View Full Version : userinit.exe and rundll32.error :-(
diavoliza
2008-08-03, 20:42
Hello! I am in trouble too and hope that somebody will help me! I have same problems as some people here...
Here is my HJT Log!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:40:18 PM, on 8/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ALEX\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM47847238] Rundll32.exe "C:\WINDOWS\system32\vmqqfqsm.dll",s
O4 - HKLM\..\Run: [44b741a4] rundll32.exe "C:\WINDOWS\system32\wtekmoay.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: cnrunj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9592 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:40:18 PM, on 8/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ALEX\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM47847238] Rundll32.exe "C:\WINDOWS\system32\vmqqfqsm.dll",s
O4 - HKLM\..\Run: [44b741a4] rundll32.exe "C:\WINDOWS\system32\wtekmoay.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: cnrunj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9592 bytes
Hi
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New HijackThis log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
diavoliza
2008-08-12, 01:16
Hello Blade! Thank you for taking care of my problematic computer!
The machine is running much better already!
Here is the reports from Combofix and HightJackThis!
ComboFix 08-08-10.06 - ALEX 2008-08-11 18:37:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.591 [GMT -4:00]
Running from: C:\Documents and Settings\ALEX\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ALEX\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\ALEX\Application Data\macromedia\Flash Player\#SharedObjects\YU32QWW6\interclick.com
C:\Documents and Settings\ALEX\Application Data\macromedia\Flash Player\#SharedObjects\YU32QWW6\interclick.com\ud.sol
C:\Documents and Settings\ALEX\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\ALEX\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\BM47847238.txt
C:\WINDOWS\BM47847238.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aclsxmjg.dll
C:\WINDOWS\system32\aknuichl.dll
C:\WINDOWS\system32\allnpswo.dll
C:\WINDOWS\system32\amlhhcej.dll
C:\WINDOWS\system32\ankqkcxs.dll
C:\WINDOWS\system32\atclukil.ini
C:\WINDOWS\system32\avpumupi.ini
C:\WINDOWS\system32\avxsysvq.dll
C:\WINDOWS\system32\axislsgn.dll
C:\WINDOWS\system32\azscus.dll
C:\WINDOWS\system32\bkgplpfk.ini
C:\WINDOWS\system32\bkhjcxfe.ini
C:\WINDOWS\system32\blfohhml.dll
C:\WINDOWS\system32\btevyfny.dll
C:\WINDOWS\system32\btfxqqyc.dll
C:\WINDOWS\system32\btggsesq.dll
C:\WINDOWS\system32\bvppnrso.dll
C:\WINDOWS\system32\bwweawru.dll
C:\WINDOWS\system32\bxipgr.dll
C:\WINDOWS\system32\cdjkrhgs.dll
C:\WINDOWS\system32\ceukyuvd.dll
C:\WINDOWS\system32\cjhqpyet.dll
C:\WINDOWS\system32\cmwaetmx.ini
C:\WINDOWS\system32\cnrunj.dll
C:\WINDOWS\system32\cpwiepeb.dll
C:\WINDOWS\system32\cruisoth.dll
C:\WINDOWS\system32\csulagqj.ini
C:\WINDOWS\system32\cvngbvbx.dll
C:\WINDOWS\system32\cwkhgxwn.dll
C:\WINDOWS\system32\cwkybbtd.ini
C:\WINDOWS\system32\cwveki.dll
C:\WINDOWS\system32\cxrugnov.dll
C:\WINDOWS\system32\dahxgoyi.dll
C:\WINDOWS\system32\daxhwtsl.dll
C:\WINDOWS\system32\dcgxencf.ini
C:\WINDOWS\system32\dqnmtelq.ini
C:\WINDOWS\system32\ducbklqn.ini
C:\WINDOWS\system32\dyjjsmtv.ini
C:\WINDOWS\system32\edoikoep.ini
C:\WINDOWS\system32\efcCsSmN.dll
C:\WINDOWS\system32\efxcjhkb.dll
C:\WINDOWS\system32\ehldck.dll
C:\WINDOWS\system32\ehuvmrhu.dll
C:\WINDOWS\system32\ejpbrysr.ini
C:\WINDOWS\system32\elhfoebj.dll
C:\WINDOWS\system32\elxigcsu.dll
C:\WINDOWS\system32\emcwrhxd.ini
C:\WINDOWS\system32\eqccktsw.dll
C:\WINDOWS\system32\erpuht.dll
C:\WINDOWS\system32\esmyft.dll
C:\WINDOWS\system32\fcfbpxuq.dll
C:\WINDOWS\system32\fczfru.dll
C:\WINDOWS\system32\fggwntcc.ini
C:\WINDOWS\system32\fiokapif.dll
C:\WINDOWS\system32\fkyiqeqo.dll
C:\WINDOWS\system32\fohsgohb.dll
C:\WINDOWS\system32\fojwdwxt.dll
C:\WINDOWS\system32\fqbmovyt.dll
C:\WINDOWS\system32\fsalmrvr.dll
C:\WINDOWS\system32\fxdtol.dll
C:\WINDOWS\system32\fxhtepba.dll
C:\WINDOWS\system32\fxkpporp.dll
C:\WINDOWS\system32\fxnktaki.dll
C:\WINDOWS\system32\fxpuwgbt.dll
C:\WINDOWS\system32\gebbwl.dll
C:\WINDOWS\system32\gfkjyogm.ini
C:\WINDOWS\system32\gkpsycem.ini
C:\WINDOWS\system32\gkuifwgh.dll
C:\WINDOWS\system32\gqffdjkr.dll
C:\WINDOWS\system32\gtfgehih.dll
C:\WINDOWS\system32\gtvjklid.dll
C:\WINDOWS\system32\guqlcxky.dll
C:\WINDOWS\system32\guslsiol.dll
C:\WINDOWS\system32\gwsqagrr.dll
C:\WINDOWS\system32\gyqmiskj.dll
C:\WINDOWS\system32\gyuxwfyi.dll
C:\WINDOWS\system32\hgeinklx.dll
C:\WINDOWS\system32\hgwfiukg.ini
C:\WINDOWS\system32\hhfhxtvr.dll
C:\WINDOWS\system32\hkvpupvf.ini
C:\WINDOWS\system32\hkwkqfnq.dll
C:\WINDOWS\system32\hlpvve.dll
C:\WINDOWS\system32\hnrnsj.dll
C:\WINDOWS\system32\hpgmeylc.ini
C:\WINDOWS\system32\hsgbpirt.ini
C:\WINDOWS\system32\iehojyxa.ini
C:\WINDOWS\system32\ikyfdlhb.ini
C:\WINDOWS\system32\ipumupva.dll
C:\WINDOWS\system32\irmprnsg.dll
C:\WINDOWS\system32\iuoiiq.dll
C:\WINDOWS\system32\ixmiwskw.dll
C:\WINDOWS\system32\iyqcvp.dll
C:\WINDOWS\system32\iysjhwbu.ini
C:\WINDOWS\system32\jbeofhle.ini
C:\WINDOWS\system32\jcliavuv.dll
C:\WINDOWS\system32\jinyppov.ini
C:\WINDOWS\system32\jivkasuu.ini
C:\WINDOWS\system32\jkwgtjgm.exe
C:\WINDOWS\system32\jnvhuaca.exe
C:\WINDOWS\system32\juaisx.dll
C:\WINDOWS\system32\kafrefyj.dll
C:\WINDOWS\system32\kaxuhqae.exe
C:\WINDOWS\system32\kdaanxsl.ini
C:\WINDOWS\system32\kedacjlj.dll
C:\WINDOWS\system32\kgprfkff.dll
C:\WINDOWS\system32\klhcbenk.dll
C:\WINDOWS\system32\kmapqlti.dll
C:\WINDOWS\system32\kqvdma.dll
C:\WINDOWS\system32\kueqsteg.ini
C:\WINDOWS\system32\kwejnrwx.exe
C:\WINDOWS\system32\kyvsmmfv.ini
C:\WINDOWS\system32\lczkbz.dll
C:\WINDOWS\system32\lgeftuxn.dll
C:\WINDOWS\system32\lhciunka.ini
C:\WINDOWS\system32\liysgwry.dll
C:\WINDOWS\system32\loapgqnu.dll
C:\WINDOWS\system32\lpwdmucw.dll
C:\WINDOWS\system32\lqjtjpiv.dll
C:\WINDOWS\system32\lrxhntrm.ini
C:\WINDOWS\system32\lsxnaadk.dll
C:\WINDOWS\system32\luikhjpo.ini
C:\WINDOWS\system32\lxageuus.dll
C:\WINDOWS\system32\lxntjfed.dll
C:\WINDOWS\system32\lycbxnac.dll
C:\WINDOWS\system32\lypjlodj.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mcsesfks.dll
C:\WINDOWS\system32\mglquxsv.dll
C:\WINDOWS\system32\mkbhbjgj.ini
C:\WINDOWS\system32\mkkxmchp.dll
C:\WINDOWS\system32\mlcnkc.dll
C:\WINDOWS\system32\mqcwcamq.ini
C:\WINDOWS\system32\mqhicf.dll
C:\WINDOWS\system32\mrewsjnj.dll
C:\WINDOWS\system32\mtkcnabt.ini
C:\WINDOWS\system32\mwhigcpm.ini
C:\WINDOWS\system32\mxpiiywv.dll
C:\WINDOWS\system32\nboyxqyw.ini
C:\WINDOWS\system32\ndibxwnu.ini
C:\WINDOWS\system32\neagjefk.dll
C:\WINDOWS\system32\nluiqrxb.dll
C:\WINDOWS\system32\nmbylpqm.dll
C:\WINDOWS\system32\NmSsCcfe.ini
C:\WINDOWS\system32\NmSsCcfe.ini2
C:\WINDOWS\system32\npobmttw.dll
C:\WINDOWS\system32\npyqrxyj.dll
C:\WINDOWS\system32\nqlkbcud.dll
C:\WINDOWS\system32\oalnnpxs.dll
C:\WINDOWS\system32\ogloasmw.ini
C:\WINDOWS\system32\ojavglle.dll
C:\WINDOWS\system32\okoamq.dll
C:\WINDOWS\system32\omtskggs.dll
C:\WINDOWS\system32\oracgx.dll
C:\WINDOWS\system32\otvmuspb.dll
C:\WINDOWS\system32\otxhvdfb.ini
C:\WINDOWS\system32\peokiode.dll
C:\WINDOWS\system32\pgfmebqg.ini
C:\WINDOWS\system32\phfbnlev.dll
C:\WINDOWS\system32\pjccfoye.dll
C:\WINDOWS\system32\pjmskiar.dll
C:\WINDOWS\system32\pjqeuybt.exe
C:\WINDOWS\system32\pmbsbyrv.dll
