Vundo Help Please

chi-chi · February 2008

I have read this forum for weeks on in i've tried everything. I tried fix vundo it says nothing found, i tried deleting posxxx files it wont let me. please help me fix this issue If some one can provide me with a step by step please.

chi-chi · February 2008

I dont know how to use hijack this or w/e but i have seen that i need to do that and i have seen it on other sites please help..

chi-chi · February 2008

I hope this helps this is my HJT log (I think I figured that much out)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:38:47 PM, on 2/22/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\UltraVNC\WinVNC.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\AIM\AIM Pro\aimpro.exe

C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE

C:\Documents and Settings\cohene-asante\Desktop\Unused Desktop Shortcuts\Mozilla Firefox\firefox.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Documents and Settings\cohene-asante\Desktop\Unused Desktop Shortcuts\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - {0444CABA-0E52-444B-AE4A-858965884DDC} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\gsvgewwg.dll

O2 - BHO: {84aac315-c48b-b43b-cc34-042b52285d1c} - {c1d58225-b240-43cc-b34b-b84c513caa48} - (no file)

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by128fd.bay128.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} (UnagiAx Class) - http://radaol-prod-web-rr.streamops.aol.co...agi3.0.84.2.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SPL.INTERNAL

O17 - HKLM\Software\..\Telephony: DomainName = SPL.INTERNAL

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SPL.INTERNAL

O20 - Winlogon Notify: gsvgewwg - C:\WINDOWS\SYSTEM32\gsvgewwg.dll

O20 - Winlogon Notify: urqnmmk - urqnmmk.dll (file missing)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

--

End of file - 4982 bytes

farbar · February 2008

Hi,

Step 1.

Remove old Java versions due to serious security vulnerability (specially for Vundo family malware): Download the latest version of JRE from here: http://java.sun.com/javase/downloads/index.jsp

Click download button right to Java Runtime Environment (JRE) 6 Update 4

Then select platform: windows - check licence agreement -click continue-download windows offline installation.

But don't install it yet.

Go to control panel -add/remove programs – uninstall/remove all the old versions of Java, or any item with Java (JRE or J2SE).

Repeat the uninstall one by one until all the Java versions are removed. Reboot once all Java components are removed.

Install Java you have downloaded.

Step 2.

Download ComboFix.exe to your desktop using this link:

bleepingcomputer

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. After Combofix is finished turn on/enable your anti virus again.

Double click on combofix.exe to run the programme & then follow the prompts.

When finished, it will produce a report for you. Please post the content of this log ("C:\ComboFix.txt") into your next post.ComboFix may need to reboot to finish its work. Let it.

Note:Do not mouseclick combofix's window while it's running. That may cause it to stall

Step 3.

Post a fresh Hijackthis log into your reply.

chi-chi · February 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 03:51, on 2008-02-22

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\UltraVNC\WinVNC.exe

C:\Documents and Settings\cohene-asante\Desktop\Unused Desktop Shortcuts\Mozilla Firefox\firefox.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\cohene-asante\Desktop\FixVundo.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - {0444CABA-0E52-444B-AE4A-858965884DDC} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll

O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\gsvgewwg.dll

O2 - BHO: {84aac315-c48b-b43b-cc34-042b52285d1c} - {c1d58225-b240-43cc-b34b-b84c513caa48} - (no file)

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Documents and Settings\cohene-asante\Desktop\Unused Desktop Shortcuts\Mozilla Firefox\plugins\NPSWF32_FlashUtil.exe -p

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by128fd.bay128.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} (UnagiAx Class) - http://radaol-prod-web-rr.streamops.aol.co...agi3.0.84.2.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SPL.INTERNAL

O17 - HKLM\Software\..\Telephony: DomainName = SPL.INTERNAL

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SPL.INTERNAL

O20 - Winlogon Notify: gsvgewwg - C:\WINDOWS\SYSTEM32\gsvgewwg.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

--

End of file - 4602 bytes

chi-chi · February 2008

Now my clock and date is acting up showing military time or a 0 before the time if i try to change it, and the date is right but backwards ??

farbar · February 2008

O.K. And where is the combofix log?

