Win32/Cryptor infection

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50:28, on 03/09/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\s3trayp.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\com\AppData\Local\ieyuxsoj.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Users\com\Desktop\hijackthis.scr
C:\Windows\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tesco.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bebo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tesco.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tesco internet access
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe -chkautorun
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe 1
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ieyuxsoj] "c:\users\com\appdata\local\ieyuxsoj.exe" ieyuxsoj
O4 - Startup: Joint Operations Typhoon Rising Registration.lnk = C:\Users\com\AppData\Local\Temp\{474E27A1-266B-4478-A02E-3DCC4B9FEE04}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8480 bytes

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  O4 - HKCU\..\Run: [ieyuxsoj] "c:\users\com\appdata\local\ieyuxsoj.exe" ieyuxsoj
  O4 - Startup: Joint Operations Typhoon Rising Registration.lnk = C:\Users\com\AppData\Local\Temp\{474E27A1-266B-4478-A02E-3DCC4B9FEE04}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
  O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.

Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 6.0.6000

04/09/2009 13:27:37
mbam-log-2009-09-04 (13-27-37).txt

Scan type: Quick Scan
Objects scanned: 86582
Time elapsed: 10 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 4
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\CodecBHO.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.codecplugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.codecplugin.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\RichVideoCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Environment\avapp (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Environment\avuninst (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\RichVideoCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Uninstall\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\PCHealthCenter\0.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.ico (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.ico (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Uninstall\PersonalAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Windows\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.
C:\Users\com\AppData\Local\Temp\~tmpb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\com\Local Settings\Application Data\ieyuxsoj_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\Users\com\Local Settings\Application Data\ieyuxsoj_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.40
Database version: 2741
Windows 6.0.6000

04/09/2009 17:40:55
mbam-log-2009-09-04 (17-40-55).txt

Scan type: Quick Scan
Objects scanned: 88514
Time elapsed: 11 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

• Download combofix from here
  Link 1
  Link 2
  

• See HERE for how to disable your AV.
  
• Double click on svchost.exe.
  
• Follow the prompts. NOTE:
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouse click combofix's window whilst it's running. That may cause it to stall.
  

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.

ComboFix 09-09-04.01 - com 05/09/2009 9:07.1.2 - NTFSx86
Microsoft Windows Vista Home Basic 6.0.6000.0.1252.44.1033.18.1790.877 [GMT 1:00]
Running from: c:\users\com\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\$recycle.bin\S-1-5-21-678796721-1726476508-308465742-500
c:\windows\Installer\2480b.msi
c:\windows\Installer\cd1bd.msi
c:\windows\system32\drivers\snetcfg.exe
c:\windows\system32\drivers\UAChjpfpjohve.sys
c:\windows\system32\ndisapi.dll
c:\windows\system32\UACgbpvcocdeg.dll
c:\windows\system32\UACihmwjpichx.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACitftdutcpv.dat
c:\windows\system32\UACwyxkgpovln.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys
-------\Legacy_UACd.sys
-------\Service_NDISRD


((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.

