View Full Version : wont connect to internet
Miniman_alis
2008-11-16, 10:58
hi i got a virus an it messed up my internet connection Mcaffee found a few and got rid of them but its still not working
here is my hjt log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:50:58, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZKfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Ali\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1147077948343
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Network Location Awareness (NLA) (Nla) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 9394 bytes
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hello and welcome to the forums
My name is Katana and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)
If you can do those few things, everything should go smoothly http://www.countingcows.de/laechel.gif
Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------
Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If you accidently close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Download and Run RSIT
Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
log.txt will be opened maximized.
info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
Miniman_alis
2008-11-18, 13:55
here is the mbam log
Malwarebytes' Anti-Malware 1.28
Database version: 1157
Windows 5.1.2600 Service Pack 3
18/11/2008 9:51:12 PM
mbam-log-2008-11-18 (21-51-03).txt
Scan type: Full Scan (C:\|)
Objects scanned: 158273
Time elapsed: 42 minute(s), 13 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{3F994ECE-23F4-49B3-A7D6-8F685209CC8C}\RP763\A0171887.dll (Adware.MyWebSearch) -> No action taken.
<<<i did delete this infection by the way>>>
log file
Logfile of random's system information tool 1.04 (written by random/random)
Run by Ali at 2008-11-18 21:03:06
Microsoft Windows XP Professional Service Pack 3
System drive C: has 36 GB (47%) free of 76 GB
Total RAM: 511 MB (28% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:03:38, on 18/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
H:\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Ali.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZKfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Ali\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1147077948343
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Network Location Awareness (NLA) (Nla) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 9421 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\McQcTask.job
C:\WINDOWS\tasks\McDefragTask.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}]
C:\Program Files\SiteAdvisor\SiteAdv.dll [2006-07-25 960664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-06-29 308856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll [2007-11-09 58688]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0BF43445-2F28-4351-9252-17FE6E806AA0} - McAfee SiteAdvisor - C:\Program Files\SiteAdvisor\SiteAdv.dll [2006-07-25 960664]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"Smapp"=C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2002-11-08 98304]
"Synchronization Manager"=C:\WINDOWS\system32\mobsync.exe [2008-04-14 143360]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-06-01 339968]
"SpybotSnD"=C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-30 4891984]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2007-11-01 582992]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2008-11-05 4347120]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Plugin]
rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe [2005-02-26 212992]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-06-29 185896]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [2000-01-21 65588]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
WRLogonNTF.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\WINDOWS\System32\dpvsetup.exe"="C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"S:\Steam\SteamApps\alis666\condition zero deleted scenes\hl.exe"="S:\Steam\SteamApps\alis666\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher"
"S:\Steam\SteamApps\alis666\condition zero\hl.exe"="S:\Steam\SteamApps\alis666\condition zero\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\tinyproxy\tinyproxy.exe"="C:\Program Files\tinyproxy\tinyproxy.exe:*:Enabled:tinyproxy"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe"="C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe:*:Enabled:McAfee Managed Services Agent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