C:\WINDOWS\system32\pmdqklvf.dll
C:\WINDOWS\system32\pqajtsyb.dll
C:\WINDOWS\system32\pquqreog.ini
C:\WINDOWS\system32\proppkxf.ini
C:\WINDOWS\system32\pwvdprkn.dll
C:\WINDOWS\system32\qbuhukci.dll
C:\WINDOWS\system32\qdnbue.dll
C:\WINDOWS\system32\qguxtgdq.dll
C:\WINDOWS\system32\qiprrkvu.dll
C:\WINDOWS\system32\qjtzex.dll
C:\WINDOWS\system32\qoualv.dll
C:\WINDOWS\system32\qrwefbjp.ini
C:\WINDOWS\system32\qshnquof.dll
C:\WINDOWS\system32\qtbllvew.dll
C:\WINDOWS\system32\qtlixukp.dll
C:\WINDOWS\system32\qxqlkubc.dll
C:\WINDOWS\system32\qytejrtk.dll
C:\WINDOWS\system32\resynele.dll
C:\WINDOWS\system32\rfsyfwfi.dll
C:\WINDOWS\system32\rgaxyvji.dll
C:\WINDOWS\system32\riomaule.dll
C:\WINDOWS\system32\rllteyxa.ini
C:\WINDOWS\system32\rrgaqswg.ini
C:\WINDOWS\system32\rvdfhgfb.ini
C:\WINDOWS\system32\rvrmlasf.ini
C:\WINDOWS\system32\rwhwgblm.ini
C:\WINDOWS\system32\ryiisptr.dll
C:\WINDOWS\system32\secupwju.exe
C:\WINDOWS\system32\sflkqjpc.dll
C:\WINDOWS\system32\skfsescm.ini
C:\WINDOWS\system32\ssqPhGxU.dll
C:\WINDOWS\system32\sugyijvp.ini
C:\WINDOWS\system32\sulwtlnq.dll
C:\WINDOWS\system32\swdopy.dll
C:\WINDOWS\system32\tbwmkcie.dll
C:\WINDOWS\system32\tcrbtgyr.dll
C:\WINDOWS\system32\tdxsneyc.dll
C:\WINDOWS\system32\teeyqbai.ini
C:\WINDOWS\system32\tenccmpp.dll
C:\WINDOWS\system32\tfhtqvrq.ini
C:\WINDOWS\system32\tfiyks.dll
C:\WINDOWS\system32\thbsmsul.ini
C:\WINDOWS\system32\tkmdrx.dll
C:\WINDOWS\system32\tlhkfuyk.dll
C:\WINDOWS\system32\tlsjdjxw.dll
C:\WINDOWS\system32\tpokjxfx.ini
C:\WINDOWS\system32\trvigd.dll
C:\WINDOWS\system32\ttcgyuye.ini
C:\WINDOWS\system32\ttgjxapl.dll
C:\WINDOWS\system32\tvlougyk.ini
C:\WINDOWS\system32\twpfwfln.dll
C:\WINDOWS\system32\unzrzo.dll
C:\WINDOWS\system32\uodmaskw.ini
C:\WINDOWS\system32\upvhphnq.dll
C:\WINDOWS\system32\utrcewco.dll
C:\WINDOWS\system32\uvvrlxmy.dll
C:\WINDOWS\system32\uxofywpk.dll
C:\WINDOWS\system32\vaidatqa.exe
C:\WINDOWS\system32\vcsbghhx.dll
C:\WINDOWS\system32\vejrevmk.dll
C:\WINDOWS\system32\vmqqfqsm.dll
C:\WINDOWS\system32\vngvekkp.dll
C:\WINDOWS\system32\vongurxc.ini
C:\WINDOWS\system32\vsxuqlgm.ini
C:\WINDOWS\system32\vtUkKCtq.dll
C:\WINDOWS\system32\vvlgwf.dll
C:\WINDOWS\system32\vxivdb.dll
C:\WINDOWS\system32\vxresdrc.dll
C:\WINDOWS\system32\vxwwkusc.ini
C:\WINDOWS\system32\vycfqvkt.dll
C:\WINDOWS\system32\vyvydpoa.dll
C:\WINDOWS\system32\weafgrxx.dll
C:\WINDOWS\system32\weqgrw.dll
C:\WINDOWS\system32\wgfosnpr.ini
C:\WINDOWS\system32\wibvdual.dll
C:\WINDOWS\system32\wigpnybp.dll
C:\WINDOWS\system32\wmhpyxvl.dll
C:\WINDOWS\system32\wpbipd.dll
C:\WINDOWS\system32\wtekmoay.dll
C:\WINDOWS\system32\wudgtdkj.dll
C:\WINDOWS\system32\wvdppown.ini
C:\WINDOWS\system32\wvkybnvg.ini
C:\WINDOWS\system32\wwuexlfb.dll
C:\WINDOWS\system32\xbbytp.dll
C:\WINDOWS\system32\xdhogasr.dll
C:\WINDOWS\system32\xfcgnjpk.dll
C:\WINDOWS\system32\xiavgt.dll
C:\WINDOWS\system32\xjunvudo.ini
C:\WINDOWS\system32\xrmenauk.ini
C:\WINDOWS\system32\xvlmxprq.ini
C:\WINDOWS\system32\xxbrdjdu.ini
C:\WINDOWS\system32\yanbmmwo.ini
C:\WINDOWS\system32\yaomketw.ini
C:\WINDOWS\system32\ybabovfr.dll
C:\WINDOWS\system32\ybjqeaey.dll
C:\WINDOWS\system32\ycymaofm.dll
C:\WINDOWS\system32\ygdgopqr.exe
C:\WINDOWS\system32\ykxhyhmi.ini
C:\WINDOWS\system32\ykyrpyid.ini
C:\WINDOWS\system32\ymxlrvvu.ini
C:\WINDOWS\system32\ynegywbb.dll
C:\WINDOWS\system32\youoqxxd.dll
C:\WINDOWS\system32\ytwrlgea.dll
C:\WINDOWS\system32\yyvxetlw.ini
.
((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.
2008-08-11 02:56 . 2008-08-11 02:56 2,048 --a------ C:\WINDOWS\system32\tkqivkjj.exe
2008-08-10 02:47 . 2008-08-10 02:47 2,048 --a------ C:\WINDOWS\system32\voekujqy.exe
2008-08-09 02:53 . 2008-08-09 02:53 2,048 --a------ C:\WINDOWS\system32\uyrhayvn.exe
2008-08-08 02:53 . 2008-08-08 02:53 2,048 --a------ C:\WINDOWS\system32\aivkpfhb.exe
2008-08-07 02:44 . 2008-08-07 02:44 2,048 --a------ C:\WINDOWS\system32\qubuyium.exe
2008-08-06 02:44 . 2008-08-06 02:44 2,048 --a------ C:\WINDOWS\system32\fdhgohuh.exe
2008-08-05 02:53 . 2008-08-05 02:53 2,048 --a------ C:\WINDOWS\system32\qdwlvdhu.exe
2008-08-02 02:41 . 2008-08-02 02:41 48 --a------ C:\WINDOWS\wininit.ini
2008-08-02 02:07 . 2008-08-02 02:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-02 02:05 . 2008-08-02 02:05 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-02 01:57 . 2008-08-02 03:16 <DIR> d-------- C:\Ad-Aware
2008-08-01 17:45 . 2008-08-02 07:29 <DIR> d-------- C:\Incomplete
2008-08-01 01:53 . 2008-08-01 01:53 43,516 --a------ C:\WINDOWS\system32\jnmoxrog.dll
2008-07-11 19:48 . 2008-07-11 19:48 <DIR> d-------- C:\Program Files\iPod
2008-07-11 19:45 . 2008-07-11 19:45 <DIR> d-------- C:\Program Files\Bonjour
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-11 20:27 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-07 07:46 --------- d-----w C:\Documents and Settings\ALEX\Application Data\Azureus
2008-08-02 10:01 --------- d-----w C:\Documents and Settings\ALEX\Application Data\LimeWire
2008-08-01 05:43 --------- d-----w C:\Program Files\Norton Internet Security
2008-07-24 09:09 --------- d-----w C:\Program Files\Java
2008-07-11 23:49 --------- d-----w C:\Program Files\iTunes
2008-07-10 13:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-06-30 21:16 --------- d-----w C:\Program Files\Adobe Acrobat
2008-06-28 11:21 --------- d-----w C:\Program Files\Safari
2008-06-16 07:43 --------- d-----w C:\Program Files\Xvid
2008-06-16 07:37 --------- d-----w C:\Program Files\QuickTime
2008-06-16 07:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-11 12:41 92,064 ----a-w C:\Documents and Settings\ALEX\mqdmmdm.sys
2008-05-11 12:41 9,232 ----a-w C:\Documents and Settings\ALEX\mqdmmdfl.sys
2008-05-11 12:41 79,328 ----a-w C:\Documents and Settings\ALEX\mqdmserd.sys
2008-05-11 12:41 66,656 ----a-w C:\Documents and Settings\ALEX\mqdmbus.sys
2008-05-11 12:41 6,208 ----a-w C:\Documents and Settings\ALEX\mqdmcmnt.sys
2008-05-11 12:41 5,936 ----a-w C:\Documents and Settings\ALEX\mqdmwhnt.sys
2008-05-11 12:41 4,048 ----a-w C:\Documents and Settings\ALEX\mqdmcr.sys
2008-05-11 12:41 25,600 ----a-w C:\Documents and Settings\ALEX\usbsermptxp.sys
2008-05-11 12:41 22,768 ----a-w C:\Documents and Settings\ALEX\usbsermpt.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-02-09 22:05 344064]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 11:42 58728]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-02-11 20:31 100056]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 13:17 694008]
"DT GWY"="C:\Program Files\Gateway\EzTune\DTHtml.exe" [2007-05-02 18:01 282624]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-11 17:02 185632]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 18:20 339968 C:\WINDOWS\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 17:38 39264]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Limewire\\LimeWire.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 13:17]
R3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\system32\drivers\pivotmou.sys [2007-02-09 13:17]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15520440-d906-11dc-90ad-00123f72bbe8}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
2008-08-09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2008-08-11 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20]
2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - ALEX.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-19 12:54]
.
