers\Fdc.SYS
Did not load driver \SystemRoot\System32\Drivers\Flpydisk.SYS
Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS
Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS
Did not load driver \SystemRoot\System32\Drivers\Changer.SYS
Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS
Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipsec.sys
Loaded driver \SystemRoot\System32\DRIVERS\tcpip.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipnat.sys
Loaded driver \SystemRoot\System32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\System32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbios.sys
Did not load driver \SystemRoot\System32\DRIVERS\processr.sys
Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS
Loaded driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\System32\Drivers\Fips.SYS
Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS
Loaded driver \SystemRoot\system32\DRIVERS\pvsnet.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndisuio.sys
Did not load driver \SystemRoot\System32\DRIVERS\rdbss.sys
Did not load driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\drivers\wdmaud.sys
Loaded driver \SystemRoot\system32\drivers\sysaudio.sys
Loaded driver \SystemRoot\system32\drivers\splitter.sys
Loaded driver \SystemRoot\system32\drivers\aec.sys
Loaded driver \SystemRoot\system32\drivers\swmidi.sys
Loaded driver \SystemRoot\system32\drivers\DMusic.sys
Loaded driver \SystemRoot\system32\drivers\kmixer.sys
Loaded driver \SystemRoot\system32\drivers\drmkaud.sys
Loaded driver \SystemRoot\System32\DRIVERS\mrxdav.sys
Loaded driver \SystemRoot\System32\drivers\BrPar.sys
Loaded driver \SystemRoot\System32\Drivers\ParVdm.SYS
Did not load driver \SystemRoot\System32\Drivers\Serial.SYS
Loaded driver \SystemRoot\System32\Drivers\HTTP.sys
Loaded driver \??\C:\WINDOWS\system32\drivers\hypervisor.sys
Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv.sys
Loaded driver \??\C:\WINDOWS\system32\drivers\pvs.sys
Loaded driver \??\C:\WINDOWS\system32\drivers\pvspth.sys
Loaded driver \??\C:\WINDOWS\system32\drivers\pvsum.sys
Did not load driver \SystemRoot\System32\DRIVERS\ipnat.sys
Loaded driver \SystemRoot\system32\drivers\kmixer.sys




And the new output from ComboFix:
=========================
ComboFix 09-03-01.01 - david 2009-03-01 20:05:46.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.297 [GMT -5:00]
Running from: c:\documents and settings\david\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))
.

2009-02-28 21:21 . 2009-02-28 21:21 <DIR> d-------- c:\documents and settings\david\Application Data\Sibelius Software
2009-02-27 21:22 . 2009-02-27 21:23 <DIR> d-------- c:\program files\Musicnotes
2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner
2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-20 20:11 . 2009-02-20 20:11 0 --a------ c:\windows\system32\drivers\nfr.dll.gpref

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 02:23 1,409 ----a-w c:\windows\Fonts\RPRSSCRP.FOT
2009-02-24 03:26 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-21 02:25 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-17 00:46 --------- d-----w c:\program files\Google
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_22.59.08.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-06-17 19:04:34 8,461,824 ----a-w c:\windows\$hf_mig$\KB967715\SP3QFE\shell32.dll
+ 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB967715\spmsg.dll
+ 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB967715\spuninst.exe
+ 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB967715\update\spcustom.dll
+ 2008-07-09 07:38:29 755,576 ----a-w c:\windows\$hf_mig$\KB967715\update\update.exe
+ 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB967715\update\updspapi.dll
+ 2008-06-17 19:02:19 8,461,312 -c----w c:\windows\system32\dllcache\shell32.dll
- 2009-01-17 01:40:17 122,136 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-03-02 00:55:58 150,792 ----a-w c:\windows\system32\FNTCACHE.DAT
- 2008-04-14 00:12:05 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2006-12-02 03:56:00 96,256 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-02 03:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 03:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 03:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 05:25:52 1,101,824 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 05:25:56 1,093,120 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 05:25:58 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 05:26:00 57,856 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 05:08:00 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:nfr
"7070:TCP"= 7070:TCP:nfr

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]
R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]
R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]
R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]
R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]
R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]
\Shell\Auto\command - E:\winsys2.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL winsys2.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://slashdot.org/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-01 20:08:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2009-03-01 20:12:23
ComboFix-quarantined-files.txt 2009-03-02 01:11:05
ComboFix2.txt 2009-02-24 04:01:45