======List of files/folders created in the last 2 months======
2008-11-18 21:03:06 ----D---- C:\rsit
2008-11-13 18:24:39 ----D---- C:\WINDOWS\system32\367770
2008-11-13 18:24:32 ----D---- C:\Program Files\tinyproxy
2008-11-13 18:24:18 ----H---- C:\WINDOWS\che4.exe
2008-11-12 22:24:45 ----HD---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-12 22:24:38 ----HD---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-12 22:24:28 ----HD---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-10 20:53:44 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\PopCap
2008-10-24 18:11:39 ----HD---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-16 07:30:57 ----HD---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-16 07:30:50 ----HD---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 07:30:45 ----HD---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-16 07:30:11 ----HD---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-16 07:30:01 ----HD---- C:\WINDOWS\$NtUninstallKB956841$
2008-10-14 19:09:01 ----D---- C:\WINDOWS\system32\Adobe
2008-10-08 21:44:56 ----SHD---- C:\FOUND.000
2008-09-30 16:43:34 ----A---- C:\WINDOWS\system32\msxml4.dll
2008-09-26 08:00:49 ----HD---- C:\WINDOWS\$NtUninstallKB951978$
2008-09-25 06:35:35 ----D---- C:\WINDOWS\Prefetch
2008-09-24 23:57:35 ----HD---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-24 23:57:19 ----HD---- C:\WINDOWS\$NtUninstallKB951618-v2$
2008-09-24 23:57:03 ----HD---- C:\WINDOWS\$NtUninstallKB915800-v4$
2008-09-24 23:56:50 ----HD---- C:\WINDOWS\$NtUninstallKB946648$
2008-09-24 23:56:35 ----HD---- C:\WINDOWS\$NtUninstallKB952287$
2008-09-24 23:56:21 ----HD---- C:\WINDOWS\$NtUninstallKB951066$
2008-09-24 23:56:09 ----HD---- C:\WINDOWS\$NtUninstallKB952954$
2008-09-24 23:55:57 ----HD---- C:\WINDOWS\$NtUninstallKB950974$
2008-09-24 23:55:37 ----HD---- C:\WINDOWS\$NtUninstallKB951748$
2008-09-24 23:55:14 ----HD---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-24 23:54:51 ----HD---- C:\WINDOWS\$NtUninstallKB950762$
2008-09-24 23:54:26 ----HD---- C:\WINDOWS\$NtUninstallKB951376$
2008-09-24 23:53:59 ----HD---- C:\WINDOWS\$NtUninstallKB951698$
2008-09-24 23:44:32 ----D---- C:\WINDOWS\system32\scripting
2008-09-24 23:44:31 ----D---- C:\WINDOWS\l2schemas
2008-09-24 23:44:30 ----D---- C:\WINDOWS\system32\en
2008-09-24 23:44:29 ----D---- C:\WINDOWS\system32\bits
2008-09-24 23:41:23 ----D---- C:\WINDOWS\ServicePackFiles
2008-09-24 23:35:24 ----A---- C:\WINDOWS\imsins.BAK
2008-09-24 23:25:53 ----HD---- C:\WINDOWS\$NtServicePackUninstall$
2008-09-22 18:31:51 ----D---- C:\Program Files\Common Files\Apple
2008-09-22 18:31:47 ----D---- C:\Program Files\QuickTime
2008-09-22 18:29:08 ----D---- C:\Program Files\Apple Software Update
2008-09-22 18:29:06 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-09-22 18:27:15 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-09-22 18:27:03 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-09-22 18:26:59 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-09-22 18:26:53 ----N---- C:\WINDOWS\system32\azroles.dll
2008-09-22 18:26:47 ----N---- C:\WINDOWS\system32\napstat.exe
2008-09-22 18:26:46 ----N---- C:\WINDOWS\system32\mssha.dll
2008-09-22 18:26:46 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-09-22 18:26:46 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-09-22 18:26:46 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-09-22 18:26:43 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-09-22 18:26:42 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-09-22 18:26:41 ----N---- C:\WINDOWS\system32\qagent.dll
2008-09-22 18:26:39 ----N---- C:\WINDOWS\system32\onex.dll
2008-09-22 18:26:39 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-09-22 18:26:34 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-09-22 18:26:33 ----N---- C:\WINDOWS\system32\qutil.dll