- - - - ORPHANS REMOVED - - - -
BHO-{D47FAEEA-E35F-4133-B2DF-E38A5AE1B08E} - C:\Documents and Settings\ALEX\Local Settings\Temporary Internet Files\Content.IE5\PNE1DX51\3077ahntdksr[1].dll
HKCU-Run-Aim6 - (no file)
HKLM-Run-WinampAgent - C:\Program Files\Winamp\winampa.exe
HKLM-Run-44b741a4 - C:\WINDOWS\system32\uvvrlxmy.dll
HKLM-Run-BM47847238 - C:\WINDOWS\system32\qshnquof.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\ALEX\Application Data\Mozilla\Firefox\Profiles\lm1tg5e4.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.gmail.com
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-11 18:58:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
C:\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Portrait Displays\Pivot Software\Floater.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\system32\dwwin.exe
.
**************************************************************************
.
Completion time: 2008-08-11 19:09:26 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-11 23:09:24
Pre-Run: 31,995,183,104 bytes free
Post-Run: 32,547,905,536 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
443 --- E O F --- 2008-08-11 23:08:56
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:10:33 PM, on 8/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Gateway\EzTune\DTHtml.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\ALEX\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10016 bytes
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.
Azureus
LimeWire
I'd like you to read the this thread (http://forums.spybot.info/showthread.php?t=282).
Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
Delete these folders afterwards:
C:\Documents and Settings\ALEX\Application Data\Azureus
C:\Documents and Settings\ALEX\Application Data\LimeWire
C:\Program Files\Azureus
C:\Program Files\LimeWire
Empty Recycle Bin.
After that:
Download Deckard's System Scanner (DSS) (http://deckard.geekstogo.com/dss.exe) to your Desktop. Note: You must be logged onto an account with administrator privileges.
Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply
diavoliza
2008-08-13, 00:07
Hello, Blade! Thank you for your help. One thing I wanted to mention - my computer suddenly restarted today..don't know why... Anyways...
Here are thee requested logs:
Deckard's System Scanner v20071014.68
Run by ALEX on 2008-08-12 17:53:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
180: 2008-08-12 21:54:00 UTC - RP205 - Deckard's System Scanner Restore Point
179: 2008-08-12 21:49:40 UTC - RP204 - Removed Ad-Aware
178: 2008-08-12 18:00:22 UTC - RP203 - Software Distribution Service 3.0
177: 2008-08-11 23:50:32 UTC - RP202 - Installed Windows Installer KB893803v2.
176: 2008-08-11 23:08:35 UTC - RP201 - Software Distribution Service 3.0
-- First Restore Point --
1: 2008-05-17 00:21:47 UTC - RP26 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as ALEX.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:54:52 PM, on 8/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Gateway\EzTune\DTHtml.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\ALEX\Desktop\dss.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\taskmgr.exe
C:\DOCUME~1\ALEX\Desktop\ALEX.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9979 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 Pivot - c:\windows\system32\drivers\pivot.sys <Not Verified; Portrait Displays, Inc.; Windows (R) 2000 DDK driver>
R3 pdiddcci (DDC/CI monitor) - c:\windows\system32\drivers\pdiddcci.sys <Not Verified; Portrait Displays, Inc.; Portrait Displays DDC/CI Monitor Device Driver>
R3 pivotmou (Pivot Mouse/Pointers Filter Driver) - c:\windows\system32\drivers\pivotmou.sys <Not Verified; Portrait Displays, Inc.; Pivot (R) Software (R)>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 DTSRVC (Portrait Displays Display Tune Service) - c:\program files\common files\portrait displays\shared\dtsrvc.exe
R3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: TI Technologies Inc.
Description: RADEON X600 256MB HyperMemory Secondary
Device ID: PCI\VEN_1002&DEV_5B72&SUBSYS_06031002&REV_00\4&1A646D2D&0&0108
Manufacturer: ATI Technologies Inc.
Name: RADEON X600 256MB HyperMemory Secondary
PNP Device ID: PCI\VEN_1002&DEV_5B72&SUBSYS_06031002&REV_00\4&1A646D2D&0&0108
Service: ati2mtag
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Simple Communications Controller
Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200F14F1&REV_00\4&5855BE9&0&28F0
Manufacturer:
Name: PCI Simple Communications Controller
PNP Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200F14F1&REV_00\4&5855BE9&0&28F0
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_8086&DEV_27DA&SUBSYS_01A71028&REV_01\3&172E68DD&0&FB
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_8086&DEV_27DA&SUBSYS_01A71028&REV_01\3&172E68DD&0&FB
Service:
-- Scheduled Tasks -------------------------------------------------------------
2008-08-12 14:11:38 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job
2008-08-09 07:17:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-08-09 01:49:48 546 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - ALEX.job
-- Files created between 2008-07-12 and 2008-08-12 -----------------------------
2008-08-11 18:36:55 0 d-------- C:\cmdcons
2008-08-11 18:33:29 68096 --a------ C:\WINDOWS\zip.exe
2008-08-11 18:33:29 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-08-11 18:33:28 49152 --a------ C:\WINDOWS\VFind.exe
2008-08-11 18:33:28 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-08-11 18:33:28 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-08-11 18:33:28 98816 --a------ C:\WINDOWS\sed.exe
2008-08-11 18:33:28 80412 --a------ C:\WINDOWS\grep.exe
2008-08-11 18:33:28 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-08-11 02:56:18 2048 --a------ C:\WINDOWS\system32\tkqivkjj.exe
2008-08-10 02:47:19 2048 --a------ C:\WINDOWS\system32\voekujqy.exe
2008-08-09 02:53:18 2048 --a------ C:\WINDOWS\system32\uyrhayvn.exe
2008-08-08 02:53:18 2048 --a------ C:\WINDOWS\system32\aivkpfhb.exe
2008-08-07 02:44:38 2048 --a------ C:\WINDOWS\system32\qubuyium.exe
2008-08-06 02:44:19 2048 --a------ C:\WINDOWS\system32\fdhgohuh.exe
2008-08-05 02:53:18 2048 --a------ C:\WINDOWS\system32\qdwlvdhu.exe
2008-08-02 02:07:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-02 01:57:07 0 d-------- C:\Ad-Aware
2008-08-01 01:53:09 43516 --a------ C:\WINDOWS\system32\jnmoxrog.dll
-- Find3M Report ---------------------------------------------------------------
2008-08-12 17:54:45 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-12 17:49:51 0 d-------- C:\Program Files\Common Files
2008-08-07 03:46:54 0 d-------- C:\Documents and Settings\ALEX\Application Data\Azureus
2008-08-02 06:01:44 0 d-------- C:\Documents and Settings\ALEX\Application Data\LimeWire
2008-08-01 01:43:46 0 d-------- C:\Program Files\Norton Internet Security
2008-07-24 05:09:42 0 d-------- C:\Program Files\Java
2008-07-11 19:49:42 0 d-------- C:\Program Files\iTunes
2008-07-11 19:48:37 0 d-------- C:\Program Files\iPod
2008-07-11 19:45:12 0 d-------- C:\Program Files\Bonjour
2008-06-30 17:16:13 0 d-------- C:\Program Files\Adobe Acrobat
2008-06-28 07:21:23 0 d-------- C:\Program Files\Safari
2008-06-16 03:43:54 0 d-------- C:\Program Files\Xvid
2008-06-16 03:37:37 0 d-------- C:\Program Files\QuickTime
2008-05-17 03:03:39 20352 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-05-16 13:31:49 69417 --a------ C:\WINDOWS\hpoins05.dat
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [02/09/2006 10:05 PM]
"SigmatelSysTrayApp"="stsystra.exe" [03/22/2005 06:20 PM C:\WINDOWS\stsystra.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/17/2008 11:42 AM]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [02/11/2008 08:31 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [02/09/2007 01:17 PM]
"DT GWY"="C:\Program Files\Gateway\EzTune\DTHtml.exe" [05/02/2007 06:01 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/11/2008 05:02 PM]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe" [01/11/2008 07:54 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2008 10:51 AM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15520440-d906-11dc-90ad-00123f72bbe8}]
AutoRun\command- F:\setupSNK.exe
-- End of Deckard's System Scanner: finished at 2008-08-12 17:56:47 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English
CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
Percentage of Memory in Use: 40%
Physical Memory (total/avail): 1022.09 MiB / 608.75 MiB
Pagefile Memory (total/avail): 2459.33 MiB / 2108.87 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1939.39 MiB
C: is Fixed (NTFS) - 93.36 GiB total, 30.27 GiB free.
