View Full Version : Infected with virtumonde.sdn?
Hello.
I'm a new user to the forums here. It appears my PC may be infected with the virtumonde virus, and possibly others. My Norton antivirus suddenly required activation and the Symantec system showed i had exceeded the allowed number of installations, which they said was an indication of a virus attack.
Due to some ill-advised surfing by my teenage son this summer, my PC was infected with a virus based on a scam that said something like "your computer is infected with a virus. Click here to fix." My son clicked on it and a virus attack ensued. I can't remember the name of the virus. After that time, my Norton antivirus required manual enabling of the auto-protect feature, and I've had spotty luck in getting Sbybot S&D to run. However, my PC has worked normally until this week.
I ran Spybot several times this week and each time, the application would freeze before it could fix any problems. Tonight, I ran Spybot again and it did complete a scan of my PC before freezing. I noticed that the last file it scanned was virtumonde.sdn. I did some research and discovered this is a known virus.
I have not taken any other action aside from what is described below.
I'm doing my best to follow the instructions in "read this before you post". Please let me know if I got it wrong, or need to take some other action. I'd be very grateful for any help you all can provide.
Here is the log from HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:08:06 PM, on 11/13/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - E:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDLauncher] "E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] E:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MSConfig] E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://E:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - E:\WINDOWS\system32\basfipm.exe
O23 - Service: Bonjour Service - Apple Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ElevatorService - Unknown owner - E:\Program Files\RipTiger\ElevatorService.exe
O23 - Service: Fling File Transfer (FlingService) - NCH Software - E:\Program Files\NCH Software\Fling\fling.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - E:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - E:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: spkrmon - Unknown owner - E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: STSService - Unknown owner - E:\Program Files\SoundTaxi Media Suite\STSService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 7508 bytes
I have backed up my registry using ERUNT. I also have log.txt and info.txt files if needed.
Please let me know what other information you need.
Thanks in advance for your help.
Max
Dakeyras
2009-11-18, 13:46
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hi Maddmax and welcome to Safer Netowrking. :)
I'm Dakeyras and I am going to try to assist you with your problem. Please take note of the below:
I will start working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine!.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Refrain from running self fixes as this will hinder the malware removal process.
It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
I also have log.txt and info.txt files if needed. If you are referring to logs created by RSIT, please delete the following:
RSIT.exe <-- Executable file.
C:\rsit <-- Folder
We will download a fresh copy in due course.
Selective Startup Mode Advice:
Your log shows that MSConfig is running at startup. This indicates that you may be using "diagnostic startup" rather than "normal startup" to stop something from running. While this is normally OK, it is possible that you have disabled something that will affect how we clean your machine. Please don't change anything in MSConfig yet, these instructions will produce a report of what programs are currently disabled so I can see the entries without requiring any changes:
Go to Start > Run and type Notepad
Copy/paste the following quote box into a new notepad (not wordpad) document. Make sure that wordwrap is unchecked.
regedit /a /e %systemdrive%\regkey.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig"
notepad %systemdrive%\regkey.txt
del /q %systemdrive%\regkey.txt
Go to the menu at the top of the Notepad File and Save as
Save it to your Desktop as "mslook.bat" (you MUST include the quotes)
Locate mslook.bat on your Desktop and double-click it. When notepad opens, copy/paste the content in your reply. When you close Notepad the CMD window will close automatically and the text file will be deleted.
Disable Spybot S&D TeaTimer's Registry Guard:
This is so it does not interfere with the malware removal process, you may re-enable this when I give the all clear.
If you have version 1.5 or 1.6, right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
Click on Mode > Advanced Mode. When it prompts you, click Yes.
On the left hand side, click on Tools.
Check this box if it is not yet ticked: Resident.
You will notice that Resident is now added under Tools. Click on Resident.
Uncheck this box: Resident "TeaTimer" (Protection of over-all system settings) active.
Exit Spybot Search & Destroy.
Restart your computer for the changes to take effect.
Note: The above must be completed before proceeding any further!
When completed the above, please post back the following:
How is you computer performing now? Any problems encountered and or any further symptoms?
The results of mslook.bat.
Hello Dakeyras.
Thanks for your assistance. I've been out of town the last few days. I'll take the action you recommended and post back here in about 24 hours.
Thanks,
Max
Dakeyras
2009-11-23, 14:19
OK, fair enough. You replied in the nick of time actually as I was about to close this topic as inactive at some point today. :)
Hello.
1.
If you are referring to logs created by RSIT, please delete the following:
* RSIT.exe <-- Executable file.
* C:\rsit <-- Folder
* We will download a fresh copy in due course.
This is done.
____
2.
Locate mslook.bat on your Desktop and double-click it. When notepad opens, copy/paste the content in your reply.
Here is the content:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
"path"="E:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Gamma Loader.lnk"
"backup"="E:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup"
"location"="Common Startup"
"command"="E:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma Loader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Max^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
"path"="E:\\Documents and Settings\\Max\\Start Menu\\Programs\\Startup\\OpenOffice.org 2.4.lnk"
"backup"="E:\\WINDOWS\\pss\\OpenOffice.org 2.4.lnkStartup"
"location"="Startup"
"command"="E:\\PROGRA~1\\OPENOF~1.4\\program\\QUICKS~1.EXE "
"item"="OpenOffice.org 2.4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Reader_sl"
"hkey"="HKLM"
"command"="\"E:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AnyDVD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AnyDVD"
"hkey"="HKCU"
"command"="\"E:\\Program Files\\SlySoft\\AnyDVD\\AnyDVD.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="daemon"
"hkey"="HKCU"
"command"="\"E:\\Program Files\\DAEMON Tools Lite\\daemon.exe\" -autorun"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Fling]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="fling"
"hkey"="HKLM"
"command"="\"E:\\Program Files\\NCH Software\\Fling\\fling.exe\" -logon"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NMIndexStoreSvr"
"hkey"="HKCU"
"command"="\"E:\\Program Files\\Common Files\\Nero\\Lib\\NMIndexStoreSvr.exe\" ASO-616B5711-6DAE-4795-A05F-39A1E5104020"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"E:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NBKeyScan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NBKeyScan"
"hkey"="HKLM"
"command"="\"E:\\Program Files\\Nero\\Nero8\\Nero BackItUp\\NBKeyScan.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="E:\\Program Files\\Common Files\\Nero\\Lib\\NeroCheck.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="QTTask"
"hkey"="HKLM"
"command"="\"E:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SeaMonkey Quick Launch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SeaMonkey"
"hkey"="HKCU"
"command"="\"E:\\Program Files\\mozilla.org\\SeaMonkey\\SeaMonkey.exe\" -turbo"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpybotSD TeaTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TeaTimer"
"hkey"="HKCU"
"command"="E:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Symantec NetDriver Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SNDMon"
"hkey"="HKLM"
"command"="E:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UpdateManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sgtray"
"hkey"="HKLM"
"command"="\"E:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="YAHOOM~1"
"hkey"="HKCU"
"command"="\"E:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"system.ini"=dword:00000000
"win.ini"=dword:00000000
"bootini"=dword:00000000
"services"=dword:00000000
"startup"=dword:00000002
____
3.
Disable Spybot S&D TeaTimer's Registry Guard:
This is done.
____
4.
How is you computer performing now? Any problems encountered and or any further symptoms?
My computer has never had severe symptoms. It has continued to work fairly well. The same is true after I restarted. One thing I did notice is that the "auto protect" feature of Norton Antivirus was not activated after the restart. I had to manually select "enable auto protect". This was one of the potential virus symptoms I noticed before, which appeared to be corrected after I contact Symantec for help with the re-registering Norton Antivirus.
Thanks in advance for your help. Please let me know how to proceed.
Max
Dakeyras
2009-11-24, 15:24
Hi. :)
Enable disabled items with MSConfig:
Go to Start> Run type msconfig and click OK.
Under the Services tab click Enable All
Under the Startup tab click Enable All> Apply> OK> Reboot now.
StartUpLite:
Please download this small application from here (http://www.malwarebytes.org/startuplite.php).
It is very simple to use and quite effective and will advise about any unnecessary system startups that can be safely removed.
Scan with Rooter:
Please download Rooter (http://forums.whatthetech.com/redirect.php?url=http%3A%2F%2Feric.71.mespages.googlepages.com%2FRooter.exe) to your desktop.
Double click on Rooter.exe to start the application.
Now click on the Scan button.
When the scan is completed a text file called Rooter.txt will appear on your desktop, post the contents in your next reply.
Now click on Close button to exit Rooter.
Note: The logfile can also be located within this folder Rooter$ at the root of your installed Hard-Drive. EG: C:\Rooter$
Scan with RSIT:
Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Make sure that RSIT.exe is on the your Desktop before running the application!
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
log.txt will be opened maximized.
info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
Note: Both logs can also be located within this folder rsit at the root of your installed Hard-Drive. EG: C:\rsit
When completed the above, please post back the following in the order asked for:
How is you computer performing now, any further symptoms and or problems encountered?
Rooter Log.
Both RSIT logs. <-- Post them individually please, IE: one Log per post/reply.
Hi.
1.
1. Enable disabled items with MSConfig:
Go to Start> Run type msconfig and click OK.
Under the Services tab click Enable All
Under the Startup tab click Enable All> Apply> OK> Reboot now.
This is done.
_____
2.
StartUpLite:
Please download this small application from here.
It is very simple to use and quite effective and will advise about any unnecessary system startups that can be safely removed.
I did this, but I didn't take any action after the application started. Please let me know how to proceed. I didn't want to act without checking with you first.
____
3.
How is you computer performing now, any further symptoms and or problems encountered?
No additional symptoms or problems that I'm aware of. Several applications started when I rebooted, which slowed the startup process a bit. Nothing else I can think of.
____
4.
Here is the Rooter log:
Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully ...
.
Windows XP . (5.1.2600) Service Pack 3
[32_bits] - x86 Family 15 Model 4 Stepping 1, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[SharedAccess] RUNNING (state:4)
Windows Firewall -> Disabled !
.
Internet Explorer 6.0.2900.5512
Mozilla Firefox 3.5.5 (en-US)
.
A:\ [Removable]
C:\ [Fixed-FAT32] .. ( Total:74 Go - Free:63 Go )
D:\ [CD_Rom]
E:\ [Fixed-NTFS] .. ( Total:149 Go - Free:13 Go )
F:\ [CD_Rom]
H:\ [CD_Rom]
.
Scan : 20:57.21
Path : E:\Documents and Settings\Max\Desktop\Rooter.exe
User : Max ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
______ System (4)
______ \SystemRoot\System32\smss.exe (660)
______ \??\E:\WINDOWS\system32\csrss.exe (740)
______ \??\E:\WINDOWS\system32\winlogon.exe (764)
______ E:\WINDOWS\system32\services.exe (808)
______ E:\WINDOWS\system32\lsass.exe (820)
______ E:\WINDOWS\system32\svchost.exe (1016)
______ E:\WINDOWS\system32\svchost.exe (1092)
______ E:\WINDOWS\System32\svchost.exe (1188)
______ E:\WINDOWS\system32\svchost.exe (1224)
______ E:\WINDOWS\system32\svchost.exe (1360)
______ E:\WINDOWS\system32\svchost.exe (1472)
Locked CCSETMGR.EXE (1564)
Locked SNDSrvc.exe (1580)
Locked SPBBCSvc.exe (1600)
Locked CCEVTMGR.EXE (1736)
______ E:\WINDOWS\system32\spoolsv.exe (1868)
______ E:\WINDOWS\Explorer.EXE (276)
______ E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (392)
______ E:\WINDOWS\system32\dla\tfswctrl.exe (404)
Locked CCAPP.EXE (476)
______ E:\Program Files\Java\jre6\bin\jusched.exe (484)
______ E:\Program Files\iTunes\iTunesHelper.exe (532)
______ E:\WINDOWS\system32\svchost.exe (728)
______ E:\Program Files\NCH Software\Fling\fling.exe (436)
______ E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe (944)
______ E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1048)
Locked AluSchedulerSvc.exe (1136)
______ E:\Program Files\Messenger\msmsgs.exe (1152)
______ E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (1392)
______ E:\WINDOWS\system32\basfipm.exe (1448)
______ E:\Program Files\Bonjour\mDNSResponder.exe (1480)
______ E:\Program Files\NCH Software\Fling\fling.exe (1588)
______ E:\Program Files\Java\jre6\bin\jqs.exe (1676)
______ E:\Program Files\DAEMON Tools Lite\daemon.exe (1936)
______ E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (2060)
______ E:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe (2160)
Locked NPFMNTOR.EXE (2224)
______ E:\WINDOWS\system32\IoctlSvc.exe (2276)
______ E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe (2456)
______ E:\WINDOWS\system32\svchost.exe (2512)
Locked symlcsvc.exe (2548)
______ E:\WINDOWS\system32\wdfmgr.exe (2572)
______ E:\Program Files\OpenOffice.org 2.4\program\soffice.exe (3152)
______ E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN (3180)
______ E:\WINDOWS\system32\wbem\wmiprvse.exe (3500)
______ E:\Program Files\iPod\bin\iPodService.exe (3664)
______ E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (3868)
______ E:\WINDOWS\System32\alg.exe (4020)
______ E:\WINDOWS\System32\svchost.exe (2992)
______ E:\WINDOWS\system32\wbem\wmiprvse.exe (3972)
Locked NAVAPSVC.EXE (3968)
______ E:\Program Files\Mozilla Firefox\firefox.exe (3200)
______ E:\PROGRA~1\mozilla.org\SEAMON~1\SEAMON~1.EXE (1908)
______ E:\Documents and Settings\Max\Desktop\Rooter.exe (300)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 (Start_Offset:32256 | Length:65769984)
\Device\Harddisk0\Partition2 --[ MBR ]-- (Start_Offset:65802240 | Length:79933271040)
.
----------------------\\ Scheduled Tasks
.
E:\WINDOWS\Tasks\desktop.ini
E:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Max.job
E:\WINDOWS\Tasks\SA.DAT
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 20:58.32
.
E:\Rooter$\Rooter_1.txt - (24/11/2009 | 20:58.32)
____
I'll post RSIT logs in separate entries to follow
info.txt logfile of random's system information tool 1.06 2009-11-24 21:04:07
======Uninstall list======
-->E:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
-->E:\WINDOWS\system32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature
-->E:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
-->E:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
-->E:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->E:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->E:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->E:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->E:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 E:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->E:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR-->E:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player 10 Plugin-->E:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->E:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 7.0-->E:\WINDOWS\ISUNINST.EXE -f"E:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"E:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Amazon Unbox Video-->E:\Program Files\InstallShield Installation Information\{54A4839E-87F8-4BD1-9682-A349E9943F0A}\setup.exe -runfromtemp -l0x0409
AnyDVD-->"E:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="E:\Program Files\SlySoft\AnyDVD"
Apple Application Support-->MsiExec.exe /I{B607C354-CD79-4D22-86D1-92DC94153F42}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AVI to MPEG Converter-->E:\PROGRA~1\AVITOM~1\UNWISE.EXE E:\PROGRA~1\AVITOM~1\INSTALL.LOG
AVIcodec (remove only)-->"E:\Program Files\AVIcodec\uninst.exe"
AviSynth 2.5-->"E:\Program Files\AviSynth 2.5\Uninstall.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Broadcom ASF Management Applications-->E:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{25D24E84-64A9-40D2-85CF-540B1C4A6D52} /l1033
Broadcom Gigabit Integrated Controller-->E:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BE6890C7-31EF-478C-812E-1E2899ABFCA9} /l1033
ccCommon-->MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}
CoffeeCup Free FTP 4.0.0-->E:\Program Files\CoffeeCup Software\FreeFTPFree-4.0.0\uninstall.exe
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
ConvertMovie 3.0-->E:\Program Files\ConvertMovie 3.0\uninst.exe
Dell ResourceCD-->RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
DesignPro 5.4 Limited Edition-->E:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{71F6DF7D-B639-4FAD-BA93-E6DF267AA44D}
DVD Decrypter (Remove Only)-->"E:\Program Files\DVD Decrypter\uninstall.exe"
DVD Shrink 3.2-->"E:\Program Files\DVD Shrink\unins000.exe"
DVDFab (Platinum/Gold/HD Decrypter) (Non-CSS Version) 5.2.3.2-->"E:\Program Files\DVDFab 5\unins000.exe"
DVDFab Ghosthunter release 5.2.3.0-->"E:\Program Files\DVDFab 5-Ghost\unins000.exe"
ERUNT 1.1j-->"E:\Program Files\ERUNT\unins000.exe"
ffdshow [rev 1972] [2008-05-24]-->"E:\Program Files\ffdshow\unins000.exe"
Fling File Transfer-->E:\Program Files\NCH Software\Fling\uninst.exe
GIRDAC Image Editor and Converter-->E:\Program Files\ImageEditorAndConverter\UNINSTL.exe
HijackThis 2.0.2-->"E:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->E:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->E:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"E:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"E:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"E:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB961118)-->"E:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB970653-v3)-->"E:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Internet Worm Protection-->MsiExec.exe /I{2908F0CB-C1D4-447F-97A2-CFC135C9F8D4}
iPhone Configuration Utility-->MsiExec.exe /I{FA54AFB1-5745-4389-B8C1-9F7509672ED1}
iTunes-->MsiExec.exe /I{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}
Java(TM) 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
jZip-->E:\PROGRA~1\jZip\UNWISE.EXE /U E:\PROGRA~1\jZip\INSTALL.LOG
K-Lite Mega Codec Pack 4.9.0-->"E:\Program Files\K-Lite Codec Pack\unins000.exe"
LiveReg (Symantec Corporation)-->E:\Program Files\Common Files\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
LiveUpdate 3.0 (Symantec Corporation)-->"E:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->E:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"E:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"E:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Office Basic Edition 2003-->MsiExec.exe /I{91130409-6000-11D3-8CFE-0150048383C9}
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF0409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"E:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Motorola Driver Installation 3.2.0-->MsiExec.exe /I{D6A1E429-CCE1-4140-A615-710B806D12BA}
Mozilla Firefox (3.5.5)-->E:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NCH Toolbox-->E:\Program Files\NCH Swift Sound\ToolBox\uninst.exe
Nero 8 Trial-->MsiExec.exe /X{BE282C23-5484-47FF-B2C1-EBEA5C891033}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Norton AntiVirus 2005 (Symantec Corporation)-->E:\Program Files\Common Files\Symantec Shared\SymSetup\{C6F5B6CF-609C-428E-876F-CA83176C021B}.exe /X
Norton AntiVirus 2005-->MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
Norton AntiVirus Help-->MsiExec.exe /I{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}
Norton AntiVirus Parent MSI-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton AntiVirus SYMLT MSI-->MsiExec.exe /I{D1FF75E7-DD42-4CFD-B052-20B3FFF4EDB8}
Norton WMI Update-->MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4}
OpenOffice.org 2.4-->MsiExec.exe /I{F87A8E11-02A4-4875-A3A5-5961081B0E4E}
Opera 9.27-->MsiExec.exe /X{04DB4871-BC1D-44BF-AADB-47326365EB8C}
PageBreeze Free HTML Editor-->E:\PROGRA~1\PAGEBR~1\UNWISE.EXE E:\PROGRA~1\PAGEBR~1\INSTALL.LOG
Picasa 3-->"E:\Program Files\Google\Picasa3\Uninstall.exe"
PlayFLV-->"E:\Program Files\FLVCodec\uninstall.exe"
PowerDVD 5.1-->RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
RipTiger 2.7.8-->"E:\Program Files\RipTiger\unins000.exe"
RipTiger Extras 2.7.0-->"E:\Program Files\RipTiger\unins001.exe"
SeaMonkey (1.1.10)-->E:\WINDOWS\SeaMonkeyUninstall.exe /ua "1.1.10 (en)"
Security Update for Windows Media Player (KB952069)-->"E:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB954155)-->"E:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB968816)-->"E:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB973540)-->"E:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"E:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"E:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"E:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"E:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->E:\WINDOWS\system32\MacroMed\Flash\genuinst.exe E:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"E:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"E:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"E:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950759)-->"E:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"E:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"E:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"E:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"E:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"E:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"E:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"E:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"E:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"E:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"E:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953838)-->"E:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"E:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"E:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"E:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"E:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"E:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"E:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"E:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"E:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956744)-->"E:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"E:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"E:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"E:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956844)-->"E:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"E:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"E:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958215)-->"E:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"E:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"E:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)-->"E:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958869)-->"E:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"E:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"E:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960714)-->"E:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"E:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"E:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960859)-->"E:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961371)-->"E:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961373)-->"E:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"E:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB963027)-->"E:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Security Update for Windows XP (KB968537)-->"E:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969059)-->"E:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969897)-->"E:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969898)-->"E:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969947)-->"E:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"E:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971486)-->"E:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971557)-->"E:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971633)-->"E:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971657)-->"E:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971961)-->"E:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Security Update for Windows XP (KB972260)-->"E:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973346)-->"E:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973354)-->"E:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973507)-->"E:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973525)-->"E:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973869)-->"E:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974112)-->"E:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974455)-->"E:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974571)-->"E:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975025)-->"E:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975467)-->"E:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Sonic RecordNow! Plus-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
Sonic Update Manager-->MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3}
Sony Noise Reduction Plug-In 2.0h-->MsiExec.exe /X{06A1BE8A-4CA4-4A39-B9E4-E815AA8FE05C}
Sony Sound Forge 9.0-->MsiExec.exe /X{4AEA9A23-D627-4699-8A0F-FC474308C2E6}
SoundMAX-->RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe"
SoundTaxi Media Suite 3.9.1-->E:\Program Files\SoundTaxi Media Suite\uninst.exe
SPBBC-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy-->"E:\Program Files\Spybot - Search & Destroy\unins000.exe"
STOIK Video Converter 2-->RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{A8DF8593-F619-47DE-AD27-BCABF233433A}\setup.exe" -l0x9 -removeonly
Symantec Script Blocking Installer-->MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138}
Symantec-->MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
UnRAR for Windows-->E:\Program Files\UnRar for Windows\Uninstal.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->E:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Windows XP (KB951072-v2)-->"E:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"E:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"E:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"E:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update for Windows XP (KB968389)-->"E:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update for Windows XP (KB973815)-->"E:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Update for Windows XP (KB976749)-->"E:\WINDOWS\$NtUninstallKB976749$\spuninst\spuninst.exe"
uSeesoft Video to YouTube Converter-->"E:\Program Files\uSeesoft\Video to YouTube Converter\unins000.exe"
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Videora iPod Converter 5.02-->E:\Program Files\Red Kawa\Video Converter App\uninstaller.exe
WinAVIVideoConverter-->"E:\Program Files\WinAVIVideoConverter\unins000.exe"
Windows Media Format Runtime-->"E:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"E:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3-->"E:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinPcap 4.0.2-->E:\Program Files\WinPcap\uninstall.exe
Xvid 1.1.3 final uninstall-->"E:\Program Files\Xvid\unins000.exe"
Yahoo! Internet Mail-->E:\WINDOWS\system32\regsvr32 /u /s E:\PROGRA~1\Yahoo!\Common\YMMAPI.dll
Yahoo! Messenger-->E:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U E:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
YouTube Downloader App 2.02-->E:\Program Files\Regensoft\Downloader App\uninstaller.exe
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Security center information======
AV: Norton AntiVirus 2005
FW: Norton Internet Worm Protection
======System event log======
Computer Name: IRA-9555D2D9A25
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 16250
Source Name: Tcpip
Time Written: 20090908225245.000000-360
Event Type: warning
User:
Computer Name: IRA-9555D2D9A25
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 16249
Source Name: Disk
Time Written: 20090908204357.000000-360
Event Type: warning
User:
Computer Name: IRA-9555D2D9A25
Event Code: 51
Message: An error was detected on device \Device\Harddisk2\D during a paging operation.
Record Number: 16248
Source Name: Disk
Time Written: 20090908204342.000000-360
Event Type: warning
User:
Computer Name: IRA-9555D2D9A25
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 16156
Source Name: Tcpip
Time Written: 20090903224008.000000-360
Event Type: warning
User:
Computer Name: IRA-9555D2D9A25
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.
Record Number: 16155
Source Name: W32Time
Time Written: 20090903204152.000000-360
Event Type: warning
User:
=====Application event log=====
Computer Name: IRA-9555D2D9A25
Event Code: 1000
Message: Faulting application mplayerc.exe, version 1.2.1008.0, faulting module unknown, version 0.0.0.0, fault address 0x622d05c0.
Record Number: 7481
Source Name: Application Error
Time Written: 20091031120842.000000-360
Event Type: error
User:
Computer Name: IRA-9555D2D9A25
Event Code: 1517
Message: Windows saved user IRA-9555D2D9A25\Max registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
Record Number: 7184
Source Name: Userenv
Time Written: 20091016031659.000000-360
Event Type: warning
User: NT AUTHORITY\SYSTEM
Computer Name: IRA-9555D2D9A25
Event Code: 1524
Message: Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.
Record Number: 7183
Source Name: Userenv
Time Written: 20091016031655.000000-360
Event Type: warning
User: IRA-9555D2D9A25\Max
Computer Name: IRA-9555D2D9A25
Event Code: 1020
Message: Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
Record Number: 7173
Source Name: ASP.NET 2.0.50727.0
Time Written: 20091016030859.000000-360
Event Type: warning
User:
Computer Name: IRA-9555D2D9A25
Event Code: 1002
Message: Hanging application PowerDVD.exe, version 5.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Record Number: 7083
Source Name: Application Hang
Time Written: 20091011122852.000000-360
Event Type: error
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;E:\Program Files\jZip;E:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;E:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=E:\Program Files\Java\jre6\lib\ext\QTJava.zip
-----------------EOF-----------------
Logfile of random's system information tool 1.06 (written by random/random)
Run by Max at 2009-11-24 21:03:52
Microsoft Windows XP Professional Service Pack 3
System drive E: has 14 GB (9%) free of 153 GB
Total RAM: 1014 MB (49% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:04:04 PM, on 11/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
E:\WINDOWS\system32\dla\tfswctrl.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\NCH Software\Fling\fling.exe
E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
E:\WINDOWS\system32\basfipm.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\NCH Software\Fling\fling.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\DAEMON Tools Lite\daemon.exe
E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
E:\WINDOWS\system32\IoctlSvc.exe
E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
E:\Program Files\iPod\bin\iPodService.exe
E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\PROGRA~1\mozilla.org\SEAMON~1\SEAMON~1.EXE
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Documents and Settings\Max\Desktop\RSIT.exe
E:\Program Files\Trend Micro\HijackThis\Max.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - E:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDLauncher] "E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] E:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UpdateManager] "E:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Fling] "E:\Program Files\NCH Software\Fling\fling.exe" -logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SeaMonkey Quick Launch] "E:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe" -turbo
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AnyDVD] "E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - S-1-5-18 Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://E:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - E:\WINDOWS\system32\basfipm.exe
O23 - Service: Bonjour Service - Apple Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ElevatorService - Unknown owner - E:\Program Files\RipTiger\ElevatorService.exe
O23 - Service: Fling File Transfer (FlingService) - NCH Software - E:\Program Files\NCH Software\Fling\fling.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - E:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - E:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: spkrmon - Unknown owner - E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: STSService - Unknown owner - E:\Program Files\SoundTaxi Media Suite\STSService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10570 bytes
======Scheduled tasks folder======
E:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Max.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
E:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll [2005-05-31 853672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - E:\WINDOWS\system32\dla\tfswshx.dll [2004-08-13 118842]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - E:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-21 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - E:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"=E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-26 53248]
"dla"=E:\WINDOWS\system32\dla\tfswctrl.exe [2004-08-13 122939]
"ccApp"=E:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-01-17 58728]
"SunJavaUpdateSched"=E:\Program Files\Java\jre6\bin\jusched.exe [2009-05-21 148888]
"QuickTime Task"=E:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=E:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]
"UpdateManager"=E:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
"Symantec NetDriver Monitor"=E:\PROGRA~1\SYMNET~1\SNDMon.exe [2008-04-27 100056]
"NeroFilterCheck"=E:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]
"NBKeyScan"=E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
"Fling"=E:\Program Files\NCH Software\Fling\fling.exe [2008-07-16 356356]
"Adobe Reader Speed Launcher"=E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=E:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"Yahoo! Pager"=E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-08-30 4670704]
"SpybotSD TeaTimer"=E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"SeaMonkey Quick Launch"=E:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe [2008-06-21 106496]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]
"DAEMON Tools Lite"=E:\Program Files\DAEMON Tools Lite\daemon.exe [2008-04-01 486856]
"AnyDVD"=E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [2009-01-09 89024]
E:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
E:\Documents and Settings\Max\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
E:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskmgr"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\uTorrent\uTorrent.exe"="E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Opera.exe"="C:\Program Files\Opera.exe:*:Enabled:Opera Internet Browser"
"E:\Program Files\Messenger\msmsgs.exe"="E:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"E:\Program Files\Yahoo!\Messenger\YServer.exe"="E:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"E:\Program Files\Bonjour\mDNSResponder.exe"="E:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"E:\Program Files\iTunes\iTunes.exe"="E:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2009-12-25 12:15:51 ----A---- E:\WINDOWS\10359rz535d.exe
2009-12-20 10:26:42 ----A---- E:\WINDOWS\system32\15592trojz48.dll
2009-12-18 17:16:03 ----A---- E:\WINDOWS\system32\10665vir5z498.exe
2009-12-15 11:44:31 ----A---- E:\WINDOWS\system32\z453s5ambot109.dll
2009-12-15 10:09:11 ----A---- E:\WINDOWS\system32\9z935roj366.dll
2009-12-10 06:12:38 ----A---- E:\WINDOWS\system32\29550szy6b7.dll
2009-11-24 21:03:52 ----D---- E:\rsit
2009-11-24 20:58:32 ----D---- E:\Rooter$
2009-11-24 08:54:53 ----A---- E:\WINDOWS\133005o9m2z3.dll
2009-11-23 18:34:30 ----A---- E:\WINDOWS\system32\6274downlo5der69z.exe
2009-11-23 04:57:09 ----A---- E:\WINDOWS\system32\265209otza-virus450.exe
2009-11-22 07:56:06 ----A---- E:\WINDOWS\3068addzar91305.dll
2009-11-21 07:04:35 ----A---- E:\WINDOWS\z382v5r1916.dll
2009-11-13 21:00:17 ----D---- E:\WINDOWS\ERDNT
2009-11-13 20:59:30 ----D---- E:\Program Files\ERUNT
2009-11-13 20:32:45 ----D---- E:\Program Files\trend micro
2009-11-12 21:52:08 ----D---- E:\WINDOWS\CSC
2009-11-12 21:52:00 ----A---- E:\WINDOWS\ntbtlog.txt
2009-11-12 18:39:23 ----D---- E:\Program Files\iPod
2009-11-12 18:39:04 ----D---- E:\Program Files\iTunes
2009-11-11 12:24:59 ----A---- E:\WINDOWS\12114spam5o97f4z.exe
2009-11-11 03:00:49 ----HDC---- E:\WINDOWS\$NtUninstallKB969947$
2009-11-05 03:01:16 ----HDC---- E:\WINDOWS\$NtUninstallKB976749$
2009-10-28 03:51:42 ----A---- E:\WINDOWS\1z062spambo5692.exe
2009-10-26 21:56:29 ----A---- E:\WINDOWS\3zacvir9705.dll
======List of files/folders modified in the last 1 months======
2009-11-24 21:03:24 ----D---- E:\WINDOWS\Prefetch
2009-11-24 20:52:27 ----D---- E:\Program Files\Mozilla Firefox
2009-11-24 20:52:13 ----D---- E:\Documents and Settings\Max\Application Data\OpenOffice.org2
2009-11-24 20:52:06 ----D---- E:\WINDOWS\Temp
2009-11-24 20:52:01 ----D---- E:\WINDOWS\system32\CatRoot2
2009-11-24 20:51:58 ----D---- E:\WINDOWS\system32
2009-11-24 20:51:19 ----RD---- E:\Program Files
2009-11-24 20:51:19 ----D---- E:\Program Files\Common Files
2009-11-24 20:50:21 ----A---- E:\WINDOWS\SchedLgU.Txt
2009-11-24 20:50:08 ----A---- E:\WINDOWS\win.ini
2009-11-24 20:50:08 ----A---- E:\WINDOWS\system.ini
2009-11-24 20:49:48 ----D---- E:\WINDOWS\pss
2009-11-23 18:44:22 ----D---- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-22 11:13:17 ----A---- E:\WINDOWS\NeroDigital.ini
2009-11-15 17:19:19 ----SHD---- E:\WINDOWS\Installer
2009-11-13 21:00:17 ----AD---- E:\WINDOWS
2009-11-12 19:22:47 ----D---- E:\Program Files\Spybot - Search & Destroy
2009-11-12 18:58:28 ----D---- E:\Program Files\Common Files\Symantec Shared
2009-11-12 18:39:21 ----D---- E:\Program Files\Common Files\Apple
2009-11-12 18:35:04 ----D---- E:\WINDOWS\WinSxS
2009-11-11 03:00:59 ----HD---- E:\WINDOWS\inf
2009-11-11 03:00:51 ----RSHDC---- E:\WINDOWS\system32\dllcache
2009-11-11 01:14:53 ----HD---- E:\WINDOWS\$hf_mig$
2009-11-05 10:36:22 ----A---- E:\WINDOWS\system32\MRT.exe
2009-11-05 03:22:17 ----A---- E:\WINDOWS\system32\PerfStringBackup.INI
2009-11-05 03:01:30 ----A---- E:\WINDOWS\imsins.BAK
2009-10-31 11:07:33 ----D---- E:\Documents and Settings\Max\Application Data\Real
2009-10-29 10:03:29 ----D---- E:\WINDOWS\Help
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 ElbyCDIO;ElbyCDIO Driver; E:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-01-01 24872]
R1 intelppm;Intel Processor Driver; E:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; E:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; E:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 SAVRTPEL;SAVRTPEL; \??\E:\Program Files\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 sscdbhk5;sscdbhk5; E:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; E:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R1 SYMTDI;SYMTDI; E:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-03-28 266552]
R2 BASFND;BASFND; \??\E:\WINDOWS\system32\Drivers\BASFND.sys []
R2 drvnddm;drvnddm; E:\WINDOWS\system32\drivers\drvnddm.sys [2004-08-13 40544]
R2 symlcbrd;symlcbrd; \??\E:\WINDOWS\system32\drivers\symlcbrd.sys []
R2 tfsnboio;tfsnboio; E:\WINDOWS\system32\dla\tfsnboio.sys [2004-08-13 25723]
R2 tfsncofs;tfsncofs; E:\WINDOWS\system32\dla\tfsncofs.sys [2004-08-13 34843]
R2 tfsndrct;tfsndrct; E:\WINDOWS\system32\dla\tfsndrct.sys [2004-08-13 4123]
R2 tfsndres;tfsndres; E:\WINDOWS\system32\dla\tfsndres.sys [2004-08-13 2239]
R2 tfsnifs;tfsnifs; E:\WINDOWS\system32\dla\tfsnifs.sys [2004-08-13 86202]
R2 tfsnopio;tfsnopio; E:\WINDOWS\system32\dla\tfsnopio.sys [2004-08-13 14715]
R2 tfsnpool;tfsnpool; E:\WINDOWS\system32\dla\tfsnpool.sys [2004-08-13 6363]
R2 tfsnudf;tfsnudf; E:\WINDOWS\system32\dla\tfsnudf.sys [2004-08-13 98714]
R2 tfsnudfa;tfsnudfa; E:\WINDOWS\system32\dla\tfsnudfa.sys [2004-08-13 100603]
R3 aeaudio;aeaudio; E:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 AnyDVD;AnyDVD; E:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-01-08 103488]
R3 Arp1394;1394 ARP Client Protocol; E:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 b57w2k;Broadcom NetXtreme 57xx Gigabit Controller; E:\WINDOWS\system32\DRIVERS\b57xp32.sys [2004-04-29 186112]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; E:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hidusb;Microsoft HID Class Driver; E:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; E:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
R3 NAVENG;NAVENG; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20091118.003\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20091118.003\NavEx15.Sys []
R3 NIC1394;1394 Net Driver; E:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pcouffin;VSO Software pcouffin; E:\WINDOWS\System32\Drivers\pcouffin.sys [2009-04-06 47360]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; E:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-12 5888]
R3 SAVRT;SAVRT; \??\E:\Program Files\Norton AntiVirus\SAVRT.SYS []
R3 smwdm;smwdm; E:\WINDOWS\system32\drivers\smwdm.sys [2004-04-09 612352]
R3 SYMDNS;SYMDNS; E:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-03-28 11480]
R3 SymEvent;SymEvent; \??\E:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; E:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-03-28 171928]
R3 SYMIDS;SYMIDS; E:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-03-28 37016]
R3 SYMIDSCO;SYMIDSCO; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20091110.002\symidsco.sys []
R3 SYMNDIS;SYMNDIS; E:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-03-28 47192]
R3 SYMREDRV;SYMREDRV; E:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-03-28 18904]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; E:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; E:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; E:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; E:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; E:\WINDOWS\System32\Drivers\vulfnth.sys [2003-08-04 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; E:\WINDOWS\System32\Drivers\vulfntr.sys [2003-08-04 11392]
S3 61883;61883 Unit Device; E:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 ae7b7w16;ae7b7w16; E:\WINDOWS\system32\drivers\ae7b7w16.sys []
S3 Avc;AVC Device; E:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 CCDECODE;Closed Caption Decoder; E:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 dot4;MS IEEE-1284.4 Driver; E:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; E:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 Dot4Scan;Scan Class Driver for IEEE-1284.4; E:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]
S3 dot4usb;Dot4USB Filter Dot4USB Filter; E:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-17 23808]
S3 motmodem;Motorola USB CDC ACM Driver; E:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]
S3 MSDV;Microsoft DV Camera and VCR; E:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; E:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; E:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; E:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Network Monitor Driver; E:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 NPF;NetGroup Packet Filter Driver; E:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 SLIP;BDA Slip De-Framer; E:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; E:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; E:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; E:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 USBAAPL;Apple Mobile USB Driver; E:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 USBSTOR;USB Mass Storage Driver; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; E:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; E:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WSTCODEC;World Standard Teletext Codec; E:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; E:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ADVService;Amazon Unbox Video Service; E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [2007-07-11 25640]
R2 Apple Mobile Device;Apple Mobile Device; E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 BAsfIpM;Broadcom ASF IP monitoring service v6.0.4; E:\WINDOWS\system32\basfipm.exe [2004-04-01 77824]
R2 Bonjour Service;Bonjour Service; E:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ccEvtMgr;Symantec Event Manager; E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2008-01-17 197992]
R2 ccSetMgr;Symantec Settings Manager; E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2008-01-17 181608]
R2 FlingService;Fling File Transfer; E:\Program Files\NCH Software\Fling\fling.exe [2008-07-16 356356]
R2 JavaQuickStarterService;Java Quick Starter; E:\Program Files\Java\jre6\bin\jqs.exe [2009-05-21 152984]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NPFMntor;Norton AntiVirus Firewall Monitor Service; E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe [2005-10-19 46704]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; E:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SNDSrvc;Symantec Network Drivers Service; E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-03-28 206552]
R2 SPBBCSvc;Symantec SPBBCSvc; E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2004-07-21 173160]
R2 spkrmon;spkrmon; E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe [2003-08-28 61440]
R2 Symantec Core LC;Symantec Core LC; E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-04-27 822424]
R2 UMWdf;Windows User Mode Driver Framework; E:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; E:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 iPod Service;iPod Service; E:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
R3 navapsvc;Norton AntiVirus Auto-Protect Service; E:\Program Files\Norton AntiVirus\navapsvc.exe [2005-10-19 177264]
R3 NMIndexingService;NMIndexingService; E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S2 SBService;ScriptBlocking Service; E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe [2005-10-19 67184]
S3 aspnet_state;ASP.NET State Service; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 ccPwdSvc;Symantec Password Validation; E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2008-01-17 79208]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 ElevatorService;ElevatorService; E:\Program Files\RipTiger\ElevatorService.exe [2009-09-29 180224]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120]
S3 idsvc;Windows CardSpace; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); E:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 SAVScan;SAVScan; E:\Program Files\Norton AntiVirus\SAVScan.exe [2005-03-07 198368]
S3 STSService;STSService; E:\Program Files\SoundTaxi Media Suite\STSService.exe [2009-09-28 335872]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Dakeyras
2009-11-25, 13:42
Hi. :)
I did this, but I didn't take any action after the application started. Please let me know how to proceed. I didn't want to act without checking with you first.
OK when you run the application it will list all that can be safely removed, so you can do so if you so wish. If still unsure I can advise specifically which start-ups to remove.
You will need to disable TeaTimer again though unfortunately as it has returned but that could not be helped. Refer to my prior instructions here (http://forums.spybot.info/showpost.php?p=347547&postcount=2).
Hard-Drive Free Space Advice:
System drive E: has 14 GB (9%) free of 153 GBThis is considered dangerously low. A Hard-Drive requires a bare minimum of 15% available free space to be able to function correctly, but at least 25% is better in my opinion.
I advise you read this article: What to do if your Computer's running slowly (http://www.malwareremoval.com/tutorials/runningslowly.php) and choose to uninstall some software you do not need, this is just my advice as the lack of current Hard-Drive space will be impacting on overall system performance. and or move any documents/files/pictures etc to a form of removable media.
This is just my advice as the lack of current Hard-Drive space will be impacting on overall system performance. Plus eventually any type of system maintenance will prove to be problematic.
Peer to Peer application advice:
Please read the forum policy (http://forums.spybot.info/showthread.php?t=282) concerning the aforementioned. Now remove the below from your machine thank you.
E:\Program Files\uTorrent\uTorrent.exe
Note: It does not have a uninstaller persay so merely remove the folder:-
E:\Program Files\uTorrent <-- This folder.
TFC(Temp File Cleaner):
Please download TFC (http://oldtimer.geekstogo.com/TFC.exe) to your desktop,
Save any unsaved work. TFC will close all open application windows.
Double-click TFC.exe to run the program.
Click the Start button in the bottom left of TFC
If prompted, click "Yes" to reboot.
Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It should not take longer than a couple of minutes , and may only take a few seconds. Only if needed will you be prompted to reboot.
Next:
Please download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) to your desktop.
Double-click mbam-setup.exe and select then follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post that log in your next reply.
The log can also be found here:
Launch Malwarebytes' Anti-Malware
Click on the Logs radio tab.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
When completed the above, please post back the following:
How is you computer performing now? Any problems encountered and or any further symptoms?
Malwarebytes' Anti-Malware Log.
A new RSIT Log. <-- Only one will be created this time and that is all I require.
I'm having problems getting Search and Destroy to open so I can change the Tea Timer settings. I can't get past the "check in progress" screen. S&D hangs up/freezes on this screen every time. I've tried this four times today. Do you have any suggestions on how I can work around this problem?
You mentioned earlier that I had too little free space on my hard drive, which could impact system performance. I deleted numerous files from my E: drive and now have about 55 gb free on my 150 gb hard drive.
I'd appreciate any suggestions you might have.
Thanks,
Max
Dakeyras
2009-11-27, 09:42
Hi. :)
OK no problem, merely uninstall Spybot for now and you may reinstall when I give the all clear.
Hi.
1.
I did everything you asked, including uninstalling Spybot. My computer seems to be working normally. No new or unusual problems. Keep in mind, the main problems I was having were Norton Antivirus not working properly, and Spybot not working properly. So far, so good. :)
2.
StartUpLite:
Please download this small application from here.
It is very simple to use and quite effective and will advise about any unnecessary system startups that can be safely removed.
I did this, but I didn't take any action after the application started. Please let me know how to proceed. I didn't want to act without checking with you first.
OK when you run the application it will list all that can be safely removed, so you can do so if you so wish. If still unsure I can advise specifically which start-ups to remove.
I would appreciate any advice you can offer about what start-up items to remove. Once all this is done, I know which start-ups I want to remove, but I'd appreciate hearing your thoughts, too.
____
3.
Here is the mbam log:
Malwarebytes' Anti-Malware 1.41
Database version: 3245
Windows 5.1.2600 Service Pack 3
11/27/2009 6:53:16 PM
mbam-log-2009-11-27 (18-53-16).txt
Scan type: Quick Scan
Objects scanned: 100760
Time elapsed: 6 minute(s), 0 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
E:\Program Files\Setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
____
I'll post the new RSIT log in a separate post.
Max
Here is the latest RSIT log:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Max at 2009-11-27 18:59:42
Microsoft Windows XP Professional Service Pack 3
System drive E: has 57 GB (38%) free of 153 GB
Total RAM: 1014 MB (48% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:55 PM, on 11/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
E:\WINDOWS\system32\dla\tfswctrl.exe
E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe
E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
E:\Program Files\DAEMON Tools Lite\daemon.exe
E:\WINDOWS\system32\basfipm.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
E:\WINDOWS\system32\IoctlSvc.exe
E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Documents and Settings\Max\Desktop\RSIT.exe
E:\Program Files\Trend Micro\HijackThis\Max.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - E:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDLauncher] "E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] E:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UpdateManager] "E:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Fling] "E:\Program Files\NCH Software\Fling\fling.exe" -logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SeaMonkey Quick Launch] "E:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe" -turbo
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AnyDVD] "E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - S-1-5-18 Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://E:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - E:\WINDOWS\system32\basfipm.exe
O23 - Service: Bonjour Service - Apple Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ElevatorService - Unknown owner - E:\Program Files\RipTiger\ElevatorService.exe
O23 - Service: Fling File Transfer (FlingService) - NCH Software - E:\Program Files\NCH Software\Fling\fling.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - E:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - E:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: spkrmon - Unknown owner - E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: STSService - Unknown owner - E:\Program Files\SoundTaxi Media Suite\STSService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10048 bytes
======Scheduled tasks folder======
E:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Max.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - E:\WINDOWS\system32\dla\tfswshx.dll [2004-08-13 118842]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - E:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-21 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - E:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"=E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-26 53248]
"dla"=E:\WINDOWS\system32\dla\tfswctrl.exe [2004-08-13 122939]
"ccApp"=E:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-01-17 58728]
"SunJavaUpdateSched"=E:\Program Files\Java\jre6\bin\jusched.exe [2009-05-21 148888]
"QuickTime Task"=E:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=E:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]
"UpdateManager"=E:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2004-01-07 110592]
"Symantec NetDriver Monitor"=E:\PROGRA~1\SYMNET~1\SNDMon.exe [2008-04-27 100056]
"NeroFilterCheck"=E:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]
"NBKeyScan"=E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
"Fling"=E:\Program Files\NCH Software\Fling\fling.exe [2008-07-16 356356]
"Adobe Reader Speed Launcher"=E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"Malwarebytes Anti-Malware (reboot)"=E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=E:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"Yahoo! Pager"=E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-08-30 4670704]
"SeaMonkey Quick Launch"=E:\Program Files\mozilla.org\SeaMonkey\SeaMonkey.exe [2008-06-21 106496]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]
"DAEMON Tools Lite"=E:\Program Files\DAEMON Tools Lite\daemon.exe [2008-04-01 486856]
"AnyDVD"=E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [2009-01-09 89024]
E:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
E:\Documents and Settings\Max\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
E:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskmgr"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\uTorrent\uTorrent.exe"="E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Opera.exe"="C:\Program Files\Opera.exe:*:Enabled:Opera Internet Browser"
"E:\Program Files\Messenger\msmsgs.exe"="E:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"E:\Program Files\Yahoo!\Messenger\YServer.exe"="E:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"E:\Program Files\Bonjour\mDNSResponder.exe"="E:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"E:\Program Files\iTunes\iTunes.exe"="E:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2009-12-25 12:15:51 ----A---- E:\WINDOWS\10359rz535d.exe
2009-12-20 10:26:42 ----A---- E:\WINDOWS\system32\15592trojz48.dll
2009-12-18 17:16:03 ----A---- E:\WINDOWS\system32\10665vir5z498.exe
2009-12-15 11:44:31 ----A---- E:\WINDOWS\system32\z453s5ambot109.dll
2009-12-15 10:09:11 ----A---- E:\WINDOWS\system32\9z935roj366.dll
2009-12-10 06:12:38 ----A---- E:\WINDOWS\system32\29550szy6b7.dll
2009-11-27 18:45:48 ----D---- E:\Documents and Settings\Max\Application Data\Malwarebytes
2009-11-27 18:45:41 ----D---- E:\Program Files\Malwarebytes' Anti-Malware
2009-11-27 18:45:41 ----D---- E:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-11-25 03:01:12 ----HDC---- E:\WINDOWS\$NtUninstallKB976098-v2$
2009-11-25 03:01:02 ----HDC---- E:\WINDOWS\$NtUninstallKB973687$
2009-11-24 21:03:52 ----D---- E:\rsit
2009-11-24 20:58:32 ----D---- E:\Rooter$
2009-11-24 08:54:53 ----A---- E:\WINDOWS\133005o9m2z3.dll
2009-11-23 18:34:30 ----A---- E:\WINDOWS\system32\6274downlo5der69z.exe
2009-11-23 04:57:09 ----A---- E:\WINDOWS\system32\265209otza-virus450.exe
2009-11-22 07:56:06 ----A---- E:\WINDOWS\3068addzar91305.dll
2009-11-21 07:04:35 ----A---- E:\WINDOWS\z382v5r1916.dll
2009-11-13 21:00:17 ----D---- E:\WINDOWS\ERDNT
2009-11-13 20:59:30 ----D---- E:\Program Files\ERUNT
2009-11-13 20:32:45 ----D---- E:\Program Files\trend micro
2009-11-12 21:52:08 ----D---- E:\WINDOWS\CSC
2009-11-12 21:52:00 ----A---- E:\WINDOWS\ntbtlog.txt
2009-11-12 18:39:23 ----D---- E:\Program Files\iPod
2009-11-12 18:39:04 ----D---- E:\Program Files\iTunes
2009-11-11 12:24:59 ----A---- E:\WINDOWS\12114spam5o97f4z.exe
2009-11-11 03:00:49 ----HDC---- E:\WINDOWS\$NtUninstallKB969947$
2009-11-05 03:01:16 ----HDC---- E:\WINDOWS\$NtUninstallKB976749$
2009-10-28 03:51:42 ----A---- E:\WINDOWS\1z062spambo5692.exe
======List of files/folders modified in the last 1 months======
2009-11-27 18:58:50 ----D---- E:\WINDOWS\Temp
2009-11-27 18:58:46 ----D---- E:\Documents and Settings\Max\Application Data\OpenOffice.org2
2009-11-27 18:58:45 ----D---- E:\WINDOWS\system32\CatRoot2
2009-11-27 18:58:41 ----D---- E:\WINDOWS\system32
2009-11-27 18:58:36 ----D---- E:\Program Files\Mozilla Firefox
2009-11-27 18:58:03 ----RD---- E:\Program Files
2009-11-27 18:58:03 ----D---- E:\Program Files\Common Files
2009-11-27 18:57:00 ----A---- E:\WINDOWS\SchedLgU.Txt
2009-11-27 18:45:48 ----D---- E:\WINDOWS\Prefetch
2009-11-27 18:45:43 ----D---- E:\WINDOWS\system32\drivers
2009-11-27 18:37:32 ----AD---- E:\WINDOWS
2009-11-27 18:26:39 ----D---- E:\Program Files\Spybot - Search & Destroy
2009-11-27 18:26:37 ----D---- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-26 00:00:55 ----A---- E:\WINDOWS\NeroDigital.ini
2009-11-25 17:49:27 ----D---- E:\Torrent
2009-11-25 17:48:52 ----D---- E:\DVD
2009-11-25 03:01:16 ----HD---- E:\WINDOWS\inf
2009-11-25 03:01:11 ----A---- E:\WINDOWS\imsins.BAK
2009-11-25 03:01:05 ----RSHDC---- E:\WINDOWS\system32\dllcache
2009-11-25 03:00:28 ----HD---- E:\WINDOWS\$hf_mig$
2009-11-25 03:00:23 ----SHD---- E:\WINDOWS\Installer
2009-11-25 03:00:22 ----D---- E:\WINDOWS\WinSxS
2009-11-24 20:50:08 ----A---- E:\WINDOWS\win.ini
2009-11-24 20:50:08 ----A---- E:\WINDOWS\system.ini
2009-11-24 20:49:48 ----D---- E:\WINDOWS\pss
2009-11-12 18:58:28 ----D---- E:\Program Files\Common Files\Symantec Shared
2009-11-12 18:39:21 ----D---- E:\Program Files\Common Files\Apple
2009-11-05 10:36:22 ----A---- E:\WINDOWS\system32\MRT.exe
2009-11-05 03:22:17 ----A---- E:\WINDOWS\system32\PerfStringBackup.INI
2009-10-31 11:07:33 ----D---- E:\Documents and Settings\Max\Application Data\Real
2009-10-29 10:03:29 ----D---- E:\WINDOWS\Help
2009-10-28 08:07:15 ----N---- E:\WINDOWS\system32\tzchange.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 ElbyCDIO;ElbyCDIO Driver; E:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-01-01 24872]
R1 intelppm;Intel Processor Driver; E:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; E:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; E:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 SAVRTPEL;SAVRTPEL; \??\E:\Program Files\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 sscdbhk5;sscdbhk5; E:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; E:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R1 SYMTDI;SYMTDI; E:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-03-28 266552]
R2 BASFND;BASFND; \??\E:\WINDOWS\system32\Drivers\BASFND.sys []
R2 drvnddm;drvnddm; E:\WINDOWS\system32\drivers\drvnddm.sys [2004-08-13 40544]
R2 symlcbrd;symlcbrd; \??\E:\WINDOWS\system32\drivers\symlcbrd.sys []
R2 tfsnboio;tfsnboio; E:\WINDOWS\system32\dla\tfsnboio.sys [2004-08-13 25723]
R2 tfsncofs;tfsncofs; E:\WINDOWS\system32\dla\tfsncofs.sys [2004-08-13 34843]
R2 tfsndrct;tfsndrct; E:\WINDOWS\system32\dla\tfsndrct.sys [2004-08-13 4123]
R2 tfsndres;tfsndres; E:\WINDOWS\system32\dla\tfsndres.sys [2004-08-13 2239]
R2 tfsnifs;tfsnifs; E:\WINDOWS\system32\dla\tfsnifs.sys [2004-08-13 86202]
R2 tfsnopio;tfsnopio; E:\WINDOWS\system32\dla\tfsnopio.sys [2004-08-13 14715]
R2 tfsnpool;tfsnpool; E:\WINDOWS\system32\dla\tfsnpool.sys [2004-08-13 6363]
R2 tfsnudf;tfsnudf; E:\WINDOWS\system32\dla\tfsnudf.sys [2004-08-13 98714]
R2 tfsnudfa;tfsnudfa; E:\WINDOWS\system32\dla\tfsnudfa.sys [2004-08-13 100603]
R3 aeaudio;aeaudio; E:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 AnyDVD;AnyDVD; E:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-01-08 103488]
R3 Arp1394;1394 ARP Client Protocol; E:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 b57w2k;Broadcom NetXtreme 57xx Gigabit Controller; E:\WINDOWS\system32\DRIVERS\b57xp32.sys [2004-04-29 186112]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; E:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hidusb;Microsoft HID Class Driver; E:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; E:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
R3 NAVENG;NAVENG; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20091125.004\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20091125.004\NavEx15.Sys []
R3 NIC1394;1394 Net Driver; E:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pcouffin;VSO Software pcouffin; E:\WINDOWS\System32\Drivers\pcouffin.sys [2009-04-06 47360]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; E:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-12 5888]
R3 SAVRT;SAVRT; \??\E:\Program Files\Norton AntiVirus\SAVRT.SYS []
R3 smwdm;smwdm; E:\WINDOWS\system32\drivers\smwdm.sys [2004-04-09 612352]
R3 SYMDNS;SYMDNS; E:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-03-28 11480]
R3 SymEvent;SymEvent; \??\E:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; E:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-03-28 171928]
R3 SYMIDS;SYMIDS; E:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-03-28 37016]
R3 SYMIDSCO;SYMIDSCO; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20091110.002\symidsco.sys []
R3 SYMNDIS;SYMNDIS; E:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-03-28 47192]
R3 SYMREDRV;SYMREDRV; E:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-03-28 18904]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; E:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; E:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; E:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; E:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; E:\WINDOWS\System32\Drivers\vulfnth.sys [2003-08-04 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; E:\WINDOWS\System32\Drivers\vulfntr.sys [2003-08-04 11392]
S3 61883;61883 Unit Device; E:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 Avc;AVC Device; E:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 avjsmv5q;avjsmv5q; E:\WINDOWS\system32\drivers\avjsmv5q.sys []
S3 CCDECODE;Closed Caption Decoder; E:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 dot4;MS IEEE-1284.4 Driver; E:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; E:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 Dot4Scan;Scan Class Driver for IEEE-1284.4; E:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]
S3 dot4usb;Dot4USB Filter Dot4USB Filter; E:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-17 23808]
S3 motmodem;Motorola USB CDC ACM Driver; E:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]
S3 MSDV;Microsoft DV Camera and VCR; E:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; E:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; E:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; E:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Network Monitor Driver; E:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 NPF;NetGroup Packet Filter Driver; E:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 SLIP;BDA Slip De-Framer; E:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; E:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; E:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; E:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 USBAAPL;Apple Mobile USB Driver; E:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 USBSTOR;USB Mass Storage Driver; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; E:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; E:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WSTCODEC;World Standard Teletext Codec; E:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; E:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ADVService;Amazon Unbox Video Service; E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [2007-07-11 25640]
R2 Apple Mobile Device;Apple Mobile Device; E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 BAsfIpM;Broadcom ASF IP monitoring service v6.0.4; E:\WINDOWS\system32\basfipm.exe [2004-04-01 77824]
R2 Bonjour Service;Bonjour Service; E:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ccEvtMgr;Symantec Event Manager; E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2008-01-17 197992]
R2 ccSetMgr;Symantec Settings Manager; E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2008-01-17 181608]
R2 JavaQuickStarterService;Java Quick Starter; E:\Program Files\Java\jre6\bin\jqs.exe [2009-05-21 152984]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NPFMntor;Norton AntiVirus Firewall Monitor Service; E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe [2005-10-19 46704]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; E:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SNDSrvc;Symantec Network Drivers Service; E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-03-28 206552]
R2 SPBBCSvc;Symantec SPBBCSvc; E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2004-07-21 173160]
R2 spkrmon;spkrmon; E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe [2003-08-28 61440]
R2 Symantec Core LC;Symantec Core LC; E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-04-27 822424]
R2 UMWdf;Windows User Mode Driver Framework; E:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; E:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 iPod Service;iPod Service; E:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
R3 navapsvc;Norton AntiVirus Auto-Protect Service; E:\Program Files\Norton AntiVirus\navapsvc.exe [2005-10-19 177264]
R3 NMIndexingService;NMIndexingService; E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S2 FlingService;Fling File Transfer; E:\Program Files\NCH Software\Fling\fling.exe [2008-07-16 356356]
S2 SBService;ScriptBlocking Service; E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe [2005-10-19 67184]
S3 aspnet_state;ASP.NET State Service; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 ccPwdSvc;Symantec Password Validation; E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2008-01-17 79208]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 ElevatorService;ElevatorService; E:\Program Files\RipTiger\ElevatorService.exe [2009-09-29 180224]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120]
S3 idsvc;Windows CardSpace; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); E:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 SAVScan;SAVScan; E:\Program Files\Norton AntiVirus\SAVScan.exe [2005-03-07 198368]
S3 STSService;STSService; E:\Program Files\SoundTaxi Media Suite\STSService.exe [2009-09-28 335872]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
In case I haven't said it before, I REALLY appreciate all of your help.
Please let me know how to proceed.
Thanks,
Max
Dakeyras
2009-11-28, 13:41
Hi. :)
I would appreciate any advice you can offer about what start-up items to remove. Once all this is done, I know which start-ups I want to remove, but I'd appreciate hearing your thoughts, too. Well the actual application will tell you which can be safely removed............however I do appreciate regardless the fact it does it can be a wee bit disconcerting. So with this in mind I will target for removal those applications that had been previously removed with MSConfig so that should improve the boot-up time and overall performance etc.
In case I haven't said it before, I REALLY appreciate all of your help.
You are very welcome!
Next:
Only carry out this part if you do not wish for Open Office quick start to be available after every system reboot. The rest of the start-ups are targeted below in the custom OTM script.
Please re-open HiJackThis and select Do a system scan only. Check the boxes next to all the entries listed below (if present):
O4 - S-1-5-18 Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
Now click on Fix Checked. Close HiJackThis.
Note: No need to reboot the system just yet, we will be shortly.
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.
Please navigate to Start >> All Programs >> ERUNT >> ERUNT.
Click on OK within the pop-up menu.
In the next menu under C:\WINDOWS\ERDNT\DD-MM-YYYY under Backup options make sure both the following are selected:
System registry
Current user registry
Next click on OK
When the Question pop-up appears click on Yes
After a short duration the Registry backup is complete! popup will appear
Now click on OK. A backup has been created.
Next:
Please download OTM (http://oldtimer.geekstogo.com/OTM.exe) to your Desktop.
Double-click OTM to start the program.
Copy the lines from the codebox to the clipboard by highlighting ALL of them and pressing CTRL + B (or, after highlighting, right-click and choose Copy):
:Processes
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[-HKEY_CLASSES_ROOT\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"iTunesHelper"=-
"UpdateManager"=-
"Fling"=-
"Adobe Reader Speed Launcher"=-
"Malwarebytes Anti-Malware (reboot)"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=-
"SeaMonkey Quick Launch"=-
"DAEMON Tools Lite"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
:Files
E:\Torrent
E:\Program Files\uTorrent
E:\WINDOWS\10359rz535d.exe
E:\WINDOWS\system32\15592trojz48.dll
E:\WINDOWS\system32\10665vir5z498.exe
E:\WINDOWS\system32\z453s5ambot109.dll
E:\WINDOWS\system32\9z935roj366.dll
E:\WINDOWS\system32\29550szy6b7.dll
E:\WINDOWS\133005o9m2z3.dll
E:\WINDOWS\system32\6274downlo5der69z.exe
E:\WINDOWS\system32\265209otza-virus450.exe
E:\WINDOWS\3068addzar91305.dll
E:\WINDOWS\z382v5r1916.dll
E:\WINDOWS\12114spam5o97f4z.exe
E:\WINDOWS\1z062spambo5692.exe
E:\Program Files\Spybot - Search & Destroy
E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
:Commands
[Purity]
[EmptyTemp]
[Start Explorer]
[Reboot]
Return to OTM, right-click in the "Paste instructions for items to be moved" window (under the yellow bar) and choose Paste
Then click the red MoveIt! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of it and pressing CTRL + C (or, after highlighting, right-click and choose Copy), and paste it into your next response.
If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
Close OTM.
Run Kaspersky Online AV Scanner:
Go to this Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/pages/default/check.html?n=1242123288046) and perform an online antivirus scan.
Note: Use Internet Explorer for this scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.
This online tuturial (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif) will help explain how to use the aforementioned online scan.
When completed the above, please post back the following:
How is you computer performing now? Any problems encountered and or any further symptoms?
OTM Log.
Kaspersky report.
A new RSIT Log.
Hi.
I did everything you mentioned. My computer continues to seem as if it's running normally. No obvious or new issues to report.
Here is the OTM log:
All processes killed
========== PROCESSES ==========
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_CLASSES_ROOT\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\UpdateManager deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Fling deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Malwarebytes Anti-Malware (reboot) deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSMSGS deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SeaMonkey Quick Launch deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys\ deleted successfully.
========== FILES ==========
E:\Torrent\043 Playboy Farrah Fawcett.DVD-Rip\WinZip Pro v.10\WiZip Pro v.10 Setup folder moved successfully.
E:\Torrent\043 Playboy Farrah Fawcett.DVD-Rip\WinZip Pro v.10\WiZip Pro v.10 Keygen folder moved successfully.
E:\Torrent\043 Playboy Farrah Fawcett.DVD-Rip\WinZip Pro v.10 folder moved successfully.
E:\Torrent\043 Playboy Farrah Fawcett.DVD-Rip folder moved successfully.
E:\Torrent folder moved successfully.
File/Folder E:\Program Files\uTorrent not found.
E:\WINDOWS\10359rz535d.exe moved successfully.
LoadLibrary failed for E:\WINDOWS\system32\15592trojz48.dll
E:\WINDOWS\system32\15592trojz48.dll moved successfully.
E:\WINDOWS\system32\10665vir5z498.exe moved successfully.
LoadLibrary failed for E:\WINDOWS\system32\z453s5ambot109.dll
E:\WINDOWS\system32\z453s5ambot109.dll moved successfully.
LoadLibrary failed for E:\WINDOWS\system32\9z935roj366.dll
E:\WINDOWS\system32\9z935roj366.dll moved successfully.
LoadLibrary failed for E:\WINDOWS\system32\29550szy6b7.dll
E:\WINDOWS\system32\29550szy6b7.dll moved successfully.
LoadLibrary failed for E:\WINDOWS\133005o9m2z3.dll
E:\WINDOWS\133005o9m2z3.dll moved successfully.
E:\WINDOWS\system32\6274downlo5der69z.exe moved successfully.
E:\WINDOWS\system32\265209otza-virus450.exe moved successfully.
LoadLibrary failed for E:\WINDOWS\3068addzar91305.dll
E:\WINDOWS\3068addzar91305.dll moved successfully.
LoadLibrary failed for E:\WINDOWS\z382v5r1916.dll
E:\WINDOWS\z382v5r1916.dll moved successfully.
E:\WINDOWS\12114spam5o97f4z.exe moved successfully.
E:\WINDOWS\1z062spambo5692.exe moved successfully.
E:\Program Files\Spybot - Search & Destroy\Skins folder moved successfully.
E:\Program Files\Spybot - Search & Destroy\Plugins folder moved successfully.
E:\Program Files\Spybot - Search & Destroy\Languages folder moved successfully.
E:\Program Files\Spybot - Search & Destroy\Help folder moved successfully.
E:\Program Files\Spybot - Search & Destroy\Dummies folder moved successfully.
E:\Program Files\Spybot - Search & Destroy folder moved successfully.
E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery folder moved successfully.
E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs folder moved successfully.
E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Max
->Temp folder emptied: 54654 bytes
->Temporary Internet Files folder emptied: 3397892 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 88717831 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 18583 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 87.98 mb
OTM by OldTimer - Version 3.1.2.0 log created on 11282009_111726
Files moved on Reboot...
Registry entries deleted on Reboot...
I will post the Kapersky report and the RSIT log in separate entries to follow.
Kapersky report:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, November 28, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, November 28, 2009 18:39:50
Records in database: 3305127
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
H:\
Scan statistics:
Objects scanned: 152117
Threats found: 3
Infected objects found: 5
Suspicious objects found: 0
Scan duration: 03:30:54
File name / Threat / Threats count
E:\Program Files\DVDFab 5-Ghost\DVDFab.Plat.5.2.3.0.Final\DVDFab Platinum 5.2.3.0 - Final GHostHunter\DVDFab5230.exe Infected: Trojan.Win32.Chifrax.d 1
E:\Program Files\DVDFab 5-Ghost\DVDFab.Plat.5.2.3.0.Final.rar Infected: Trojan.Win32.Chifrax.d 1
E:\Program Files\Norton AntiVirus\Quarantine\024C371A.htm Infected: Packed.JS.Agent.i 1
E:\Program Files\Norton AntiVirus\Quarantine\2D914A20.exe Infected: Trojan-Downloader.Win32.Agent.cjqz 1
E:\Program Files\Norton AntiVirus\Quarantine\353507B7.exe Infected: Trojan-Downloader.Win32.Agent.cjqz 1
Selected area has been scanned.
Latest RSIT log to follow
Latest RSIT log:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Max at 2009-11-28 20:42:11
Microsoft Windows XP Professional Service Pack 3
System drive E: has 57 GB (38%) free of 153 GB
Total RAM: 1014 MB (52% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:42:22 PM, on 11/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\WINDOWS\system32\basfipm.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\NCH Software\Fling\fling.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
E:\WINDOWS\system32\IoctlSvc.exe
E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\notepad.exe
E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
E:\WINDOWS\system32\dla\tfswctrl.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Java\jre6\bin\java.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Documents and Settings\Max\Desktop\RSIT.exe
E:\Program Files\trend micro\HijackThis\Max.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - E:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DVDLauncher] "E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] E:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [AnyDVD] "E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://E:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - E:\WINDOWS\system32\basfipm.exe
O23 - Service: Bonjour Service - Apple Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ElevatorService - Unknown owner - E:\Program Files\RipTiger\ElevatorService.exe
O23 - Service: Fling File Transfer (FlingService) - NCH Software - E:\Program Files\NCH Software\Fling\fling.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - E:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - E:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: spkrmon - Unknown owner - E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: STSService - Unknown owner - E:\Program Files\SoundTaxi Media Suite\STSService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 8757 bytes
======Scheduled tasks folder======
E:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Max.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - E:\WINDOWS\system32\dla\tfswshx.dll [2004-08-13 118842]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - E:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-21 41368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-21 73728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - E:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"=E:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-26 53248]
"dla"=E:\WINDOWS\system32\dla\tfswctrl.exe [2004-08-13 122939]
"ccApp"=E:\Program Files\Common Files\Symantec Shared\ccApp.exe [2008-01-17 58728]
"SunJavaUpdateSched"=E:\Program Files\Java\jre6\bin\jusched.exe [2009-05-21 148888]
"Symantec NetDriver Monitor"=E:\PROGRA~1\SYMNET~1\SNDMon.exe [2008-04-27 100056]
"NeroFilterCheck"=E:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]
"NBKeyScan"=E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"=E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-08-30 4670704]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=E:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]
"AnyDVD"=E:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [2009-01-09 89024]
"MSMSGS"=E:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
E:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
E:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskmgr"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\uTorrent\uTorrent.exe"="E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Opera.exe"="C:\Program Files\Opera.exe:*:Enabled:Opera Internet Browser"
"E:\Program Files\Messenger\msmsgs.exe"="E:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"E:\Program Files\Yahoo!\Messenger\YServer.exe"="E:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"E:\Program Files\Bonjour\mDNSResponder.exe"="E:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"E:\Program Files\iTunes\iTunes.exe"="E:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2009-11-28 11:17:26 ----D---- E:\_OTM
2009-11-27 18:45:48 ----D---- E:\Documents and Settings\Max\Application Data\Malwarebytes
2009-11-27 18:45:41 ----D---- E:\Program Files\Malwarebytes' Anti-Malware
2009-11-27 18:45:41 ----D---- E:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-11-25 03:01:12 ----HDC---- E:\WINDOWS\$NtUninstallKB976098-v2$
2009-11-25 03:01:02 ----HDC---- E:\WINDOWS\$NtUninstallKB973687$
2009-11-24 21:03:52 ----D---- E:\rsit
2009-11-24 20:58:32 ----D---- E:\Rooter$
2009-11-13 21:00:17 ----D---- E:\WINDOWS\ERDNT
2009-11-13 20:59:30 ----D---- E:\Program Files\ERUNT
2009-11-13 20:32:45 ----D---- E:\Program Files\trend micro
2009-11-12 21:52:08 ----D---- E:\WINDOWS\CSC
2009-11-12 21:52:00 ----A---- E:\WINDOWS\ntbtlog.txt
2009-11-12 18:39:23 ----D---- E:\Program Files\iPod
2009-11-12 18:39:04 ----D---- E:\Program Files\iTunes
2009-11-11 03:00:49 ----HDC---- E:\WINDOWS\$NtUninstallKB969947$
2009-11-05 03:01:16 ----HDC---- E:\WINDOWS\$NtUninstallKB976749$
======List of files/folders modified in the last 1 months======
2009-11-28 20:42:20 ----D---- E:\WINDOWS\Prefetch
2009-11-28 17:26:43 ----D---- E:\WINDOWS\Temp
2009-11-28 17:21:15 ----D---- E:\WINDOWS\system32
2009-11-28 11:21:49 ----D---- E:\Program Files\Mozilla Firefox
2009-11-28 11:20:59 ----RD---- E:\Program Files
2009-11-28 11:20:59 ----D---- E:\Program Files\Common Files
2009-11-28 11:20:13 ----D---- E:\WINDOWS\system32\CatRoot2
2009-11-28 11:18:19 ----A---- E:\WINDOWS\SchedLgU.Txt
2009-11-28 11:17:43 ----AD---- E:\WINDOWS
2009-11-27 18:59:10 ----D---- E:\Documents and Settings\Max\Application Data\OpenOffice.org2
2009-11-27 18:45:43 ----D---- E:\WINDOWS\system32\drivers
2009-11-26 00:00:55 ----A---- E:\WINDOWS\NeroDigital.ini
2009-11-25 17:48:52 ----D---- E:\DVD
2009-11-25 03:01:16 ----HD---- E:\WINDOWS\inf
2009-11-25 03:01:11 ----A---- E:\WINDOWS\imsins.BAK
2009-11-25 03:01:05 ----RSHDC---- E:\WINDOWS\system32\dllcache
2009-11-25 03:00:28 ----HD---- E:\WINDOWS\$hf_mig$
2009-11-25 03:00:23 ----SHD---- E:\WINDOWS\Installer
2009-11-25 03:00:22 ----D---- E:\WINDOWS\WinSxS
2009-11-24 20:50:08 ----A---- E:\WINDOWS\win.ini
2009-11-24 20:50:08 ----A---- E:\WINDOWS\system.ini
2009-11-24 20:49:48 ----D---- E:\WINDOWS\pss
2009-11-12 18:58:28 ----D---- E:\Program Files\Common Files\Symantec Shared
2009-11-12 18:39:21 ----D---- E:\Program Files\Common Files\Apple
2009-11-05 10:36:22 ----A---- E:\WINDOWS\system32\MRT.exe
2009-11-05 03:22:17 ----A---- E:\WINDOWS\system32\PerfStringBackup.INI
2009-10-31 11:07:33 ----D---- E:\Documents and Settings\Max\Application Data\Real
2009-10-29 10:03:29 ----D---- E:\WINDOWS\Help
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 ElbyCDIO;ElbyCDIO Driver; E:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-01-01 24872]