2008-09-22 18:26:33 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-09-22 18:26:32 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-09-22 18:26:31 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-09-22 18:26:31 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-09-22 18:26:30 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-09-22 18:26:30 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-09-22 18:26:30 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-09-22 18:26:29 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-09-22 18:26:28 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-09-22 18:26:27 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-09-22 18:26:26 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-09-22 18:26:26 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-09-22 18:26:26 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-09-22 18:26:25 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-09-22 18:26:24 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-09-22 18:26:24 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-09-22 18:26:23 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-09-22 18:26:23 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-09-22 18:26:22 ----N---- C:\WINDOWS\system32\faxpatch.exe
2008-09-22 18:26:22 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-09-22 18:26:21 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-09-22 18:26:20 ----N---- C:\WINDOWS\system32\setupn.exe
2008-09-22 18:26:20 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-09-22 18:26:17 ----N---- C:\WINDOWS\system32\credssp.dll
2008-09-22 18:26:14 ----N---- C:\WINDOWS\system32\spupdwxp.exe
2008-09-22 18:26:14 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-09-22 18:26:13 ----A---- C:\WINDOWS\system32\spdwnwxp.exe
2008-09-22 18:26:09 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-09-22 18:26:09 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-09-22 18:26:09 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-09-22 18:26:09 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-09-22 18:26:09 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-09-22 18:26:02 ----N---- C:\WINDOWS\system32\slextspk.dll
2008-09-22 18:26:00 ----N---- C:\WINDOWS\system32\nv4_disp.dll
2008-09-22 18:25:46 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2008-09-22 18:25:45 ----N---- C:\WINDOWS\system32\slgen.dll
2008-09-22 18:25:42 ----N---- C:\WINDOWS\system32\slserv.exe
2008-09-22 18:25:41 ----N---- C:\WINDOWS\system32\slrundll.exe
2008-09-22 18:25:41 ----N---- C:\WINDOWS\system32\slcoinst.dll
2008-09-22 18:25:41 ----N---- C:\WINDOWS\system32\s3gnb.dll
2008-09-22 18:25:41 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2008-09-22 18:25:41 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2008-09-22 18:25:41 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2008-09-22 18:25:41 ----N---- C:\WINDOWS\slrundll.exe
2008-09-22 18:25:40 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2008-09-22 18:25:32 ----A---- C:\WINDOWS\003399_.tmp
2008-09-22 18:25:19 ----N---- C:\WINDOWS\system32\comsdupd.exe
2008-09-22 18:25:17 ----N---- C:\WINDOWS\system32\smtpapi.dll
2008-09-22 18:25:17 ----N---- C:\WINDOWS\system32\rwnh.dll
2008-09-20 12:38:05 ----D---- C:\Program Files\NCH Swift Sound
2008-09-20 12:12:05 ----D---- C:\Program Files\Conduit
2008-09-20 08:29:31 ----D---- C:\Program Files\SpywareGuard
======List of files/folders modified in the last 2 months======
2008-11-18 07:10:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-04 10:10:26 ----A---- C:\WINDOWS\system32\MRT.exe
2008-11-02 10:15:44 ----A---- C:\WINDOWS\Wininit.ini
2008-10-24 18:51:28 ----SH---- C:\boot.ini
2008-10-24 18:51:28 ----A---- C:\WINDOWS\win.ini
2008-10-24 18:51:28 ----A---- C:\WINDOWS\system.ini
2008-10-16 02:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-04 03:41:16 ----A---- C:\WINDOWS\system32\ieframe.dll
2008-09-25 06:38:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-09-24 23:57:44 ----A---- C:\WINDOWS\iis6.BAK
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2007-11-22 201320]
R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2007-07-13 113952]
R2 nxsIO32;NextSensor Kernel I/O Driver; \??\C:\WINDOWS\System32\DRIVERS\nxsIO32.sys []
R2 pciinfo;pciinfo; C:\WINDOWS\System32\drivers\PCIINFO.SYS [2000-03-15 2752]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-12-01 873984]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2003-03-04 145408]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2007-11-22 79304]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2007-11-22 35240]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2007-12-02 40488]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-12-19 539008]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S1 wpsdrvnt;wpsdrvnt; \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys []
S2 wg3n;SyGate for NT, wg3n; C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\Ali\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\DRIVERS\LVUSBSta.sys [2005-12-06 39424]