chi-chi · February 2008

ComboFix 08-02-23 - cohene-asante 2008-02-22 4:09:14.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.89 [GMT -5:00]

Running from: C:\Documents and Settings\cohene-asante\Desktop\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\LocalService\Application Data\NetMon

C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt

C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe

C:\Program Files\inetget2

C:\Program Files\StorageProtector

C:\Program Files\StorageProtector\SysRep.exe

C:\Program Files\StorageProtector\SysRep.exe.xml

C:\Program Files\StorageProtector\unins000.dat

C:\Program Files\StorageProtector\unins000.exe

C:\WINDOWS\IA

C:\WINDOWS\IA\KE.vbs

C:\WINDOWS\system32\bburomfx.dll

C:\WINDOWS\system32\fkixatmm.dll

C:\WINDOWS\system32\gsvgewwg.dllbox

C:\WINDOWS\system32\knnmp.ini

C:\WINDOWS\system32\knnmp.ini2

C:\WINDOWS\system32\mmtaxikf.ini

C:\WINDOWS\system32\msnav32.ax

C:\WINDOWS\system32\tqwpcomx.ini

C:\WINDOWS\system32\vqpcikcw.ini

C:\WINDOWS\system32\xfmorubb.ini

C:\WINDOWS\system32\xjstvuyt.ini

C:\WINDOWS\system32\xnqntldp.ini

C:\WINDOWS\uninstall_nmon.vbs

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_CMDSERVICE

-------\LEGACY_NETWORK_MONITOR

((((((((((((((((((((((((( Files Created from 2008-01-22 to 2008-02-22 )))))))))))))))))))))))))))))))

.

2008-02-22 15:25 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-02-22 15:23 . 2008-02-22 15:23 <DIR> d-------- C:\Program Files\Common Files\Java

2008-02-22 12:36 . 2008-02-22 12:36 <DIR> d-------- C:\Program Files\Trend Micro

2008-02-22 03:45 . 2008-02-22 03:45 22 --a------ C:\WINDOWS\system32\gsvgewwg.zip

2008-02-06 09:41 . 2008-02-06 09:49 <DIR> d-------- C:\Documents and Settings\cohene-asante\Application Data\wsInspector

2008-02-06 09:37 . 2008-02-06 09:39 <DIR> d-------- C:\Program Files\Startup Inspector for Windows

2008-01-31 08:28 . 2008-01-31 08:28 <DIR> d-------- C:\Program Files\Lavasoft

2008-01-31 08:28 . 2008-01-31 08:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-01-31 08:24 . 2008-01-31 08:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-01-29 23:40 . 2008-01-29 23:40 163,904 --------- C:\WINDOWS\system32\gsvgewwg.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-22 20:25 --------- d-----w C:\Program Files\Java

2008-01-30 15:18 --------- d-----w C:\Documents and Settings\cohene-asante\Application Data\Yahoo!

2008-01-30 15:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!

2008-01-30 15:09 --------- d-----w C:\Program Files\Yahoo!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]

2008-01-29 23:40 163904 --------- C:\WINDOWS\system32\gsvgewwg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="C:\Documents and Settings\cohene-asante\Desktop\Unused Desktop Shortcuts\Mozilla Firefox\plugins\NPSWF32_FlashUtil.exe" [2007-02-20 15:15 190696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208]

"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 02:50 139320]

"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 08:48 147514]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gsvgewwg]

gsvgewwg.dll 2008-01-29 23:40 163904 C:\WINDOWS\system32\gsvgewwg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2109043195-537022207-5522801-2906\Scripts\Logon\0\0]

"******"=D:\Public\inventory.bat

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"C:\\Program Files\\BitLord\\BitLord.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5900:TCP"= 5900:TCP:VNC

"5800:TCP"= 5800:TCP:VNC1

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-22 16:17:35

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\UltraVNC\WinVNC.exe

.

**************************************************************************

.

Completion time: 2008-02-22 16:19:27 - machine was rebooted [cohene-asante]

ComboFix-quarantined-files.txt 2008-02-22 21:19:16

.

2008-02-13 08:04:44 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:27, on 2008-02-22

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\Mcshield.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\UltraVNC\WinVNC.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\cohene-asante\Desktop\Unused Desktop Shortcuts\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE