PC hyper infecte !

rolmic · le 18 octobre 2007

Bon, voila le pc d'un pote que je dois remettre en etat !

Divers pbs souleves par Trens Scan Online :

troj_vundo.bdd .bdb .qc

tspy_agent.aayo

Trend ne peut pas les enlever !

Voici le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:33:19 PM, on 10/18/2007

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\Atievxx.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\System32\oyqappsm.exe

C:\WINDOWS\explorer.exe

C:\Documents and Settings\user\Local Settings\Temp\Temporary Directory 1 for HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2internet.fr/?skip_split_page

O2 - BHO: (no name) - {01fcaeb1-2405-4f33-804a-97a692933839} - C:\WINDOWS\system32\audmon.dll (file missing)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {48C0E877-79B9-45C8-9AC5-F3B86162F389} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\System32\dcnfuspd.dll

O2 - BHO: (no name) - {9EAE5BF9-F80A-490F-A501-235BEE06E4E2} - C:\WINDOWS\System32\qoppq.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [searchIndexer] rundll32.exe "C:\WINDOWS\System32\qqdfxxei.dll",sitypnow

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1191366021951

O20 - AppInit_DLLs: c:\windows\system32\wvwtttq.dll

O20 - Winlogon Notify: audmon - audmon.dll (file missing)

O20 - Winlogon Notify: qommkji - qommkji.dll (file missing)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: DomainService - - C:\WINDOWS\System32\oyqappsm.exe

O23 - Service: ms hexidecimal defx (mshexdefx) - Unknown owner - C:\WINDOWS\system32\dllcache\ivchost.exe (file missing)

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--

End of file - 4486 bytes

MERCI D'AVANCE !!!

Lien Rag · le 18 octobre 2007

Bonsoir

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

Double-clique VundoFix.exe afin de le lancer.

Clique sur le bouton "Scan for Vundo"

Lorsque le scan est complété, clique sur le bouton Remove Vundo.

Une invite te demandera si tu veux supprimer les fichiers, clique YES

Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.

Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK

Démarre ton PC à nouveau.

Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

Télécharge VirtumundoBegone sur le bureau:

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.

Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau

dans ta prochaine réponse avec un nouveau rapport HijackThis.

Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu.

rolmic · le 18 octobre 2007

Bonsoir

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

Double-clique VundoFix.exe afin de le lancer.

Clique sur le bouton "Scan for Vundo"

Lorsque le scan est complété, clique sur le bouton Remove Vundo.

Une invite te demandera si tu veux supprimer les fichiers, clique YES

Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.

Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK

Démarre ton PC à nouveau.

Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

Télécharge VirtumundoBegone sur le bureau:

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.

Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau

dans ta prochaine réponse avec un nouveau rapport HijackThis.

Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu.

Alors ok, j'ai fait Vundo.

Voici le rapport HiJAck

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:55:19 PM, on 10/18/2007

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\Atievxx.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Documents and Settings\user\Local Settings\Temp\Temporary Directory 2 for HiJackThis.zip\HijackThis.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2internet.fr/?skip_split_page

O2 - BHO: (no name) - {01fcaeb1-2405-4f33-804a-97a692933839} - C:\WINDOWS\system32\audmon.dll (file missing)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {48C0E877-79B9-45C8-9AC5-F3B86162F389} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {9BAC607A-7A33-4B0F-948C-FC2B4C29BCF8} - C:\WINDOWS\System32\qoppq.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1191366021951

O20 - AppInit_DLLs: c:\windows\system32\wvwtttq.dll

O20 - Winlogon Notify: audmon - audmon.dll (file missing)

O20 - Winlogon Notify: qommkji - qommkji.dll (file missing)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: ms hexidecimal defx (mshexdefx) - Unknown owner - C:\WINDOWS\system32\dllcache\ivchost.exe (file missing)

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--

End of file - 5121 bytes

ET VOICI LE RAPPORT VUNDOFIX

VundoFix V6.5.10

Checking Java version...

Sun Java not detected

Scan started at 8:50:03 PM 10/18/2007

Listing files found while scanning....

C:\WINDOWS\System32\dcnfuspd.dll

C:\windows\system32\qoppq.dll

C:\windows\system32\qppoq.bak1

C:\windows\system32\qppoq.bak2

C:\windows\system32\qppoq.ini

C:\WINDOWS\System32\qqdfxxei.dll

Beginning removal...

Attempting to delete C:\WINDOWS\System32\dcnfuspd.dll

C:\WINDOWS\System32\dcnfuspd.dll Has been deleted!

Attempting to delete C:\windows\system32\qoppq.dll

C:\windows\system32\qoppq.dll Has been deleted!

Attempting to delete C:\windows\system32\qppoq.bak1

C:\windows\system32\qppoq.bak1 Has been deleted!

Attempting to delete C:\windows\system32\qppoq.bak2

C:\windows\system32\qppoq.bak2 Has been deleted!

Attempting to delete C:\windows\system32\qppoq.ini

C:\windows\system32\qppoq.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\qqdfxxei.dll

C:\WINDOWS\System32\qqdfxxei.dll Has been deleted!

Performing Repairs to the registry.

Done!

LA SUITE ARRIVE ...

Voici VBG.txt

[10/18/2007, 22:12:10] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\user\Desktop\VirtumundoBeGone.exe" )

[10/18/2007, 22:12:14] - Detected System Information:

[10/18/2007, 22:12:14] - Windows Version: 5.1.2600,

[10/18/2007, 22:12:14] - Current Username: user (Admin)

[10/18/2007, 22:12:15] - Windows is in NORMAL mode.

[10/18/2007, 22:12:15] - Searching for Browser Helper Objects:

[10/18/2007, 22:12:15] - BHO 1: {01fcaeb1-2405-4f33-804a-97a692933839} ()

[10/18/2007, 22:12:15] - WARNING: BHO has no default name. Checking for Winlogon reference.

[10/18/2007, 22:12:15] - Checking for HKLM\...\Winlogon\Notify\audmon

[10/18/2007, 22:12:15] - Found: HKLM\...\Winlogon\Notify\audmon - This is probably Virtumundo.

[10/18/2007, 22:12:15] - Assigning {01fcaeb1-2405-4f33-804a-97a692933839} MSEvents Object

[10/18/2007, 22:12:15] - BHO list has been changed! Starting over...

[10/18/2007, 22:12:15] - BHO 1: {01fcaeb1-2405-4f33-804a-97a692933839} (MSEvents Object)

[10/18/2007, 22:12:15] - ALERT: Found MSEvents Object!

[10/18/2007, 22:12:15] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)

[10/18/2007, 22:12:15] - BHO 3: {48C0E877-79B9-45C8-9AC5-F3B86162F389} ()

[10/18/2007, 22:12:15] - WARNING: BHO has no default name. Checking for Winlogon reference.

[10/18/2007, 22:12:15] - No filename found. Continuing.

[10/18/2007, 22:12:15] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)

[10/18/2007, 22:12:15] - BHO 5: {9BAC607A-7A33-4B0F-948C-FC2B4C29BCF8} ()

[10/18/2007, 22:12:15] - WARNING: BHO has no default name. Checking for Winlogon reference.

[10/18/2007, 22:12:15] - Checking for HKLM\...\Winlogon\Notify\qoppq

[10/18/2007, 22:12:15] - Key not found: HKLM\...\Winlogon\Notify\qoppq, continuing.

[10/18/2007, 22:12:15] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)

[10/18/2007, 22:12:15] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)

[10/18/2007, 22:12:15] - Finished Searching Browser Helper Objects

[10/18/2007, 22:12:16] - *** Detected MSEvents Object

[10/18/2007, 22:12:16] - Trying to remove MSEvents Object...

[10/18/2007, 22:12:17] - Terminating Process: IEXPLORE.EXE

[10/18/2007, 22:12:29] - Terminating Process: RUNDLL32.EXE

[10/18/2007, 22:12:33] - Disabling Automatic Shell Restart

[10/18/2007, 22:12:33] - Terminating Process: EXPLORER.EXE

[10/18/2007, 22:12:34] - Suspending the NT Session Manager System Service

[10/18/2007, 22:12:34] - Terminating Windows NT Logon/Logoff Manager

[10/18/2007, 22:12:36] - Re-enabling Automatic Shell Restart

[10/18/2007, 22:12:36] - File to disable: C:\WINDOWS\system32\audmon.dll

[10/18/2007, 22:12:36] - Removing HKLM\...\Browser Helper Objects\{01fcaeb1-2405-4f33-804a-97a692933839}

[10/18/2007, 22:12:37] - Removing HKCR\CLSID\{01fcaeb1-2405-4f33-804a-97a692933839}

[10/18/2007, 22:12:39] - Adding Kill Bit for ActiveX for GUID: {01fcaeb1-2405-4f33-804a-97a692933839}

[10/18/2007, 22:12:40] - Deleting ATLEvents/MSEvents Registry entries

[10/18/2007, 22:12:40] - Removing HKLM\...\Winlogon\Notify\audmon

[10/18/2007, 22:12:41] - Searching for Browser Helper Objects:

[10/18/2007, 22:12:41] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)

[10/18/2007, 22:12:41] - BHO 2: {48C0E877-79B9-45C8-9AC5-F3B86162F389} ()

[10/18/2007, 22:12:41] - WARNING: BHO has no default name. Checking for Winlogon reference.

[10/18/2007, 22:12:41] - No filename found. Continuing.

[10/18/2007, 22:12:41] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)

[10/18/2007, 22:12:41] - BHO 4: {9BAC607A-7A33-4B0F-948C-FC2B4C29BCF8} ()

[10/18/2007, 22:12:41] - WARNING: BHO has no default name. Checking for Winlogon reference.

[10/18/2007, 22:12:42] - Checking for HKLM\...\Winlogon\Notify\qoppq

[10/18/2007, 22:12:42] - Key not found: HKLM\...\Winlogon\Notify\qoppq, continuing.

[10/18/2007, 22:12:42] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)

[10/18/2007, 22:12:42] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)

[10/18/2007, 22:12:42] - Finished Searching Browser Helper Objects

[10/18/2007, 22:12:42] - Finishing up...

[10/18/2007, 22:12:42] - A restart is needed.

[10/18/2007, 22:13:12] - Attempting to Restart via STOP error (Blue Screen!)

Et HiJack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:27:09 PM, on 10/18/2007

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\Atievxx.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\user\Local Settings\Temp\Temporary Directory 3 for HiJackThis.zip\HijackThis.exe