2009-09-05 08:14 . 2009-09-05 08:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-05 08:14 . 2009-09-05 08:17 -------- d-----w- c:\users\com\AppData\Local\temp
2009-09-04 12:15 . 2009-09-04 12:15 -------- d-----w- c:\users\com\AppData\Roaming\Malwarebytes
2009-09-04 12:09 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-04 12:08 . 2009-09-04 12:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-04 12:08 . 2009-09-04 12:08 -------- d-----w- c:\programdata\Malwarebytes
2009-09-04 12:08 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-03 17:16 . 2009-09-03 17:35 -------- d-----w- c:\users\com\.SunDownloadManager
2009-09-03 16:56 . 2009-09-03 17:07 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-03 16:56 . 2009-09-03 16:56 -------- d-----w- c:\users\com\AppData\Roaming\SUPERAntiSpyware.com
2009-09-03 16:56 . 2009-09-03 16:56 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-31 19:43 . 2009-09-04 12:05 3923 ----a-w- c:\users\com\AppData\Local\ieyuxsoj.dat
2009-08-31 19:43 . 2009-08-31 19:43 247296 ----a-w- c:\users\com\AppData\Local\ieyuxsoj.exe
2009-08-29 11:28 . 2009-08-29 11:28 -------- d-----w- c:\users\com\Office Genuine Advantage
2009-08-29 10:37 . 2009-09-05 07:53 -------- d--h--w- C:\$AVG8.VAULT$
2009-08-29 10:24 . 2009-09-03 17:36 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-29 07:55 . 2009-08-29 07:55 680 ----a-w- c:\users\com\AppData\Local\d3d9caps.dat
2009-08-29 07:55 . 2009-08-29 07:55 -------- d-----w- c:\programdata\Office Genuine Advantage
2009-08-29 07:45 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll
2009-08-29 01:25 . 2009-08-29 01:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-29 01:25 . 2009-08-29 01:25 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-29 01:25 . 2009-09-05 07:53 -------- d-----w- c:\windows\system32\drivers\Avg
2009-08-29 01:25 . 2009-08-29 01:25 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-29 01:25 . 2009-08-29 10:19 -------- d-----w- c:\programdata\AVG Security Toolbar
2009-08-29 01:25 . 2009-09-03 17:06 -------- d-----w- c:\programdata\avg8
2009-08-29 01:25 . 2009-08-29 01:25 -------- d-----w- c:\program files\AVG
2009-08-29 01:08 . 2009-09-04 12:27 -------- d-----w- c:\program files\Common Files\Uninstall
2009-08-26 00:37 . 2009-06-22 08:44 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-14 12:59 . 2009-06-15 15:25 216576 ----a-w- c:\windows\system32\msv1_0.dll
2009-08-14 12:59 . 2009-06-15 15:23 494592 ----a-w- c:\windows\system32\kerberos.dll
2009-08-14 12:58 . 2009-06-15 15:29 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-08-14 12:58 . 2009-06-15 15:28 272384 ----a-w- c:\windows\system32\schannel.dll
2009-08-14 12:58 . 2009-06-15 15:23 1233920 ----a-w- c:\windows\system32\lsasrv.dll
2009-08-14 12:58 . 2009-06-15 18:12 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-14 12:58 . 2009-06-15 15:28 72704 ----a-w- c:\windows\system32\secur32.dll
2009-08-14 12:58 . 2009-06-15 13:10 7680 ----a-w- c:\windows\system32\lsass.exe
2009-08-08 18:45 . 2009-08-08 18:45 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-08 18:44 . 2009-08-08 18:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-08-08 18:38 . 2009-08-08 19:33 -------- d-----w- c:\programdata\NOS
2009-08-08 18:38 . 2009-08-08 19:33 -------- d-----w- c:\program files\NOS
2009-08-07 01:13 . 2008-06-20 01:18 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-07 01:13 . 2008-06-20 01:17 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-08-07 01:13 . 2008-06-20 01:18 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-07 01:13 . 2008-06-20 01:17 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-08-07 01:13 . 2008-06-20 01:17 11264 ----a-w- c:\windows\system32\icardres.dll
2009-08-07 01:13 . 2008-06-20 01:18 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-07 01:13 . 2008-06-20 01:18 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-08-07 00:59 . 2008-07-27 18:00 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-08-07 00:59 . 2008-07-27 18:00 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-08-07 00:59 . 2008-07-27 18:00 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-08-07 00:59 . 2008-07-27 18:00 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-08-07 00:59 . 2008-07-27 18:00 83968 ----a-w- c:\windows\system32\mscories.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-04 12:00 . 2009-05-18 22:58 89 ----a-w- c:\users\com\AppData\Local\kiumqyo.bat
2009-09-03 17:58 . 2009-06-15 19:36 -------- d-----w- c:\users\com\AppData\Roaming\LimeWire
2009-09-03 17:36 . 2008-05-26 02:32 -------- d-----w- c:\program files\Java
2009-08-29 07:54 . 2007-12-10 11:17 100248 ----a-w- c:\users\com\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-29 07:43 . 2008-01-01 12:25 -------- d-----w- c:\programdata\Microsoft Help
2009-08-29 07:41 . 2008-01-01 12:30 -------- d-----w- c:\program files\Microsoft Works
2009-08-29 01:25 . 2007-12-30 14:09 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-03 14:07 . 2009-08-03 14:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 14:07 . 2009-08-03 14:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 14:07 . 2009-08-03 14:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-07-21 21:52 . 2009-08-29 07:46 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-08-29 07:46 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-08-29 07:46 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-08-29 07:46 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:52 . 2009-08-11 19:43 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:02 . 2009-08-11 19:43 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 13:01 . 2009-08-11 19:43 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 13:00 . 2009-08-11 19:43 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 11:11 . 2009-08-11 19:43 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2009-06-15 15:29 . 2009-07-14 20:59 156160 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:23 . 2009-07-14 20:59 24064 ----a-w- c:\windows\system32\lpk.dll
2009-06-15 15:22 . 2009-07-14 20:59 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:21 . 2009-07-14 20:59 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 15:20 . 2009-07-14 20:59 34304 ----a-w- c:\windows\system32\atmlib.dll
2009-06-15 13:03 . 2009-07-14 20:59 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-06-10 12:16 . 2009-08-11 19:43 156160 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-10 12:10 . 2009-08-11 19:43 31232 ----a-w- c:\windows\system32\msvidc32.dll
2009-06-10 12:10 . 2009-08-11 19:43 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-06-10 12:09 . 2009-08-11 19:43 12800 ----a-w- c:\windows\system32\msrle32.dll
2009-06-10 12:07 . 2009-08-11 19:43 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-06-10 12:04 . 2009-08-11 19:43 88576 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 12:04 . 2009-08-11 19:43 65024 ----a-w- c:\windows\system32\avicap32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 08:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-22 1232896]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-20 39408]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-02-17 1006264]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe" [2007-01-02 471040]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-12 155648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-27 153136]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-16 98304]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-06-24 278528]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-29 2007832]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-03 149280]
"S3Trayp"="S3trayp.exe" - c:\windows\System32\s3trayp.exe [2007-08-13 200704]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{3474A1D2-C5DE-4EF9-B202-10FAB744F94A}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{BE35BF2E-E404-4F1A-92B2-8701449A9E11}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"{BC69C0EE-B8E0-4BFD-9412-410DB83E54B3}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2DDBE325-AE87-42DE-A466-B2670759731C}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{203CB41E-9F11-443F-8B6B-00193BEC1877}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{AE8EE5D8-75D6-43E1-9BBC-FB66AD2E83F8}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7EFA3E6F-1E50-4310-9EF8-A3979F6704C0}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A6619296-C9C1-4741-AA30-B0BEBAB4C741}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{FA045174-8D18-4736-8B7B-0619A79F3C51}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{C6600148-95B5-46E7-973C-BC5E5374AFB7}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{7C800888-9363-4F7A-9070-0E3414E736C9}"= UDP:e:\release\Tiscali.exe:Tiscali Wireless Gateway Installation
"{809872E8-08BE-49EE-AC1D-550E85DE2E71}"= TCP:e:\release\Tiscali.exe:Tiscali Wireless Gateway Installation
"{13983667-871B-41CA-B5D2-568F1DB306CF}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{B6749E01-B57F-41DF-B5E0-7C798D725358}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"{9A19ACCE-3CEA-4BBD-B33C-C601A80B21E1}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{F9C94F3C-0055-4710-8954-14FC87A79FFF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{6B107A63-2331-48CE-80AC-6F569A028129}"= UDP:c:\program files\Sega\The Club\Launcher.exe:The Club Launcher
"{C628EDBB-9738-4D37-A44F-F9866CC4D6D8}"= TCP:c:\program files\Sega\The Club\Launcher.exe:The Club Launcher
"{9A99EF39-B4F2-4601-8ED8-7CC53DBFEC89}"= UDP:c:\program files\Sega\The Club\TheClub.exe:The Club
"{56B8DFED-66A6-4D4D-B106-82521228A303}"= TCP:c:\program files\Sega\The Club\TheClub.exe:The Club
"TCP Query User{2DCAB9EE-5890-4C96-9FEE-15D34A61069F}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{6E7B7B7C-3D81-4464-AB33-E85A8A58407C}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{69C0ECCE-B3F1-4435-8CB9-3C322A05C925}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{450FB8B8-782E-4E69-9FA4-6CCFD66E6CB0}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{D117468E-4FFC-4F37-A414-249EEB6667E6}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [29/08/2009 02:25 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [29/08/2009 02:25 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [29/08/2009 02:25 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [29/08/2009 02:25 297752]
R3 S3GIGP;S3GIGP;c:\windows\System32\drivers\VTGKModeDX32.sys [12/09/2007 06:17 776704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2008-05-04 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bebo.com/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: o2.co.uk\www
Trusted Zone: tiscali.co.uk\www
.
.
------- File Associations -------
.
vbefile\shell\open2\command="%SystemRoot%\System32\CScript.exe" "%1" %*
vbsfile\shell\open2\command="%SystemRoot%\System32\CScript.exe" "%1" %*
jsefile\shell\open2\command=c:\windows\System32\CScript.exe "%1" %*
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-05 09:17
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe 1????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
c:\windows\System32\drivers\XAudio.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
.
**************************************************************************
.
Completion time: 2009-09-05 9:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-05 08:21