D: is CDROM (No Media)
E: is CDROM (No Media)
\\.\PHYSICALDRIVE0 - Maxtor 6L100M0 - 93.36 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 93.36 GiB - C:
-- Security Center -------------------------------------------------------------
AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.
AntiVirusDisableNotify is set.
FW: Norton Internet Security v2005 (Symantec Corporation)
AV: Norton Internet Security v2005 (Symantec Corporation)
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Limewire\\LimeWire.exe"="C:\\Program Files\\Limewire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\ALEX\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_04\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=ALEX-FHXMPNIWPL
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\ALEX
LOGONSERVER=\\ALEX-FHXMPNIWPL
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0403
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.6.0_04\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\ALEX\LOCALS~1\Temp
TMP=C:\DOCUME~1\ALEX\LOCALS~1\Temp
USERDOMAIN=ALEX-FHXMPNIWPL
USERNAME=ALEX
USERPROFILE=C:\Documents and Settings\ALEX
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI
-- User Profiles ---------------------------------------------------------------
ALEX [I](admin)
-- Add/Remove Programs ---------------------------------------------------------
--> C:\Alex\DivX\DivXConverterUninstall.exe /CONVERTER
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 8.1.2 Professional --> msiexec /I {AC76BA86-1033-F400-7760-000000000003}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
AIM 6 --> C:\Program Files\AIM6\uninst.exe
Apple Mobile Device Support --> MsiExec.exe /I{35B91753-5789-4517-9CF1-2CCE3A8CF4F1}
Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver --> rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Avanquest update --> C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe -runfromtemp -l0x0009 -removeonly
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
CC_ccProxyExt --> MsiExec.exe /I{DA42FDCA-7C5A-43EF-9A05-CCE148ADF919}
ccCommon --> MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}
ccPxyCore --> MsiExec.exe /I{FC08587A-4F01-4188-819F-F55880022917}
Diablo II --> C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
Diablo II --> C:\WINDOWS\DIIUnin.exe C:\WINDOWS\DIIUnin.dat
DivX Codec --> C:\Alex\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader --> C:\Alex\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter --> C:\Alex\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player --> C:\Alex\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player --> C:\Alex\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EzTune --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4955758-B754-471D-9091-7CE2C3D9E9AA}\setup.exe" -l0x9 -removeonly
High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2 --> "C:\Documents and Settings\ALEX\Desktop\HijackThis.exe" /uninstall
HP PSC & Officejet 4.7 Corporate Edition --> "C:\Program Files\HP\Digital Imaging\{8EA67542-82B6-4c5c-8AD3-CD36232C1362}\setup\hpzscr01.exe" -datfile hposcr05.dat
Intel(R) PRO Network Connections Drivers --> Prounstl.exe
iTunes --> MsiExec.exe /I{EF6C4600-306D-4F6A-A119-C2A877D25B4A}
Java(TM) 6 Update 4 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) 6 Update 7 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LiveReg (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
LiveUpdate 3.0 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Office XP Professional --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0050048383C9}
Motorola Driver Installation --> MsiExec.exe /I{3324A5DC-C7F6-430A-ACC8-F251CD8F4FC7}
Motorola Phone Tools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}\setup.exe" -l0x9 -removeonly
Mozilla Firefox (2.0.0.16) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSRedist --> MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
Norton AntiSpam --> MsiExec.exe /I{3B29A786-5803-4e9e-9B58-3014A5B4E519}
Norton AntiSpam --> MsiExec.exe /I{5677563D-0CB1-485f-9E18-C5025306BB3F}
Norton AntiVirus 2005 --> MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
Norton Internet Security --> MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125}
Norton Internet Security --> MsiExec.exe /I{449F3A9E-9903-4a0d-A209-08030D45A935}
Norton Internet Security --> MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
Norton Internet Security --> MsiExec.exe /I{526AD5DC-CFC4-4f2a-8442-C84CC91D6C7F}
Norton Internet Security --> MsiExec.exe /I{A93C9E60-29B6-49da-BA21-F70AC6AADE20}
Norton Internet Security --> MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security --> MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Internet Security --> MsiExec.exe /I{FC2C0536-583C-46c0-844A-62CECAE01F22}
Norton Internet Security 2005 (Symantec Corporation) --> C:\Program Files\Common Files\Symantec Shared\SymSetup\{A93C9E60-29B6-49da-BA21-F70AC6AADE20}.exe /X
Norton WMI Update --> MsiExec.exe /X{E85FA9A1-C241-4698-893B-DD99509B8DB0}
Norton WMI Update --> MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4}
Pivot Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}\setup.exe" -l0x9 -removeonly
QuickTime --> MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Safari --> MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}
SDK --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}\setup.exe" -l0x9
SigmaTel Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly
SPBBC --> MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Symantec Script Blocking Installer --> MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138}
SymNet --> MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
Tom Clancy's Rainbow Six 3: Iron Wrath 1.00.000 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{81521545-BE95-4869-92FA-CC2E276C790E}\Setup.exe" -l0x9
Tom Clancy's Rainbow Six 3: Raven Shield 1.60.412 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AF131494-F5D8-45C5-938C-D5F020CF1B0D}\setup.exe" -l0x9
VideoLAN VLC media player 0.8.6e --> C:\Alex\VLC Player\VLC\uninstall.exe
Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Defender --> MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
Xvid 1.1.3 final uninstall --> "C:\Program Files\Xvid\unins000.exe"
-- Application Event Log -------------------------------------------------------
Event Record #/Type4903 / Warning
Event Submitted/Written: 08/12/2008 02:07:37 PM
Event ID/Source: 1524 / Userenv
Event Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.
Event Record #/Type4901 / Error
Event Submitted/Written: 08/11/2008 07:09:05 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application cscript.exe, version 5.6.0.8820, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Event Record #/Type4900 / Error
Event Submitted/Written: 08/11/2008 07:08:58 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application cscript.exe, version 5.6.0.8820, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Event Record #/Type4858 / Error
Event Submitted/Written: 08/11/2008 02:16:03 AM
Event ID/Source: 5000 / MPSampleSubmission
Event Description:
mptelemetry80070422updateservicemanager-_get_servicesfallbackcheck1.1.1593.0mpsigdwn.dll1.1.1593.0windows defenderNILNILNIL
Event Record #/Type4845 / Error
Event Submitted/Written: 08/10/2008 10:37:23 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application Safari.exe, version 3.525.21.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type11438 / Error
Event Submitted/Written: 08/12/2008 05:46:32 PM
Event ID/Source: 59 / SideBySide
Event Description:
Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_39049d00\MFC80U.DLL.
Reference error message: The operation completed successfully.
.
Event Record #/Type11437 / Error
Event Submitted/Written: 08/12/2008 05:46:32 PM
Event ID/Source: 59 / SideBySide
Event Description:
Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC.
Reference error message: The referenced assembly is not installed on your system.
.
Event Record #/Type11436 / Error
Event Submitted/Written: 08/12/2008 05:46:32 PM
Event ID/Source: 32 / SideBySide
Event Description:
Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system.
Event Record #/Type11435 / Error
Event Submitted/Written: 08/12/2008 05:46:32 PM
Event ID/Source: 59 / SideBySide
Event Description:
Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_39049d00\MFC80U.DLL.
Reference error message: The operation completed successfully.
.
Event Record #/Type11434 / Error
Event Submitted/Written: 08/12/2008 05:46:32 PM
Event ID/Source: 59 / SideBySide
Event Description:
Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC.
Reference error message: The referenced assembly is not installed on your system.
.
-- End of Deckard's System Scanner: finished at 2008-08-12 17:56:47 ------------
Hi
Uninstall vulnerable Java(TM) 6 Update 4 thru add/remove programs.
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\system32\tkqivkjj.exe
C:\WINDOWS\system32\voekujqy.exe
C:\WINDOWS\system32\uyrhayvn.exe
C:\WINDOWS\system32\aivkpfhb.exe
C:\WINDOWS\system32\qubuyium.exe
C:\WINDOWS\system32\fdhgohuh.exe
C:\WINDOWS\system32\qdwlvdhu.exe
C:\WINDOWS\system32\jnmoxrog.dll
Registry::
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Limewire\\LimeWire.exe"=-
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner). Post back its report, a fresh hjt log and above meantioned ComboFix resultant log.
diavoliza
2008-08-13, 22:18
ComboFix 08-08-12.01 - ALEX 2008-08-13 14:49:38.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.493 [GMT -4:00]
Running from: C:\Documents and Settings\ALEX\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ALEX\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\WINDOWS\system32\aivkpfhb.exe
C:\WINDOWS\system32\fdhgohuh.exe
C:\WINDOWS\system32\jnmoxrog.dll
C:\WINDOWS\system32\qdwlvdhu.exe
C:\WINDOWS\system32\qubuyium.exe
C:\WINDOWS\system32\tkqivkjj.exe
C:\WINDOWS\system32\uyrhayvn.exe
C:\WINDOWS\system32\voekujqy.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\aivkpfhb.exe
C:\WINDOWS\system32\fdhgohuh.exe
C:\WINDOWS\system32\jnmoxrog.dll
C:\WINDOWS\system32\qdwlvdhu.exe
C:\WINDOWS\system32\qubuyium.exe
C:\WINDOWS\system32\tkqivkjj.exe
C:\WINDOWS\system32\uyrhayvn.exe
C:\WINDOWS\system32\voekujqy.exe
.