Pre-Run: 34,422,636,544 bytes free
Post-Run: 34,416,644,096 bytes free

141 --- E O F --- 2009-02-25 08:01:01

Attached Files

•  DDS.txt   7.92K   17 downloads
•  Attach.txt   12.5K   18 downloads

[AdvancedSetup]

Please download a NEW fresh copy of Combofix.exe and Update MBAM, then Disconnect from the Internet (remove your cable or disable your wireless)

Temporarily Uninstall Spybot - Search & Destroy - you can re-install it later.
Stop Acrobat 7 from loading (you need to update it, even if you only get Reader 9 and let it open all Web documents)

Do you have any direct Shares available from the MAC to Parallels PC? If so please disable them.

What ever your E: drive is for this system, it has a infected file. Combofix should remove it if it's connected. E:\winsys2.exe




STEP 01
Click on START - RUN and type in or copy / paste NETSH FIREWALL RESET (there is a space between each word) then hit the OK button.

STEP 02
Download but do not yet run ComboFix
If you have a previous version of Combofix.exe, delete it and download a fresh copy.
Download it to your DESKTOP - it MUST run from the Desktop
download.bleepingcomputer.com/sUBs/ComboFix.exe
subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

File::
c:\windows\system32\drivers\nfr.dll.gpref
c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
E:\winsys2.exe
c:\windows\fonts\RPRSSCRP.FOT

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

• Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  
• Disconnect from the Internet.
  
• Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  
• A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
  
• It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
  When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.


STEP 03
Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
• When the update is complete, select the Scanner tab
  
• Select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

[dchen]

Hi AdvancedSetup,
I uninstalled SpyBot and Acrobat Reader as requested, then performed all steps. I also ran MBAM in full scan mode, two times, to see if the Trojan.Dropper would return (before reconnecting to the Internet)... unfortunately it seems to not be removed.

Posting all logs...
Thanks for the try!
-dchen




ComboFix Log:
===============
ComboFix 09-03-02.01 - david 2009-03-02 21:26:17.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.304 [GMT -5:00]
Running from: c:\documents and settings\david\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\david\Desktop\CFscript.txt
* Created a new restore point

FILE ::
c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
c:\windows\fonts\RPRSSCRP.FOT
c:\windows\system32\drivers\nfr.dll.gpref
E:\winsys2.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
c:\windows\fonts\RPRSSCRP.FOT
c:\windows\system32\drivers\nfr.dll.gpref

.
((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))
.

2009-02-28 21:21 . 2009-02-28 21:21 <DIR> d-------- c:\documents and settings\david\Application Data\Sibelius Software
2009-02-27 21:22 . 2009-02-27 21:23 <DIR> d-------- c:\program files\Musicnotes
2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner
2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes
2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-03 02:08 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-17 00:46 --------- d-----w c:\program files\Google
.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_22.59.08.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-06-17 19:04:34 8,461,824 ----a-w c:\windows\$hf_mig$\KB967715\SP3QFE\shell32.dll
+ 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB967715\spmsg.dll
+ 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB967715\spuninst.exe
+ 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB967715\update\spcustom.dll
+ 2008-07-09 07:38:29 755,576 ----a-w c:\windows\$hf_mig$\KB967715\update\update.exe
+ 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB967715\update\updspapi.dll
+ 2008-06-17 19:02:19 8,461,312 -c----w c:\windows\system32\dllcache\shell32.dll
- 2009-01-17 01:40:17 122,136 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-03-02 00:55:58 150,792 ----a-w c:\windows\system32\FNTCACHE.DAT
- 2008-04-14 00:12:05 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2006-12-02 03:56:00 96,256 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-02 03:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 03:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 03:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 05:25:52 1,101,824 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 05:25:56 1,093,120 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 05:25:58 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 05:26:00 57,856 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 05:08:00 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]
R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]
R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]
R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]
R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]
R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://slashdot.org/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 21:30:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\spkrmon.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-03-02 21:33:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-03 02:33:17
ComboFix2.txt 2009-03-02 01:12:26
ComboFix3.txt 2009-02-24 04:01:45

Pre-Run: 34,443,104,256 bytes free
Post-Run: 34,432,557,056 bytes free

149 --- E O F --- 2009-02-25 08:01:01




HiJack This Log:
================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:07:55 AM, on 3/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--
End of file - 7256 bytes




MBAM Log 1 (QuickScan)
=======================
Malwarebytes' Anti-Malware 1.34
Database version: 1814
Windows 5.1.2600 Service Pack 3

3/2/2009 10:05:46 PM
mbam-log-2009-03-02 (22-05-46).txt

Scan type: Quick Scan
Objects scanned: 64599
Time elapsed: 2 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



MBAM Log 2
=============
Malwarebytes' Anti-Malware 1.34
Database version: 1814
Windows 5.1.2600 Service Pack 3

3/2/2009 11:23:49 PM
mbam-log-2009-03-02 (23-23-49).txt

Scan type: Full Scan (C:\|)
Objects scanned: 163179
Time elapsed: 38 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 180

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock 2.34.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prey DVDRip REPACK XviD-ReCode.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia Revelations Psp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\#1 DVD Ripper v1.3.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\007 DVD Maker v3.0.0.48.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 CD Ripper 1.80.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper 4.2 with KeyGen.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\100 Deadliest Karate Moves - A TutorialScary....exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Activator 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows VISTA FINAL 2007 Updated Links.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista RC1 Build 5600 Direct Fast Link.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Ultimate Retail with full genui.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP 11 in 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Corporate With SP2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Xp Media Center Edition - Live Editio.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional - Demonoid Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows xp Professional With SP3 May 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.62.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.39.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.58.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro 4.80.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware and Adware Removal 3.0e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 2006 3.8.0.2584 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2602 + fix.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2618 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 5.0.0.182 Vista Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.5.1.498.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.0.2613-RESURRECTiON.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v5.0.0.182.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Die Hard Nakatomi Plaza.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital 3D Screensaver 1.1.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor 7.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v7.8.5 Build 550.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Element WorldBuilder Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1Click DVD Copy 5.1.1.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\2 Fast 2 Furious.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\3D Home Design Suite Deluxe v6.0 Retail.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\A Scanner Darkly CAM.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1 Build 3633.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D 7.0.86 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Pagemaker v7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Password Recovery 1.53.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v.4.0.964.6926.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Caste.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Life Deathmatch Source.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Past Dead 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Collectors Edition - PROViSiON.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 5.6.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Password v3.8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal 2006 DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Password Recovery v1.0.200.2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Hunter v4.1 Build 903.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.5.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v6.5.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Crime New York City.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Image Enterprise Server 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power on and Shut down v2.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Run Design Specialty v5.0.8.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoDesk - Lustre 2007 - ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoDesk 3DS Max 9 3D Studio Max.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Architectural Desktop 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD LT 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Combustion v4.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Maya Unlimited v8.0 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk MotionBuilder ver.7.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 6.22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.29 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autopano Pro V1.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 9.60 - Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 v9.51.01.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v10.0 Beta 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 7 - COMPLETE FULL.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO 3.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 6.2.1 Build 1newsid2234663.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall 4.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Winavi Video Converter 7.7 With Crack.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Pro 2.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Window Blinds + 32 themes.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Window Washer 6.0.5.409 Portable Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Windowblinds 5.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds Enhanced v.5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Windows Internet Cleaner Pro v5.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Pro 6.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\eXtreme Movie Manager 5.6.2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ Backup Firefox and Thunderbird Premium v4.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Ez Mp3 Creator V1.3.9.390.