S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2007-11-22 33832]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 PID_08A0;QuickCam IM(PID_08A0); C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [2005-12-06 916096]
S3 QCDonner;Logitech QuickCam Express; C:\WINDOWS\system32\DRIVERS\OVCD.sys [2001-08-17 28032]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-12-01 425984]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
R2 McNASvc;McAfee Network Agent; c:\program files\common files\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864]
R2 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-12-05 695624]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-06-01 516096]
S2 IPSEC Services (PolicyAgent) ;IPSEC Services (PolicyAgent) ; C:\Program Files\tinyproxy\tinyproxy.exe [2008-11-14 8448]
S2 Network Location Awareness (NLA) (Nla) ;Network Location Awareness (NLA) (Nla) ; C:\Program Files\tinyproxy\tinyproxy.exe [2008-11-14 8448]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
-----------------EOF-----------------
info file
info.txt logfile of random's system information tool 1.04 2008-11-18 21:03:43
======Uninstall list======
-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Control Panel-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HydraVision-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}\setup.exe"
AVS DVD Player version 2.4-->"C:\Program Files\AVS4YOU\AVSDVDPlayer\unins000.exe"
Condition Zero Deleted Scenes-->"S:\Steam\steam.exe" steam://uninstall/100
Condition Zero-->"S:\Steam\steam.exe" steam://uninstall/80
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
Express Burn-->C:\Program Files\NCH Swift Sound\ExpressBurn\uninst.exe
FL Studio 6-->S:\Ali\fruity loops\uninstall.exe
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
GTK+ 2.8.18-1 runtime environment-->"C:\Program Files\Common Files\GTK\2.0\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Initial D Mountain Vengeance-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B773B178-2C91-4E90-A082-F2875AAEAF48}\setup.exe"
Intel(R) Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
J2SE Runtime Environment 5.0 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150010}
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
J2SE Runtime Environment 5.0 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150070}
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java DB 10.3.1.4-->MsiExec.exe /X{CD49361E-3FE6-457E-90A1-9C59E29B5D02}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Development Kit 6 Update 7-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160070}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
LiveUpdate 1.7 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft .NET Framework 3.0-->MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003}
Microsoft Base Smart Card Cryptographic Service Provider Package-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 SR-1 Professional-->MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Windows XP Video Decoder Checkup Utility-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\DECCHECK.inf,Uninstall
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Security Update for Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe"
Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Steam-->S:\Steam\UNWISE.EXE S:\Steam\INSTALL.LOG
Update for Windows XP (KB943729)-->"C:\WINDOWS\$NtUninstallKB943729$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951618-v2)-->"C:\WINDOWS\$NtUninstallKB951618-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Live Writer-->MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall
Yahoo!7 Messenger-->C:\PROGRA~1\YAHOO!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\YAHOO!\MESSEN~1\INSTALL.LOG
=====HijackThis Backups=====
O2 - BHO: (no name) - {0DB97D98-6B63-4618-B494-EE392A393958} - (no file)
O2 - BHO: (no name) - {18A06A97-6727-4E9F-8539-1DFFB68BAD64} - (no file)
O2 - BHO: (no name) - {1c8d7b1e-6bc3-4893-b84b-180cde813e7f} - (no file)
O2 - BHO: (no name) - {294C2417-1FE1-4ACC-9EFA-D702C50ECE70} - (no file)
O2 - BHO: (no name) - {37B48017-FCFD-4F3E-9CB2-1C8190CEF58C} - (no file)
O2 - BHO: (no name) - {3916CD7B-3414-47F7-B217-D2B1E1882750} - (no file)
O2 - BHO: (no name) - {40C387A8-7792-4CB5-8E78-EC641A10237F} - (no file)
O2 - BHO: (no name) - {44FBB655-BC59-4303-B61B-E6A2B859A145} - (no file)
O2 - BHO: (no name) - {53024510-6992-4F1D-893C-EFD15C3E8F0A} - (no file)
O2 - BHO: (no name) - {5F138E77-4F6A-479D-8FAE-37B3B666ED45} - (no file)
O2 - BHO: (no name) - {67E52A1E-81A6-4BA5-B998-985CCB51A9F3} - (no file)
O2 - BHO: (no name) - {7296E57C-4687-41E0-8332-F89A68802C24} - (no file)
O2 - BHO: (no name) - {A87FBEFA-3AF4-4AAC-B4C9-EDB7348283F5} - (no file)
O2 - BHO: (no name) - {AF2ADE5B-A381-4C27-9063-EA8D5CEA4930} - (no file)
O2 - BHO: (no name) - {B3E78CE2-7A92-4BEE-86EC-8F05E915AC7D} - (no file)
O2 - BHO: (no name) - {B47176EC-2E30-4EB7-AC44-6F91965ADEF9} - (no file)
O2 - BHO: (no name) - {BF54529D-2977-4ACA-BC9A-E50D9E641B32} - (no file)
O2 - BHO: (no name) - {D762E9C4-4CE2-4444-8FD8-11E29DF2EC64} - (no file)
O2 - BHO: (no name) - {D8DDAD18-A44B-483D-91A8-ECFA810BD56C} - (no file)
O2 - BHO: (no name) - {D91E166C-FB17-44DF-8B67-042A1899E3B0} - (no file)
O2 - BHO: (no name) - {DBC45470-59D1-4F7D-8D2A-12B6E1C3459B} - (no file)
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O2 - BHO: (no name) - {944D2310-5301-4E16-B50A-CC288F1C7379} - (no file)
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} -
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Security center information======
AV: McAfee VirusScan
FW: McAfee Personal Firewall
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\GTK\2.0\bin;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0207
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"LANG"=C
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
-----------------EOF-----------------
Download ComboFix from one of these locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See HERE (http://www.bleepingcomputer.com/forums/topic114351.html) for help
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Miniman_alis
2008-11-22, 00:10
i cant connect to the internet on the infected computer
ComboFix 08-11-19.08 - Ali 2008-11-22 6:56:16.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.194 [GMT 10:00]
Running from: H:\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\TinyProxy
c:\program files\TinyProxy\tinyproxy.exe
c:\windows\fmark2.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
((((((((((((((((((((((((( Files Created from 2008-10-21 to 2008-11-21 )))))))))))))))))))))))))))))))
.
2008-11-18 21:03 . 2008-11-18 21:03 <DIR> d-------- C:\rsit
2008-11-13 18:24 . 2008-11-13 18:24 <DIR> d-------- c:\windows\system32\367770
2008-11-13 18:24 . 2008-11-13 18:24 24,064 ---h----- c:\windows\che4.exe
2008-11-13 18:24 . 2008-11-14 05:23 1 ---h----- c:\windows\f49f4daa.dat
2008-11-13 18:24 . 2008-11-13 18:24 1 ---h----- c:\windows\bemark2.dat
2008-11-12 21:18 . 2008-10-24 21:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 21:17 . 2008-09-05 03:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-10 20:53 . 2008-11-10 20:53 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\PopCap
2008-10-24 16:40 . 2008-10-16 02:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 06:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-22 08:31 --------- d-----w c:\program files\QuickTime
2008-09-22 08:31 --------- d-----w c:\program files\Common Files\Apple
2008-09-22 08:29 --------- d-----w c:\program files\Apple Software Update
2008-09-22 08:29 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys
2008-09-05 13:30 241,704 ------w c:\windows\system32\dllcache\wgaLogon.dll
2008-09-05 13:29 917,032 ------w c:\windows\system32\dllcache\WgaTray.exe
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-09-03 21:43 3,336 ------w c:\windows\system32\tmp.reg
2008-08-27 08:24 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-01 339968]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2008-07-30 4891984]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--------- 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
--------- 2005-02-26 10:28 212992 c:\progra~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-06-29 08:22 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"s:\\Steam\\SteamApps\\alis666\\condition zero deleted scenes\\hl.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R2 nxsIO32;NextSensor Kernel I/O Driver;\??\c:\windows\System32\DRIVERS\nxsIO32.sys [2007-02-05 2208]
R2 pciinfo;pciinfo;c:\windows\system32\drivers\PCIINFO.SYS [2007-02-05 2752]
S0 yotxbc;yotxbc;c:\windows\system32\drivers\yomtqc.sys []
S2 IPSEC Services (PolicyAgent) ;IPSEC Services (PolicyAgent) ;c:\program files\tinyproxy\tinyproxy.exe []
S2 Network Location Awareness (NLA) (Nla) ;Network Location Awareness (NLA) (Nla) ;c:\program files\tinyproxy\tinyproxy.exe []
.
Contents of the 'Scheduled Tasks' folder
2008-09-30 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2008-11-14 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2008-04-14 10:12]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Ali\Application Data\Mozilla\Firefox\Profiles\mvqeby3j.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-22 07:42:37
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\program files\MCAFEE\MSC\MCMSCSVC.EXE
c:\program files\COMMON FILES\MCAFEE\MNA\MCNASVC.EXE
c:\program files\COMMON FILES\MCAFEE\MCPROXY\MCPROXY.EXE
c:\program files\MCAFEE\VIRUSSCAN\MCSHIELD.EXE
c:\program files\MCAFEE\MPF\MPFSRV.EXE
c:\windows\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE
c:\program files\ANALOG DEVICES\SOUNDMAX\SMAGENT.EXE
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\progra~1\mcafee\msc\mcuimgr.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-11-22 7:46:37 - machine was rebooted
ComboFix2.txt 2008-09-04 11:48:02
ComboFix-quarantined-files.txt 2008-11-21 21:46:22
Pre-Run: 36,875,468,800 bytes free
Post-Run: 36,737,384,448 bytes free
164 --- E O F --- 2008-11-12 12:26:23
Are you still unable to access the internet ?
Miniman_alis
2008-11-22, 02:25
yes that is correct it has a little icon in the tray the says it has limited to no connection and i tried to repair it but that didnt work.
should i be able to?
Download WinsockFix (http://downloads.subratam.org/WinsockFix.zip). By Option^Explicit.
Transfer it to the infected machine
UnZip WinsockFix.zip (Pay close attention to where the file is extracted to.)
run WinsockFix.exe. Click the Fix button.
Miniman_alis
2008-11-25, 23:29
i dont think that worked? it says the same thing.
Custom CFScript
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
File::
c:\windows\che4.exe
c:\windows\f49f4daa.dat
c:\windows\bemark2.dat
c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
Folder::
c:\windows\system32\367770
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap
Driver::
yotxbc
"IPSEC Services (PolicyAgent) "
"Network Location Awareness (NLA) (Nla) "
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]68]
"SunJavaUpdateSched"=-
Save this as CFScript.txt and place it on your desktop.
http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
Miniman_alis
2008-11-29, 09:31
ComboFix 08-11-19.08 - Ali 2008-11-29 17:21:00.4 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.103 [GMT 10:00]
Running from: H:\ComboFix.exe
Command switches used :: H:\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
FILE ::
c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
c:\windows\bemark2.dat
c:\windows\che4.exe
c:\windows\f49f4daa.dat
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\_version.bin
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\aliens80.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\aquarium.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\aquarium2.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\aquarium2sm.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\aquariumsm.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\bear80.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\blank.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\choosepets.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\choosetank.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\fblogo.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\fish4032.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\helpbtnd.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\helpbtnu.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\helprestart.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\introcontinue.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\introoutline.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\introstart.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\levelcomplete.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\logo.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\menu.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\menubtnd.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\menubtnu.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\misc20.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\misc28.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\misc36.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\missle20.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\nextlevelbtn.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\pausebtnd.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\pausebtnu.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\petbtnd.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\petbtnu.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\pets3240.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\pets4032.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\shot20.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\soundbtnd.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\soundbtnu.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\threefs.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\_ArialBlack10.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\_ContinuumBold12outline.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\_ContinuumBold14.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\_ContinuumBold14outback.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\ArialBlack10.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\ArialBlack10.txt
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\ContinuumBold12outline.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\ContinuumBold12outline.txt
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\ContinuumBold14.txt
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\ContinuumBold14outback.txt
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\fatbutton.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\fatbutton_.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen1.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen2.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen3.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen4.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen5.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen6.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen7.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\Screen8.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\star.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\star_.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\upsell\upsellscreen.jpg
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\images\warp1180.gif
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\Insaniquarium.dll
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\resources.xml
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\awooga.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\bubbles.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\buttonclick.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\buy.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\buzzer.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_awooga.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_bubbles.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_buttonclick.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_buy.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_buzzer.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_chomp.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_diamond.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_die.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_dropfood.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_explode.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_fart.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_grow.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_guffaw.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_hatch.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_levelup.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_missle.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_points.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_ricochet.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_roar.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_silence.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_sing.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_slurp.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_tapglass.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_zap.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\cached_zzam.wav
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\chomp.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\diamond.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\die.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\dropfood.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\explode.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\fart.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\grow.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\guffaw.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\hatch.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\levelup.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\missle.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\points.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\ricochet.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\roar.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\silence.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\sing.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\slurp.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\tapglass.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\zap.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\sounds\zzam.au
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\insaniquarium\upsell_dlver.txt
c:\documents and settings\All Users.WINDOWS\Application Data\PopCap\PopCapLoader\YahooGames\savedgames\insaniquarium\savegame.dat
c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
c:\windows\bemark2.dat
c:\windows\che4.exe
c:\windows\f49f4daa.dat
c:\windows\system32\367770
.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-29 )))))))))))))))))))))))))))))))
.
2008-11-18 21:03 . 2008-11-18 21:03 <DIR> d-------- C:\rsit
2008-11-12 21:18 . 2008-10-24 21:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 21:17 . 2008-09-05 03:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 06:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys
2008-09-05 13:30 241,704 ------w c:\windows\system32\dllcache\wgaLogon.dll
2008-09-05 13:29 917,032 ------w c:\windows\system32\dllcache\WgaTray.exe
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-09-03 21:43 3,336 ------w c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((((((( snapshot@2008-11-22_ 7.45.21.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-21 17:28:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-11-29 07:20:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-11-21 17:28:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-11-29 07:20:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-11-21 17:28:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-29 07:20:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-29 07:17:00 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_b34.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-05 4347120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-01 339968]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2008-07-30 4891984]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--------- 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
--------- 2005-02-26 10:28 212992 c:\progra~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--------- 2008-06-29 08:22 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"s:\\Steam\\SteamApps\\alis666\\condition zero deleted scenes\\hl.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R2 nxsIO32;NextSensor Kernel I/O Driver;\??\c:\windows\System32\DRIVERS\nxsIO32.sys [2007-02-05 2208]
R2 pciinfo;pciinfo;c:\windows\system32\drivers\PCIINFO.SYS [2007-02-05 2752]
S0 yotxbc;yotxbc;c:\windows\system32\drivers\yomtqc.sys []
S2 IPSEC Services (PolicyAgent) ;IPSEC Services (PolicyAgent) ;c:\program files\tinyproxy\tinyproxy.exe []
S2 Network Location Awareness (NLA) (Nla) ;Network Location Awareness (NLA) (Nla) ;c:\program files\tinyproxy\tinyproxy.exe []
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
2008-09-30 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2008-11-14 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2008-04-14 10:12]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-29 17:22:08
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-29 17:23:58
ComboFix3.txt 2008-09-04 11:48:02
ComboFix-quarantined-files.txt 2008-11-29 07:23:56
ComboFix2.txt 2008-11-21 21:46:44
Pre-Run: 36,272,373,760 bytes free
Post-Run: 36,293,378,048 bytes free
259 --- E O F --- 2008-11-12 12:26:23
Fix With HJT
Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O8 - Extra context menu item: &Search - ?p=ZKfox000
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Ali\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
O23 - Service: Network Location Awareness (NLA) (Nla) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis
Reboot your machine
Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
**Note**
To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
Due to inactivity, this thread will now be closed.
Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.