((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 )))))))))))))))))))))))))))))))
.
2008-08-12 17:53 . 2008-08-12 17:53 <DIR> d-------- C:\Deckard
2008-08-11 19:07 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-02 02:41 . 2008-08-02 02:41 48 --a------ C:\WINDOWS\wininit.ini
2008-08-02 02:07 . 2008-08-02 02:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-12 21:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-07 07:46 --------- d-----w C:\Documents and Settings\ALEX\Application Data\Azureus
2008-08-02 10:01 --------- d-----w C:\Documents and Settings\ALEX\Application Data\LimeWire
2008-08-01 05:43 --------- d-----w C:\Program Files\Norton Internet Security
2008-07-24 09:09 --------- d-----w C:\Program Files\Java
2008-07-11 23:49 --------- d-----w C:\Program Files\iTunes
2008-07-11 23:48 --------- d-----w C:\Program Files\iPod
2008-07-11 23:45 --------- d-----w C:\Program Files\Bonjour
2008-07-10 13:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-06-30 21:16 --------- d-----w C:\Program Files\Adobe Acrobat
2008-06-28 11:21 --------- d-----w C:\Program Files\Safari
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-16 07:43 --------- d-----w C:\Program Files\Xvid
2008-06-16 07:37 --------- d-----w C:\Program Files\QuickTime
2008-06-16 07:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-11 12:41 92,064 ----a-w C:\Documents and Settings\ALEX\mqdmmdm.sys
2008-05-11 12:41 9,232 ----a-w C:\Documents and Settings\ALEX\mqdmmdfl.sys
2008-05-11 12:41 79,328 ----a-w C:\Documents and Settings\ALEX\mqdmserd.sys
2008-05-11 12:41 66,656 ----a-w C:\Documents and Settings\ALEX\mqdmbus.sys
2008-05-11 12:41 6,208 ----a-w C:\Documents and Settings\ALEX\mqdmcmnt.sys
2008-05-11 12:41 5,936 ----a-w C:\Documents and Settings\ALEX\mqdmwhnt.sys
2008-05-11 12:41 4,048 ----a-w C:\Documents and Settings\ALEX\mqdmcr.sys
2008-05-11 12:41 25,600 ----a-w C:\Documents and Settings\ALEX\usbsermptxp.sys
2008-05-11 12:41 22,768 ----a-w C:\Documents and Settings\ALEX\usbsermpt.sys
.
((((((((((((((((((((((((((((( snapshot@2008-08-11_19.04.58.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-02-26 11:48:44 297,984 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\SP2QFE\msctf.dll
+ 2007-03-06 01:22:36 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spmsg.dll
+ 2007-03-06 01:22:41 213,216 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spuninst.exe
+ 2007-03-06 01:22:34 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\spcustom.dll
+ 2007-03-06 01:22:59 716,000 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe
+ 2007-03-06 01:23:51 371,424 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\updspapi.dll
+ 2008-05-07 04:55:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll
+ 2008-05-07 05:04:15 1,288,192 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll
+ 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spmsg.dll
+ 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe
+ 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll
+ 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
+ 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll
+ 2006-08-16 12:08:32 100,352 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll
+ 2008-06-20 10:44:08 138,368 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
+ 2008-06-20 17:36:11 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll
+ 2008-06-20 17:36:11 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
+ 2008-06-20 10:44:42 360,960 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
+ 2008-06-20 09:32:39 225,920 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys
+ 2008-06-20 11:40:08 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
+ 2008-06-20 17:46:57 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll
+ 2008-06-20 17:46:57 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
+ 2008-06-20 11:51:12 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
+ 2008-06-20 11:08:27 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys
+ 2008-06-20 11:48:03 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
+ 2008-06-20 17:43:05 147,968 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
+ 2008-06-20 17:43:05 245,248 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
+ 2008-06-20 11:59:02 361,600 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
+ 2008-06-20 11:16:44 225,856 ----a-w C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
+ 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spmsg.dll
+ 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe
+ 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll
+ 2007-11-30 12:39:18 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
+ 2007-11-30 12:39:19 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll
+ 2008-06-13 13:10:50 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
+ 2008-03-01 13:06:20 124,928 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll
+ 2008-03-01 13:06:21 347,136 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll
+ 2008-03-01 13:06:21 214,528 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll
+ 2008-03-01 13:06:21 133,120 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll
+ 2008-03-01 13:06:21 63,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll
+ 2008-02-29 08:55:23 70,656 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe
+ 2008-03-01 13:06:21 153,088 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll
+ 2008-03-01 13:06:21 230,400 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll
+ 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll
+ 2008-03-01 13:06:22 383,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll
+ 2008-03-01 13:06:22 384,512 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll
+ 2008-03-01 13:06:24 6,066,176 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll
+ 2008-03-01 13:06:24 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll
+ 2008-03-01 13:06:25 267,776 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll
+ 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe
+ 2008-02-29 08:55:46 625,664 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
+ 2008-03-01 13:06:25 27,648 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll
+ 2008-03-01 13:06:26 459,264 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll
+ 2008-03-01 13:06:26 52,224 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll
+ 2008-03-01 22:36:30 3,591,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll
+ 2008-03-01 13:06:28 478,208 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll
+ 2008-03-01 13:06:28 193,024 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll
+ 2008-03-01 13:06:29 671,232 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll
+ 2008-03-01 13:06:29 102,912 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll
+ 2008-03-01 13:06:29 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll
+ 2008-03-01 13:06:29 105,984 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\url.dll
+ 2008-03-01 13:06:30 1,159,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll
+ 2008-03-01 13:06:30 233,472 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll
+ 2008-03-01 13:06:31 826,368 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
- 2008-03-01 13:06:20 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-04-23 04:16:28 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-03-01 13:06:20 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-04-23 04:16:28 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-06-20 10:44:38 138,368 -c----w C:\WINDOWS\system32\dllcache\afd.sys
- 2008-02-20 05:32:43 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 -c--a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
- 2008-03-01 13:06:21 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-23 04:16:28 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-03-01 13:06:21 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-23 04:16:28 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-03-01 13:06:21 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-23 04:16:28 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-03-01 13:06:21 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-02-29 08:55:23 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-03-01 13:06:21 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-03-01 13:06:21 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-04-20 05:07:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2008-03-01 13:06:22 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-03-01 13:06:22 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-03-01 13:06:24 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2008-03-01 13:06:24 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-03-01 13:06:25 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2008-02-29 08:55:46 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2008-03-01 13:06:25 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-23 04:16:28 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-02-26 11:59:50 294,912 -c----w C:\WINDOWS\system32\dllcache\msctf.dll
- 2008-03-01 13:06:26 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-03-01 13:06:26 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-03-01 22:36:30 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-24 02:16:30 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-03-01 13:06:28 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-23 04:16:28 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-03-01 13:06:28 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-23 04:16:28 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-03-01 13:06:29 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-23 04:16:28 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-20 17:41:10 245,248 -c----w C:\WINDOWS\system32\dllcache\mswsock.dll
- 2008-03-01 13:06:29 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-03-01 13:06:29 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:43:03 1,287,680 -c----w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 -c----w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 10:45:13 360,320 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-06-20 09:52:06 225,920 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2008-03-01 13:06:29 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2008-03-01 13:06:30 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-23 04:16:29 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-03-01 13:06:30 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-03-01 13:06:31 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-23 04:16:29 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-02-20 05:32:43 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:41:10 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2006-07-13 08:48:58 202,240 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2008-05-08 12:28:49 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2008-03-01 13:06:21 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-23 04:16:28 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-03-01 13:06:21 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-04-23 04:16:28 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-03-01 13:06:21 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-04-23 04:16:28 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2008-03-01 13:06:21 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-04-23 04:16:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2008-02-29 08:55:23 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-04-22 07:39:58 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
- 2008-03-01 13:06:21 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
+ 2008-04-23 04:16:28 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
- 2008-03-01 13:06:21 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
+ 2008-04-23 04:16:28 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
- 2008-02-15 05:44:25 161,792 ------w C:\WINDOWS\system32\ieakui.dll
+ 2008-04-20 05:07:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll
- 2008-03-01 13:06:22 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-04-23 04:16:28 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2008-03-01 13:06:22 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-04-23 04:16:28 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
- 2008-03-01 13:06:24 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-04-23 04:16:28 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2008-03-01 13:06:24 44,544 ------w C:\WINDOWS\system32\iernonce.dll
+ 2008-04-23 04:16:28 44,544 ------w C:\WINDOWS\system32\iernonce.dll
- 2008-03-01 13:06:25 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-04-23 04:16:28 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2008-03-01 13:06:25 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
+ 2008-04-23 04:16:28 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
- 2004-08-04 05:56:44 294,400 ----a-w C:\WINDOWS\system32\msctf.dll
+ 2008-02-26 11:59:50 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
- 2008-03-01 13:06:26 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-04-23 04:16:28 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2008-03-01 13:06:26 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-04-23 04:16:28 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-03-01 22:36:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-04-24 02:16:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-03-01 13:06:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-04-23 04:16:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-03-01 13:06:28 193,024 ------w C:\WINDOWS\system32\msrating.dll
+ 2008-04-23 04:16:28 193,024 ------w C:\WINDOWS\system32\msrating.dll
- 2008-03-01 13:06:29 671,232 ------w C:\WINDOWS\system32\mstime.dll
+ 2008-04-23 04:16:28 671,232 ------w C:\WINDOWS\system32\mstime.dll
- 2008-03-01 13:06:29 102,912 ------w C:\WINDOWS\system32\occache.dll
+ 2008-04-23 04:16:28 102,912 ------w C:\WINDOWS\system32\occache.dll
- 2008-08-03 04:16:25 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-12 18:12:55 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-03 04:16:25 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-12 18:12:55 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-03-01 13:06:29 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-10-29 22:43:03 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
- 2006-10-09 01:51:14 14,640 ----a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2008-03-01 13:06:29 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-04-23 04:16:28 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2008-03-01 13:06:30 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-04-23 04:16:29 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-03-01 13:06:30 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-04-23 04:16:29 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
- 2008-03-01 13:06:31 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-04-23 04:16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-02-09 22:05 344064]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 11:42 58728]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-02-11 20:31 100056]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 13:17 694008]