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. - First Encounter Assault Recon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.140.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO - Unattended XP Making Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO CrackSearch Hacking Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Guitar Lessons Vol.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Proxy Tools 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Sony Media.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Air America Radio The Al Franken Show 02 27 06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa dvdscreen 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa PROPER-DVDSCR-XVID-MVS.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rome - Complete Season 1 Caps.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter 5.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.4.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\nVidia Forceware 91.28 32-bit 2yk &amp; Xp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\nVidia nTune 5.05.25.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O Defrag 8.6 Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O FormatRecovery v4.0.727.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Object Rescue Pro 4.4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\ObjectRescue Pro v4.0.141.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Ten Thumbs Typing Tutor 4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Text Recordster v1.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\007 - Licence To Kill.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\123 DVD Clone v2.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Macromedia Director 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Burning Studio v10.1.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD R v 4.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Ripper v4.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic ISO Maker 5.3 Build 0229.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Swf2Gif 1.35.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2004 3.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2006 v4.22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 4.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Download Accelerator Plus 8.1.5.6 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr. DivX 2.0.0 RC3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr.Hardware 2005 Build 6.0.0e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Adobe Flash Professional 9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Advanced Encryption Package v4.21.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AI Roboform Pro 6.8.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alien Shooter 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Apollo DVD Copy ver. 4.7.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Arial Audio Converter 2.3.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Ashampoo AntiVirus 1.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Aurora Media Workshop v3.3.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Pixarra Twisted Brush v12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD Ripper 1.19.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD to DivX XviD Ripper 4.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Video Converter v3.13.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Video To Mp4 v2.13.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Batch It! Ultra v3.91.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Battlefield 2 iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Bearshare 5.2.5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Google Earth PRO v3.0.0395.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Graphic Workshop Professional v3.0a 22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Screen Recorder Gold v2.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\www el torrent ath cx El Mejor Dia De Mi Vida....exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Disk Security 7.52.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Space v9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AIO Mobile software v1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alarm v7.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alias ImageStudio v.3.0 (Full).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7 Premium Reloaded v7.5.9.0A Vista Ready.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7.8.5.0 Premium.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero CD-DVD Speed 4.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero PhotoShow Express 4.5.2045 ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Premium Edition v7.2.0.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Net Aid v3.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Network Event Viewer 6.0.0.52.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Express Plus 2.1.2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\EZ Auction Timer Plus v1.60.153.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\FairStars Audio Converter 1.51.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Family Cyber Alert ver. 3.91.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internal Affairs XXX DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Business Promoter 9.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Cyclone v1.90.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.0 Beta 3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.07 Beta 3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v4.07.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.02.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.07 Beta 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Explorer Security Pro v7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Video Converter 1.41.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Intervideo DVDCopy Platinum v4.5B002.09C.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Sims 2 University.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Skeleton Key.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Texas Chainsaw Massacre.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Truman Show 1998 DVDRip AVC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Untouchables DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The White Dragon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Work And The Glory American Zion DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\bszip.dll.vir (Worm.P2P) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{841A6618-5B0A-44A9-81FC-280F6504ACFE}\RP1076\A0067347.dll (Worm.P2P) -> Quarantined and deleted successfully.



MBAM Log 3
=============
Malwarebytes' Anti-Malware 1.34
Database version: 1814
Windows 5.1.2600 Service Pack 3

3/3/2009 5:27:49 AM
mbam-log-2009-03-03 (05-27-49).txt

Scan type: Full Scan (C:\|)
Objects scanned: 163469
Time elapsed: 39 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 156

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock 2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prey DVDRip REPACK XviD ReCode.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Prince Of Persia Anthology.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\#1 DVD Ripper 5.33.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\007 DVD Maker v3.0.0.45.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 Anonymous Proxy List Verifier v1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper 4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\100 best albums of 2004 according to Fogass vol 1....exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista 86x Ultimate Final 32bit.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista RC1 Build 5600 Direct Fast Li.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Ultimate iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP -For Gamer.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Corporate W SP3 Feb 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Media Center 2005.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional Lite BOOT EDITION.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.35.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.57.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro 4.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware and Adware Removal 3.0c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 2006 3.8.0.2557.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2618 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.0.2603.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Die Befreiung 01 Der Längste Tag shared by....exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital 3D Photos 1.51.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor 7.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v7.8.10.621.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Digital Element Aurora 2.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\1Click DVD Copy 5.0.3.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\2 Fast 2 Furious Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\3D Home Architect Home Design Deluxe 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\A Scanner Darkly CAM VCD [RS].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1 Build 3567 Workstation.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D 7.0.85.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Adobe PageMaker v7.0.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Password Recovery 1.52.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v.3.51.748.6419.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Baked 1998 dvdrip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Life Classic Game - 2 Links.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Half Past Dead 2 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 5.461.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Handy Password v3.5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal 2006 - DVDRiP.XViD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Messenger Pro v.3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Hunter 4.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v6.5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Connect ver. 1.1.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\True Crime, New York City.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power on & Shut down v2.03.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Auto Repair For Dummies.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk 3DS Max 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD Electrical v2008.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AutoDesk Combustion v.4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Maya Unlimited v.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk MotionBuilder v7.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 6.16 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.27 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Autopano Pro 1.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Powerarchiver 2006 9.51.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v.10.10.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO 3.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 6.2.1 Build 1663.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall 4.2.1 build 89.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinAVI Video Converter 7.7 Latest.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Open File Manager v3.7.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Window Washer 6.0.5.409 - Retail.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5.02 Golden Enhanced.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds Enhanced 5.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\WindowFX v2.12 Enhanced.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Pro 6.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\eXtreme Movie Manager 5.5.8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ Backup Access Premium v4.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\EZ MP3 Creator v1.3.9.260.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. - First Encounter Assault Recon Working Online.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.100.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO - Tracing Utilities.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Crack Searching Shareware Hacking.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Greenmix 7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Portable Softwares.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\AIO Sony Media _ $1500.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Air America 1990.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa PROPER DVDSCR XViD-mVs.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rome Total War.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Rome Total War.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter 5.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.4.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\nVIDIA nTune 5.00.11.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O Defrag 8.5 Build 1788 Professional Server Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\O&O Format Recovery v4.0.719.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Object Rescue Grandbackup Personal v1.1 build 428.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\ObjectRescue Pro v3.5.120.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Ten Thumbs Typing Tutor 4.0.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Darcy Chen\Shared\_\Text PT 2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\007 - Licence To Kill DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\123 AVI to GIF Converter.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Burning Studio v10.0.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Creator v7.9.9.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic DVD Ripper v4.0a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Stones.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2004 3.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 2006 v4.21.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Magic Utilities 4.33.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Download Accelerator Plus 8.1.3.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr. DivX 2.0.0 beta 9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Dr.Hardware 2005 6.0.0e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Adobe Flash Player 9.0.16.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Advanced Encryption Package 2007 4.6.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AI RoboForm Pro 6.8.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Alien Incursion 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Apollo DVD Copy ver. 4.7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Ashampoo Antispyware v1.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Aurora Media Workshop v3.3.34.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD Ripper 1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato DVD Ripper v6.66.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Video Converter v3.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Plato Video To iPod PSP 3GP.v2.16.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Batch It! Ultra v.3.97.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\BattleField 2 DVD iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Bearshare 5.2.5.3 Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Google Earth Pro v3.0.03.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Graphic Workshop Professional v2.0a.108.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Disk Security 7.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Clean Space v10.0.792.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\AIO Keygenerators.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7 Premium Reloaded v7.5.9.0A Multi Installer.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero 7.7.5.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero CD-DVD Speed 3.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero PhotoShow Elite 1.0.1.191.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Nero Premium Edition v7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Network Eagle Monitor Pro v4.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Express Dictate v4.03.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\EZ Auction Timer Plus 1.72.196.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\FairStars Audio Converter 1.47.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Family Cyber Alert v3.99.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Business Promoter 9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Cyclone v1.89.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.07 Beta 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.02.14.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Explorer Security Pro v7.0.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\Internet Tweak v4.90.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Sims 2 Summer Life.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Skeleton Key (2005).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Texas Chainsaw Massacre The Beginning.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Treasures Of Montezuma.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Unknown.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Wedding Date SCREENER Wastedtime.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\david\Shared\_\The Woods.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

[dchen]

Hi AdvancedSetup, please advise if you have any more methods to try to get rid of the Trojan.Dropper!
Many thanks,
-dchen

[AdvancedSetup]

Is this folder really shared?


Let's try these RK scanners.

RootRepeal - Rootkit Detector
[indent]

• Please download the following tool: RootRepeal - Rootkit Detector
  
• Direct download link is here: RootRepeal.rar
  
• If you don't already have a program to open a .RAR compressed file you can download a trial version from here: WinRAR
  
• Extract the program file to a new folder such as C:\RootRepeal
  
• Run the program RootRepeal.exe and go to the REPORT tab and click on the Scan button
  
• Select ALL of the checkboxes and then click OK and it will start scanning your system.
  
• If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
  
• When done, click on Save Report
  
• Save it to the same location where you ran it from, such as C:\RootRepeal
  
• Save it as your_name_rootrepeal.txt - where your_name is your forum name
  
• This makes it more easy to track who the log belongs to.
  
• Then open that log and select all and copy/paste it back on your next reply please.
  
• Quit the RootRepeal program.

[/indent]





Please download the following scanning tool. GMER
[indent]

• Open the zip file and copy the file gmer.exe to your Desktop.
  
• Double click on gmer.exe and run it.
  
• It may take a minute to load and become available.
  
• Do not make any changes. Click on the SCAN button and DO NOT use the computer while it's scanning.
  
• Once the scan is done click on the SAVE button and browse to your Desktop and save the file as GMER.LOG
  
• Zip up the GMER.LOG file and save it as gmerlog.zip and attach it to your reply post.
  
• DO NOT directly post this log into a reply. You MUST attach it as a .ZIP file.
  
• Click OK and quit the GMER program.

How To Use Compressed (Zipped) Folders in Windows XP
Compress and uncompress files (zip files) in Vista
[/indent]

[dchen]

I started running RootRepeal and noticed that it hung in the folder:

C:\Documents and Settings\Darcy Chen\Shared\_

I had tried to use Windows Explorer to check that folder in the past; couldn't find it and thought that the "_" name was somehow not really there. Then I tried "Tools -> Folder Options -> Views" and unchecked "Hide protected operating system files" then I found that there was actually a folder named "_". This folder had 10's of thousands of EXE files, all the same size with long names that differed only by version number. I deleted all these files manually, then a full MBAM scan ran successfully with no threats found.

I'm hoping that this was the problem. I'm thinking that MBAM found and deleted a few of these files at a time, but did not report all 10's of thousands in a single directory all at once. I saved one of the EXE files as a ZIP archive. If you like, I can email this to you.

Best regards,
-dchen

[AdvancedSetup]

Yes, how big is this Zip file? Probably not e-mail but if it's not too large you could send it in a Private Message.
If it's too large then we'd need to upload it somewhere else that I could get a hold of it.

[AdvancedSetup]

Well after a bit more research this appears to be a known P2P file sharing worm.
Basically it came from one of your programs sharing out your system.

You should uninstall and remove this programs from your computer.
BitTorrent 5.0.9
SoulSeek Client 156c



File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.
Risks of File-Sharing Technology

[AdvancedSetup]

Please post a status update on this and let me know if you still need help or not.

[dchen]

Hi AdvancedSetup, I think my system is now OK. I uninstalled the P2P programs that you suggested, rebooted and the most recent MBAM full scan was totally clean. Let me know if you would like me to email the ZIP file for the EXE file that I found.
Thanks again for all the great help!
-dchen

[AdvancedSetup]

No that's fine. Just a file sharing worm. With the programs removed you should be okay as long as you didn't run or install any of those files.


Great, all looks good now.

I'll close your post soon so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?


[indent]At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.
Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:

Remove all but the most recent Restore Point on Windows XP

[indent]You should Create a New Restore Point to prevent possible reinfection from an old one.
Some of the malware you picked up could have been saved in System Restore.
Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.
Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
  
• If the shortcut is missing you can also click on START > RUN > and type in %SystemRoot%\system32\restore\rstrui.exe and click OK
  
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next".
  
• Give the new Restore Point a name, then click "Create".
  
• The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use the Disk Cleanup to remove all but the most recently created Restore Point.
  
• Go to Start > Run and type: Cleanmgr.exe
  
• Select the drive where Windows is installed and click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
  
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  
• Click Yes, then click Ok.
  
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
  
• Disk Cleanup will remove the files and close automatically.
  
• On the Disk Cleanup tab, if the System Restore: Obsolete Data Stores entry is available remove them also.
  
• These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.

[indent] [/indent]

Additional information
Microsoft KB article: How to turn off and turn on System Restore in Windows XP
Bert Kinney's site: All about Windows System Restore[/indent]

Here are some free programs I recommend that could help you improve your computer's security.

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install hpHosts
Download it from here
hpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad,
tracking and malicious websites. This prevents your computer from connecting to these untrusted sites
by redirecting them to 127.0.0.1 which is your own local computer.
hpHosts Support Forum

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com
Note 1: If you are running Windows XP SP2, you should upgrade to SP3.
Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.
The security suite can then be reinstalled afterwards.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
I recommend Online Armor Free

A little outdated but good reading on how to prevent Malware

Keep safe online and happy surfing.



Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post Instructions


Also don't forget that we offer FREE assistance with General PC questions and repair here PC Help
If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org[/indent]