Pre-Run: 8,750,587,904 bytes free
Post-Run: 8,760,561,664 bytes free

255 --- E O F --- 2009-09-03 16:53

• Save it to your desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\users\com\AppData\Local\ieyuxsoj.dat
  c:\users\com\AppData\Local\ieyuxsoj.exe
  c:\users\com\AppData\Local\kiumqyo.bat
  c:\users\com\AppData\Roaming\LimeWire
  
  
  
• Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt
  

............................................................................................
Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.

========== FILES ==========
c:\users\com\AppData\Local\ieyuxsoj.dat moved successfully.
c:\users\com\AppData\Local\ieyuxsoj.exe moved successfully.
c:\users\com\AppData\Local\kiumqyo.bat moved successfully.
c:\users\com\AppData\Roaming\LimeWire\xml\data moved successfully.
c:\users\com\AppData\Roaming\LimeWire\xml moved successfully.
c:\users\com\AppData\Roaming\LimeWire\promotion moved successfully.
c:\users\com\AppData\Roaming\LimeWire\mozilla-profile\updates\0 moved successfully.
c:\users\com\AppData\Roaming\LimeWire\mozilla-profile\updates moved successfully.
c:\users\com\AppData\Roaming\LimeWire\mozilla-profile\extensions moved successfully.
c:\users\com\AppData\Roaming\LimeWire\mozilla-profile\Cache moved successfully.
c:\users\com\AppData\Roaming\LimeWire\mozilla-profile moved successfully.
c:\users\com\AppData\Roaming\LimeWire\certificate moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\res\html moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\res\fonts moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\res\entityTables moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\res\dtd moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\res moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\plugins moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\modules moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\greprefs moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\dictionaries moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults\profile\US\chrome moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults\profile\US moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults\profile\chrome moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults\profile moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults\pref moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults\autoconfig moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\defaults moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\components moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner\chrome moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser\xulrunner moved successfully.
c:\users\com\AppData\Roaming\LimeWire\browser moved successfully.
c:\users\com\AppData\Roaming\LimeWire\.AppSpecialShare moved successfully.
c:\users\com\AppData\Roaming\LimeWire moved successfully.

OTM by OldTimer - Version 3.0.0.6 log created on 09062009_001154