"DT GWY"="C:\Program Files\Gateway\EzTune\DTHtml.exe" [2007-05-02 18:01 282624]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-11 17:02 185632]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 18:20 339968 C:\WINDOWS\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 17:38 39264]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 13:17]
R3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\system32\drivers\pivotmou.sys [2007-02-09 13:17]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15520440-d906-11dc-90ad-00123f72bbe8}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
2008-08-09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2008-08-13 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20]
2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - ALEX.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-19 12:54]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-13 14:51:38
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-13 14:53:04
ComboFix-quarantined-files.txt 2008-08-13 18:52:38
ComboFix2.txt 2008-08-11 23:09:27
Pre-Run: 32,476,299,264 bytes free
Post-Run: 32,466,157,568 bytes free
346 --- E O F --- 2008-08-12 18:02:23
diavoliza
2008-08-13, 22:19
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:59:14 PM, on 8/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\ALEX\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe Acrobat\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9887 bytes
diavoliza
2008-08-13, 22:20
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, August 13, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, August 13, 2008 20:00:42
Records in database: 1090281
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Scan statistics:
Files scanned: 46798
Threat name: 63
Infected objects: 152
Suspicious objects: 0
Duration of the scan: 00:58:33
File name / Threat name / Threats count
C:\Program Files\Adobe Acrobat\Adobe Acrobat Professional 8.10\Keygen.exe Infected: Trojan-Dropper.Win32.VB.bix 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\013B0182.DLL Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\018B0A1A.tmp Infected: Trojan-Downloader.Win32.Homles.bl 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\031563CE.IE5 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\03975F3A Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\03AD384C.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\049E10B8.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.rtf 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\06827E83.htm Infected: Trojan-Downloader.JS.Agent.bou 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\075742D8.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.srg 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\08885124.dll Infected: not-a-virus:AdWare.Win32.BHO.cbd 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0A9962DE Infected: Trojan.Win32.Monder.bez 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0ECE2337.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0FDD2AA4.exe Infected: Trojan-Downloader.Win32.Homles.bl 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\113B4152.DLL Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\12E87ED6.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\130B0886 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\134E74DE.dll Infected: Trojan.Win32.Monder.alp 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\15B36A72.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\15BC6867.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\16040418.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\161E53FB.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\162851F0.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\162F25E9.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\165C71B7.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\19D63729.DLL Infected: Trojan.Win32.Monder.zb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1DAC4EC6.dll Infected: Trojan.Win32.Monder.alo 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1DE179B6 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\22624306.DLL Infected: Trojan.Win32.Monder.axm 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2D552303 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2EFB59F7.exe Infected: Trojan-Dropper.Win32.VB.bix 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\325D1A2A.dll Infected: Trojan.Win32.Monder.xo 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\32744011.dll Infected: Trojan-Downloader.Win32.ConHook.apx 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\32B95B0B.IE5 Infected: Trojan.Win32.Monder.axm 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\332039AE.DLL Infected: Trojan-PSW.Win32.OnLineGames.apjl 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3342152F.dll Infected: Trojan.Win32.Monder.yj 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\336C58E4.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\33C84E9C.dll Infected: Trojan-Downloader.Win32.ConHook.apx 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\33E21E7F.dll Infected: Trojan-Downloader.Win32.ConHook.apx 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34163E45.dll Infected: Trojan.Win32.Monder.yj 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\346650BC.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\35323CCB.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\35DF0EBA Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\36D20F77.DLL Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\418F64D9.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\438B5672.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4458715C Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44FE36EF.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4594424A.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\45AB0774.IE5 Infected: Trojan.Win32.Monderc.a 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4D1F20D7.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4D286B68 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4D8516DF.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4E345F52.dll Infected: Trojan-Downloader.Win32.Delf.kbv 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4FC444A2.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\57562E03.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\57E370C7.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\582A5719.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.sca 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\58417D00.dll Infected: Trojan.Win32.Monderc.a 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\584B7AF5.dll Infected: Trojan.Win32.Monder.wg 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\58996A9F.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\58EB0445.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.srh 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\636C2935 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\679E1D5D.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6DCC0C7C.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6E5D0C00.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6F0468C4.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\704C56EC.DLL Infected: Trojan-PSW.Win32.OnLineGames.apjl 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\708A75E2 Infected: Trojan.Win32.LowZones.gb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\74D739ED Infected: Trojan-PSW.Win32.OnLineGames.apjl 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\74FE31C2 Infected: Trojan.Win32.Monder.pt 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\75EE40DF.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\75F16ADC.dll Infected: Trojan.Win32.Monder.wf 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\75FB68D1.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\761538B4.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\769E1C1D.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76A57016.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76A81A13.dll Infected: Trojan.Win32.Monder.aln 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76AB440F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.tsm 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76AF6E0B.dll Infected: Trojan.Win32.Agent.reo 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76B54204.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.tsz 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76BF3FF9.dll Infected: Trojan.Win32.Monder.aeo 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76C269F6.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76C613F2.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76C93DEF.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\76CC67EB.dll Infected: Trojan.Win32.Monder.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\770007B2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.trb 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\770235E0.cab Infected: not-a-virus:Downloader.Win32.WinFixer.au 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\770431AE.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\77075BAA.dll Infected: Trojan.Win32.Monder.alp 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\77172D98.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\771B5795.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\77223F66 Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7724558A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.tnx 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\77317D7C.dll Infected: Trojan-Downloader.Win32.ConHook.te 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\774C4D5F.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\774F775B.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\77554B54.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.sby 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\77597551.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ttg 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\776F1B37.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7779192D.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\777C4329.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7BA65626.DLL Infected: Trojan.Win32.Monderc.gen 1
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7C465F76.dll Infected: Trojan.Win32.Monder.pt 1
C:\QooBox\Quarantine\C\WINDOWS\system32\bxipgr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cgx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cnrunj.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cruisoth.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cju 1
C:\QooBox\Quarantine\C\WINDOWS\system32\cxrugnov.dll.vir Infected: Trojan.Win32.Pakes.kay 1
C:\QooBox\Quarantine\C\WINDOWS\system32\efxcjhkb.dll.vir Infected: Trojan.Win32.Monder.dyd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\eqccktsw.dll.vir Infected: Trojan.Win32.Monder.cbv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fkyiqeqo.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fsalmrvr.dll.vir Infected: Trojan.Win32.Monder.cca 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fxnktaki.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.afjt 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fxpuwgbt.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gtvjklid.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cfn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\gwsqagrr.dll.vir Infected: Trojan.Win32.Monder.egz 1
C:\QooBox\Quarantine\C\WINDOWS\system32\hlpvve.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cfn 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ipumupva.dll.vir Infected: Trojan.Win32.Monder.cep 1
C:\QooBox\Quarantine\C\WINDOWS\system32\irmprnsg.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ciy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\iyqcvp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lpwdmucw.dll.vir Infected: Trojan.Win32.Monder.cbv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lqjtjpiv.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lycbxnac.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ccv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mglquxsv.dll.vir Infected: Trojan.Win32.Pakes.kay 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mlcnkc.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\mqhicf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ciy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\npobmttw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeuf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\oracgx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeuf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\peokiode.dll.vir Infected: Trojan.Win32.Monder.cxg 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qdnbue.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdf 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qshnquof.dll.vir Infected: Trojan.Win32.Monder.eqo 1
C:\QooBox\Quarantine\C\WINDOWS\system32\qtlixukp.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\rfsyfwfi.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\riomaule.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ryiisptr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\sflkqjpc.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqPhGxU.dll.vir Infected: Trojan-Downloader.Win32.Agent.pif 1
C:\QooBox\Quarantine\C\WINDOWS\system32\sulwtlnq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cgx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\swdopy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cju 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tenccmpp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.afju 1
C:\QooBox\Quarantine\C\WINDOWS\system32\tfiyks.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ccv 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ttgjxapl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.aeqi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\uvvrlxmy.dll.vir Infected: Trojan.Win32.Monder.epx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vmqqfqsm.dll.vir Infected: Trojan.Win32.Monder.cmm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vngvekkp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chi 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUkKCtq.dll.vir Infected: Trojan-Downloader.Win32.Agent.pif 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vvlgwf.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vxresdrc.dll.vir Infected: Trojan.Win32.Monder.cmm 1
C:\QooBox\Quarantine\C\WINDOWS\system32\weqgrw.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chs 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wtekmoay.dll.vir Infected: Trojan.Win32.Monder.cep 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wudgtdkj.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cat 1
C:\QooBox\Quarantine\C\WINDOWS\system32\xbbytp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chi 1
C:\QooBox\Quarantine\catchme2008-08-11_185602.75.zip Infected: Trojan.Win32.Monder.gen 1
The selected area was scanned.
Hi
C:\Program Files\Adobe Acrobat\Adobe Acrobat Professional 8.10\Keygen.exe Infected: Trojan-Dropper.Win32.VB.bix 1
It seems you don't have a legal license for Adobe Acrobat 8.1.2 Professional and that's why I'm asking you to uninstall it thru add/remove programs now.
Then delete items in C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine folder.
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\Program Files\Adobe Acrobat\Adobe Acrobat Professional 8.10\Keygen.exe
Folder::
C:\Documents and Settings\ALEX\Application Data\Azureus
C:\Documents and Settings\ALEX\Application Data\LimeWire
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log & a fresh hjt log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
diavoliza
2008-08-15, 01:12
ComboFix 08-08-14.01 - ALEX 2008-08-14 18:39:12.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.633 [GMT -4:00]
Running from: C:\Documents and Settings\ALEX\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ALEX\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\Program Files\Adobe Acrobat\Adobe Acrobat Professional 8.10\Keygen.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\ALEX\Application Data\Azureus
C:\Documents and Settings\ALEX\Application Data\Azureus\.keystore
C:\Documents and Settings\ALEX\Application Data\Azureus\active\344D2E8F29D88692F90ACE164C240C81D88D2D14.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\active\344D2E8F29D88692F90ACE164C240C81D88D2D14.dat.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\active\cache.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\azureus.config
C:\Documents and Settings\ALEX\Application Data\Azureus\azureus.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\azureus.statistics
C:\Documents and Settings\ALEX\Application Data\Azureus\azureus.statistics.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\banips.config
C:\Documents and Settings\ALEX\Application Data\Azureus\banips.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\dht\addresses.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\dht\contacts.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\dht\diverse.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\dht\general.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\dht\version.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\downloads.config
C:\Documents and Settings\ALEX\Application Data\Azureus\downloads.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\friends.config
C:\Documents and Settings\ALEX\Application Data\Azureus\friends.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\ipfilter.cache
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\alerts_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\AutoSpeed_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\AutoSpeed_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\AutoSpeedSearchHistory_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\AutoSpeedSearchHistory_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\debug_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\debug_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\Friends_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\Friends_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\MetaSearch_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\NetStatus_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\seltrace_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\SpeedMan_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\SpeedMan_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\thread_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\thread_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\v3.ads_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\v3.CMsgr_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\v3.Friends_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\v3.Friends_2.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\v3.PMsgr_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\logs\v3.Stream_1.log
C:\Documents and Settings\ALEX\Application Data\Azureus\metasearch.config
C:\Documents and Settings\ALEX\Application Data\Azureus\metasearch.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\net\pm_6128.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\net\pm_default.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\tables.config
C:\Documents and Settings\ALEX\Application Data\Azureus\tables.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\timingstats.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30222.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30223.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30224.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30225.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30226.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30227.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30228.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30229.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\tmp\AZU30231.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] 3984aa4ebad8f3c0f6ccdae37b6e15b0f6f9b4fb.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] b127403b5720b3b5e0cf011e0b87118a51831662.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] The Wire - season 3 complete.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] The Wire - Season 4.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] The_Wire_-_Season_5.4160206.TPB.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] Untraceable[2008]R5.DvDrip[Eng]-aXXo.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\[isoHunt] Vantage.Point.2008.Eng.R5.DivX-LTT.4102704.TPB.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\_[isoHunt] The Wire - season 3 complete.torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\_Top Gear - [11x04] - 2008.07.13 [RiVER].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\_Top Gear - [11x05] - 2008.07.20 [RiVER].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Adobe Acrobat Professional 8.10.rar [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU24407.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU30891.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU42867.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU42870.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU57763.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU62491.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\AZU62495.tmp
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Camron-Killa_Season-2006-C4 [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Cloverfield DVDRip XviD[www.yestorrent.com] [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Kill_Point_Entire_Season_1 [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Lil Wayne - Tha Carter II [2005] [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Lil wayne the carter III NEW [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\One[1].Missed.Call.DVDRip.XviD-DiAMOND [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Planet_Earth_-_Vol._01_-_05_[mininova][1].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Planet_Earth_-_Vol._06_-_11_[mininova][1].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\RAMBO[2008][ENG][AC3_5.1][DVDRip][RP]-KonzillaRG_[mininova][1].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [02x01] - 2003.05.01.avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [02x02] - 2003.05.18.avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [02x03] - 2003.05.25.avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [11x01] - 2008.06.22 [ANGELiC].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [11x02] - 2008.06.29 [COUNCiL].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [11x03] - 2008.07.06 [ANGELiC].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [11x04] - 2008.07.13 [RiVER].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [11x05] - 2008.07.20 [RiVER].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - [11x06] - 2008.07.27 [RiVER].avi [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top Gear - Season 01 [SBS Rips] [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\top.gear.ground.force.sports.relief.2008.ws.pdtv.xvid-sparel.avi_[mininova][1].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top.Gear.Season.10[DVBRip]XVID.MP3-DsG [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Top.Gear.Season.10[DVBRip]XVID.MP3-DsG_[mininova][1].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Vantage Point [High Quality-R5-XVID]_KaYz 2008 [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\torrents\Vantage.Point.READNFO.PROPER.R5.XVID_iGNiTE [mininova].torrent
C:\Documents and Settings\ALEX\Application Data\Azureus\tracker.config
C:\Documents and Settings\ALEX\Application Data\Azureus\tracker.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\unsentdata.config
C:\Documents and Settings\ALEX\Application Data\Azureus\unsentdata.config.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\update.log
C:\Documents and Settings\ALEX\Application Data\Azureus\update.properties
C:\Documents and Settings\ALEX\Application Data\Azureus\v3.Friends.dat
C:\Documents and Settings\ALEX\Application Data\Azureus\v3.Friends.dat.bak
C:\Documents and Settings\ALEX\Application Data\Azureus\VuzeActivities.config
C:\Documents and Settings\ALEX\Application Data\Azureus\VuzeActivities.config.bak
C:\Documents and Settings\ALEX\Application Data\LimeWire
C:\Documents and Settings\ALEX\Application Data\LimeWire\active.mojito
C:\Documents and Settings\ALEX\Application Data\LimeWire\createtimes.cache
C:\Documents and Settings\ALEX\Application Data\LimeWire\fileurns.bak
C:\Documents and Settings\ALEX\Application Data\LimeWire\fileurns.cache
C:\Documents and Settings\ALEX\Application Data\LimeWire\filters.props
C:\Documents and Settings\ALEX\Application Data\LimeWire\gnutella.net
C:\Documents and Settings\ALEX\Application Data\LimeWire\installation.props
C:\Documents and Settings\ALEX\Application Data\LimeWire\library.dat
C:\Documents and Settings\ALEX\Application Data\LimeWire\limewire.props
C:\Documents and Settings\ALEX\Application Data\LimeWire\mojito.props
C:\Documents and Settings\ALEX\Application Data\LimeWire\questions.props
C:\Documents and Settings\ALEX\Application Data\LimeWire\responses.cache
C:\Documents and Settings\ALEX\Application Data\LimeWire\simpp.xml
C:\Documents and Settings\ALEX\Application Data\LimeWire\spam.dat
C:\Documents and Settings\ALEX\Application Data\LimeWire\tables.props
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme.lwtp
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\01_star.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\02_star.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\03_star.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\04_star.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\05_star.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\chat.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\forward_up.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\kill.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\kill_on.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\logo.png
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\notsearching.png
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\pause_up.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\play_dn.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\play_up.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\question.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\searching.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\stop_up.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\theme.txt
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\version.txt
C:\Documents and Settings\ALEX\Application Data\LimeWire\themes\windows_theme\warning.gif
C:\Documents and Settings\ALEX\Application Data\LimeWire\ttrees.cache
C:\Documents and Settings\ALEX\Application Data\LimeWire\ttroot.cache
C:\Documents and Settings\ALEX\Application Data\LimeWire\version.xml
C:\Program Files\Adobe Acrobat\Adobe Acrobat Professional 8.10\Keygen.exe
.
((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))
.
2008-08-14 18:34 . 2008-08-14 18:35 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-08-14 00:58 . 2008-05-01 10:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-12 17:53 . 2008-08-12 17:53 <DIR> d-------- C:\Deckard
2008-08-11 19:07 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-02 02:41 . 2008-08-02 02:41 48 --a------ C:\WINDOWS\wininit.ini
2008-08-02 02:07 . 2008-08-02 02:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 22:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 22:32 --------- d-----w C:\Program Files\Adobe Acrobat
2008-08-14 14:31 --------- d-----w C:\Program Files\Norton Internet Security
2008-08-13 21:50 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-24 09:09 --------- d-----w C:\Program Files\Java
2008-07-11 23:49 --------- d-----w C:\Program Files\iTunes
2008-07-11 23:48 --------- d-----w C:\Program Files\iPod
2008-07-11 23:45 --------- d-----w C:\Program Files\Bonjour
2008-07-10 13:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-28 11:21 --------- d-----w C:\Program Files\Safari
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-16 07:43 --------- d-----w C:\Program Files\Xvid
2008-06-16 07:37 --------- d-----w C:\Program Files\QuickTime
2008-06-16 07:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-05-11 12:41 92,064 ----a-w C:\Documents and Settings\ALEX\mqdmmdm.sys
2008-05-11 12:41 9,232 ----a-w C:\Documents and Settings\ALEX\mqdmmdfl.sys
2008-05-11 12:41 79,328 ----a-w C:\Documents and Settings\ALEX\mqdmserd.sys
2008-05-11 12:41 66,656 ----a-w C:\Documents and Settings\ALEX\mqdmbus.sys
2008-05-11 12:41 6,208 ----a-w C:\Documents and Settings\ALEX\mqdmcmnt.sys
2008-05-11 12:41 5,936 ----a-w C:\Documents and Settings\ALEX\mqdmwhnt.sys
2008-05-11 12:41 4,048 ----a-w C:\Documents and Settings\ALEX\mqdmcr.sys
2008-05-11 12:41 25,600 ----a-w C:\Documents and Settings\ALEX\usbsermptxp.sys
2008-05-11 12:41 22,768 ----a-w C:\Documents and Settings\ALEX\usbsermpt.sys
.
((((((((((((((((((((((((((((( snapshot_2008-08-13_14.52.24.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-23 04:16:28 124,928 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\advpack.dll
+ 2008-04-23 04:16:28 347,136 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtmsft.dll
+ 2008-04-23 04:16:28 214,528 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\dxtrans.dll
+ 2008-04-23 04:16:28 133,120 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\extmgr.dll
+ 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\icardie.dll
+ 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ie4uinit.exe
+ 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakeng.dll
+ 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieaksie.dll
+ 2008-04-20 05:07:51 161,792 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieakui.dll
+ 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieapfltr.dll
+ 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iedkcs32.dll
+ 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieframe.dll
+ 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iernonce.dll
+ 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iertutil.dll
+ 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\ieudinit.exe
+ 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
+ 2008-04-23 04:16:28 27,648 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\jsproxy.dll
+ 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeeds.dll
+ 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msfeedsbs.dll
+ 2008-04-24 02:16:30 3,591,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtml.dll
+ 2008-04-23 04:16:28 478,208 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mshtmled.dll
+ 2008-04-23 04:16:28 193,024 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\msrating.dll
+ 2008-04-23 04:16:28 671,232 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\mstime.dll
+ 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\occache.dll
+ 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\updspapi.dll
+ 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\url.dll
+ 2008-04-23 04:16:29 1,159,680 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\urlmon.dll
+ 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\webcheck.dll
+ 2008-04-23 04:16:29 826,368 -c----w C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
- 2008-04-23 04:16:28 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2008-06-23 16:57:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2008-04-23 04:16:28 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-06-23 16:57:27 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
- 2008-04-23 04:16:28 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-04-23 04:16:28 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-07-07 20:32:22 253,952 -c----w C:\WINDOWS\system32\dllcache\es.dll
- 2008-04-23 04:16:28 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-06-23 16:57:27 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-04-23 04:16:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-06-23 16:57:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-04-22 07:39:58 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2008-04-23 04:16:28 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-04-23 04:16:28 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-04-20 05:07:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-06-21 05:23:54 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2008-04-23 04:16:28 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-04-23 04:16:28 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-04-23 04:16:28 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
- 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-06-23 16:57:33 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-04-23 04:16:28 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-06-23 16:57:34 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
- 2008-04-22 07:40:18 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-06-23 09:20:52 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-08-21 06:15:44 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 -c----w C:\WINDOWS\system32\dllcache\inetcomm.dll
- 2008-04-23 04:16:28 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-06-24 16:23:05 74,240 -c----w C:\WINDOWS\system32\dllcache\mscms.dll
- 2008-04-23 04:16:28 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-04-23 04:16:28 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-04-24 02:16:30 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-06-24 14:57:40 3,592,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-04-23 04:16:28 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-04-23 04:16:28 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-06-23 16:57:39 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-04-23 04:16:28 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-06-23 16:57:40 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-04-23 04:16:28 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-06-23 16:57:40 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2008-04-23 04:16:28 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2008-04-23 04:16:28 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
+ 2008-06-23 16:57:40 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2008-04-23 04:16:29 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-04-23 04:16:29 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-06-23 16:57:41 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-04-23 04:16:29 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-06-23 16:57:41 826,368 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-04-23 04:16:28 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-04-23 04:16:28 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-04-23 04:16:28 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2008-05-17 05:09:34 119,744 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-14 22:35:41 118,152 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-04-23 04:16:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2008-04-22 07:39:58 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe
- 2008-04-23 04:16:28 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 ------w C:\WINDOWS\system32\ieakeng.dll
- 2008-04-23 04:16:28 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 ------w C:\WINDOWS\system32\ieaksie.dll
- 2008-04-20 05:07:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll
+ 2008-06-21 05:23:54 161,792 ------w C:\WINDOWS\system32\ieakui.dll
- 2008-04-23 04:16:28 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2008-04-23 04:16:28 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
- 2008-04-23 04:16:28 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2008-04-23 04:16:28 44,544 ------w C:\WINDOWS\system32\iernonce.dll
+ 2008-06-23 16:57:33 44,544 ------w C:\WINDOWS\system32\iernonce.dll
- 2008-04-23 04:16:28 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-08-21 06:15:44 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
- 2008-04-23 04:16:28 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 ------w C:\WINDOWS\system32\jsproxy.dll
- 2008-04-23 04:16:28 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2008-04-23 04:16:28 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
- 2008-04-24 02:16:30 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 14:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-04-23 04:16:28 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-04-23 04:16:28 193,024 ------w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 16:57:39 193,024 ------w C:\WINDOWS\system32\msrating.dll
- 2008-04-23 04:16:28 671,232 ------w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 16:57:40 671,232 ------w C:\WINDOWS\system32\mstime.dll
- 2008-04-23 04:16:28 102,912 ------w C:\WINDOWS\system32\occache.dll
+ 2008-06-23 16:57:40 102,912 ------w C:\WINDOWS\system32\occache.dll
- 2008-08-12 18:12:55 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-14 22:40:07 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-12 18:12:55 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-14 22:40:07 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-04-23 04:16:28 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2007-11-13 11:31:11 60,416 ----a-w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-14 11:09:18 62,976 ----a-w C:\WINDOWS\system32\tzchange.exe
- 2008-04-23 04:16:28 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2008-04-23 04:16:29 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-04-23 04:16:29 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-02-09 22:05 344064]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 11:42 58728]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-02-11 20:31 100056]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 13:17 694008]
"DT GWY"="C:\Program Files\Gateway\EzTune\DTHtml.exe" [2007-05-02 18:01 282624]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-11 17:02 185632]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 18:20 339968 C:\WINDOWS\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 17:38 39264]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
R1 Pivot;Pivot;C:\WINDOWS\system32\drivers\pivot.sys [2007-02-09 13:17]
R3 pivotmou;Pivot Mouse/Pointers Filter Driver;C:\WINDOWS\system32\drivers\pivotmou.sys [2007-02-09 13:17]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15520440-d906-11dc-90ad-00123f72bbe8}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
2008-08-09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2008-08-14 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20]
2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - ALEX.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-19 12:54]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-14 18:43:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Portrait Displays\Pivot Software\Floater.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cscript.exe
.
**************************************************************************
.
Completion time: 2008-08-14 18:47:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-14 22:47:26
ComboFix2.txt 2008-08-13 18:53:05
ComboFix3.txt 2008-08-11 23:09:27
Pre-Run: 33,790,951,424 bytes free
Post-Run: 33,819,693,056 bytes free
465 --- E O F --- 2008-08-14 18:02:56
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:04:27 PM, on 8/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Gateway\EzTune\DTHtml.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\ALEX\Desktop\ALEX.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 8042 bytes
Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.
If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.
Make your Internet Explorer more secure
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
Download Adaware
Adaware is a free program. It scans for known spyware on your computer. These scans should be run at least once every two weeks. For more information, see this tutorial (http://www.bleepingcomputer.com/forums/index.php?showtutorial=48)
The program is available for download here (http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10319876.html?tag=lst-0-1)
Download Spybot
Spybot is a scanner like adaware. It scans for spyware and other malicious programs. It is important to have both Adaware and Spybot on your computer because each program provides unique detection and pretection measures. Spybot has preventitive tools that stop programs from even installing on your computer.
To see how to set this up as well as more spybot features, see here (http://www.bleepingcomputer.com/forums/index.php?showtutorial=43)
Spybot can be downloaded at this location (http://www.download.com/Spybot-Search-Destroy/3000-8022-10122137.html?part=dl-spybot&subj=dl&tag=but)
Download SpywareBlaster
Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
kill bits
in the registry, so that certain activex controls can't install.
If you don't know what activex controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
You can download SpywareBlaster here here (http://majorgeeks.com/downloadget.php?id=2859&file=11&evp=61b0e8ad41924a03c37615f4682b4cef)
SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/tutorial49.html)
hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Run the spybot and adaware regularly. (Once or twice a week minimum.)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system... problems etc.
Have a great day,
Blade :cool:
diavoliza
2008-08-15, 07:23
Hello, Blade! Thank you so much for all your help and time! I will follow your instructions tomorrow. Tonight is very late - got to go now. Computer feels like new! Don't have any complaints :) Will definitely do cleaning to get rid of everything and let you know how it will go.Thank you again!
Ok. I'll leave the topic open for a couple of days. Let me know when you've taken the steps :)
diavoliza
2008-08-18, 02:22
Hello, Blade! I cleaned the system restore - got rid of the old infected restore points - thought I am not sue how to check if I really got rid of them - but nevertheless - I am pretty happy with my computer right now. I don't use IE - don't like it. I use Firefox. I get the Windows updates run anytime it has to. Hope everything will be OK from now on.
Thank you again for the great job you do! Wish you all the best!!!
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)
Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.