R1 intelppm;Intel Processor Driver; E:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; E:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 OMCI;OMCI; E:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 SAVRTPEL;SAVRTPEL; \??\E:\Program Files\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 sscdbhk5;sscdbhk5; E:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; E:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R1 SYMTDI;SYMTDI; E:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-03-28 266552]
R2 BASFND;BASFND; \??\E:\WINDOWS\system32\Drivers\BASFND.sys []
R2 drvnddm;drvnddm; E:\WINDOWS\system32\drivers\drvnddm.sys [2004-08-13 40544]
R2 symlcbrd;symlcbrd; \??\E:\WINDOWS\system32\drivers\symlcbrd.sys []
R2 tfsnboio;tfsnboio; E:\WINDOWS\system32\dla\tfsnboio.sys [2004-08-13 25723]
R2 tfsncofs;tfsncofs; E:\WINDOWS\system32\dla\tfsncofs.sys [2004-08-13 34843]
R2 tfsndrct;tfsndrct; E:\WINDOWS\system32\dla\tfsndrct.sys [2004-08-13 4123]
R2 tfsndres;tfsndres; E:\WINDOWS\system32\dla\tfsndres.sys [2004-08-13 2239]
R2 tfsnifs;tfsnifs; E:\WINDOWS\system32\dla\tfsnifs.sys [2004-08-13 86202]
R2 tfsnopio;tfsnopio; E:\WINDOWS\system32\dla\tfsnopio.sys [2004-08-13 14715]
R2 tfsnpool;tfsnpool; E:\WINDOWS\system32\dla\tfsnpool.sys [2004-08-13 6363]
R2 tfsnudf;tfsnudf; E:\WINDOWS\system32\dla\tfsnudf.sys [2004-08-13 98714]
R2 tfsnudfa;tfsnudfa; E:\WINDOWS\system32\dla\tfsnudfa.sys [2004-08-13 100603]
R3 aeaudio;aeaudio; E:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 AnyDVD;AnyDVD; E:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-01-08 103488]
R3 Arp1394;1394 ARP Client Protocol; E:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 b57w2k;Broadcom NetXtreme 57xx Gigabit Controller; E:\WINDOWS\system32\DRIVERS\b57xp32.sys [2004-04-29 186112]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; E:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hidusb;Microsoft HID Class Driver; E:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; E:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
R3 NAVENG;NAVENG; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20091125.004\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20091125.004\NavEx15.Sys []
R3 NIC1394;1394 Net Driver; E:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pcouffin;VSO Software pcouffin; E:\WINDOWS\System32\Drivers\pcouffin.sys [2009-04-06 47360]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; E:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-12 5888]
R3 SAVRT;SAVRT; \??\E:\Program Files\Norton AntiVirus\SAVRT.SYS []
R3 smwdm;smwdm; E:\WINDOWS\system32\drivers\smwdm.sys [2004-04-09 612352]
R3 SYMDNS;SYMDNS; E:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-03-28 11480]
R3 SymEvent;SymEvent; \??\E:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; E:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-03-28 171928]
R3 SYMIDS;SYMIDS; E:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-03-28 37016]
R3 SYMIDSCO;SYMIDSCO; \??\E:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20091110.002\symidsco.sys []
R3 SYMNDIS;SYMNDIS; E:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-03-28 47192]
R3 SYMREDRV;SYMREDRV; E:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-03-28 18904]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; E:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; E:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; E:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; E:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vulfnths;VIA USB Host Controller Lower Filter; E:\WINDOWS\System32\Drivers\vulfnth.sys [2003-08-04 6912]
R3 vulfntrs;VIA USB Roothub Lower Filter; E:\WINDOWS\System32\Drivers\vulfntr.sys [2003-08-04 11392]
S3 61883;61883 Unit Device; E:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128]
S3 a9ot9s2c;a9ot9s2c; E:\WINDOWS\system32\drivers\a9ot9s2c.sys []
S3 Avc;AVC Device; E:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912]
S3 CCDECODE;Closed Caption Decoder; E:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 dot4;MS IEEE-1284.4 Driver; E:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; E:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 Dot4Scan;Scan Class Driver for IEEE-1284.4; E:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]
S3 dot4usb;Dot4USB Filter Dot4USB Filter; E:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-17 23808]
S3 motmodem;Motorola USB CDC ACM Driver; E:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]
S3 MSDV;Microsoft DV Camera and VCR; E:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; E:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; E:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; E:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nm;Network Monitor Driver; E:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 NPF;NetGroup Packet Filter Driver; E:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 SLIP;BDA Slip De-Framer; E:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; E:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; E:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; E:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 USBAAPL;Apple Mobile USB Driver; E:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 USBSTOR;USB Mass Storage Driver; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; E:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; E:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WSTCODEC;World Standard Teletext Codec; E:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; E:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ADVService;Amazon Unbox Video Service; E:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [2007-07-11 25640]
R2 Apple Mobile Device;Apple Mobile Device; E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 BAsfIpM;Broadcom ASF IP monitoring service v6.0.4; E:\WINDOWS\system32\basfipm.exe [2004-04-01 77824]
R2 Bonjour Service;Bonjour Service; E:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ccEvtMgr;Symantec Event Manager; E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2008-01-17 197992]
R2 ccSetMgr;Symantec Settings Manager; E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2008-01-17 181608]
R2 FlingService;Fling File Transfer; E:\Program Files\NCH Software\Fling\fling.exe [2008-07-16 356356]
R2 JavaQuickStarterService;Java Quick Starter; E:\Program Files\Java\jre6\bin\jqs.exe [2009-05-21 152984]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; E:\Program Files\Norton AntiVirus\navapsvc.exe [2005-10-19 177264]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 NPFMntor;Norton AntiVirus Firewall Monitor Service; E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe [2005-10-19 46704]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; E:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SNDSrvc;Symantec Network Drivers Service; E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-03-28 206552]
R2 SPBBCSvc;Symantec SPBBCSvc; E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2004-07-21 173160]
R2 spkrmon;spkrmon; E:\Program Files\Analog Devices\SoundMAX\spkrmon.exe [2003-08-28 61440]
R2 Symantec Core LC;Symantec Core LC; E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-04-27 822424]
R2 UMWdf;Windows User Mode Driver Framework; E:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; E:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 iPod Service;iPod Service; E:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
R3 NMIndexingService;NMIndexingService; E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S2 SBService;ScriptBlocking Service; E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe [2005-10-19 67184]
S3 aspnet_state;ASP.NET State Service; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 ccPwdSvc;Symantec Password Validation; E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2008-01-17 79208]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 ElevatorService;ElevatorService; E:\Program Files\RipTiger\ElevatorService.exe [2009-09-29 180224]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; E:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120]
S3 idsvc;Windows CardSpace; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); E:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 SAVScan;SAVScan; E:\Program Files\Norton AntiVirus\SAVScan.exe [2005-03-07 198368]
S3 STSService;STSService; E:\Program Files\SoundTaxi Media Suite\STSService.exe [2009-09-28 335872]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; E:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
FYI, Norton Antivirus performed an automatic weekly scan of my PC late Friday night. As usual (GRRRRRR) it found no infected files and as far as I can tell it took no action. I just wanted you to know Norton did it's thing automatically, in case that complicates the situation.
Please let me know how to proceed.
Thanks!
Max
Dakeyras
2009-11-29, 23:14
Hi. :)
The below flagged by the online scan:-
E:\Program Files\DVDFab 5-Ghost\DVDFab.Plat.5.2.3.0.Final\DVDFab Platinum 5.2.3.0 - Final GHostHunter\DVDFab5230.exe
E:\Program Files\DVDFab 5-Ghost\DVDFab.Plat.5.2.3.0.Final.rar Rather than actually removing the files I suggest you remove the actual application as it appears it may have been downloaded as a torrent and the reason why it flagged as infected.
I also advise you empty the Norton AntiVirus Quarantine folder as a precaution.
FYI, Norton Antivirus performed an automatic weekly scan of my PC late Friday night. As usual (GRRRRRR) it found no infected files and as far as I can tell it took no action. I just wanted you to know Norton did it's thing automatically, in case that complicates the situation.
Not a problem the scheduled scan ran, it actually not having found anything is a good sign and you have to bare in mind the actual detections will based upon the actual internal database and the updates etc.
For peace of mind I advise you consider running a online scan a minimum of once per month.
Next:
Out of date Adobe and Java installations pose a security risk. They can be used by malware as a means to infect a computer and or re-infect. We will update both shortly.
Now please go to Start >> Control Panel >> Add/Remove Programs and remove the following (if present):
Adobe Reader 9
Java(TM) 6 Update
Java(TM) 6 Update 4
Java(TM) 6 Update 7
To do so, click once on each of the above in turn to highlight and then click on the Remove button.
Note: Take extra care in answering questions posed by any Uninstaller. Some questions may be worded to deceive you into keeping the program.
New Adobe Reader Installation:
Go here (ftp://ftp.adobe.com/pub/adobe/reader/win/9.x/9.2/enu/) and click on AdbeRdr920_en_US.exe to download the latest version of Adobe Acrobat Reader.
Save this file to your desktop and run it to install the latest version of Adobe Reader.
New Java Installation:
Click here (http://java.sun.com/javase/downloads/index.jsp) to visit Java's website.
Scroll down to Java SE Runtime Environment (JRE) 6 Update 17. Click on Download.
Select Windows from the drop-down list for Platform.
Select Multi-language from the drop-down list for Language.
Check (tick) I agree to the Java SE Runtime Environment 6 License Agreement box and click on Continue.
Click on jre-6u17-windows-i586.exe link to download it and save this to a convenient location.
Double click on jre-6u17-windows-i586.exe to install Java.
Let myself know when completed the above and if any further issues, thank you.
Hi.
I deleted this folder and its contents (bolded items):
E:\Program Files\DVDFab 5-Ghost\DVDFab.Plat.5.2.3.0.Final\DVDFab Platinum 5.2.3.0 - Final GHostHunter\DVDFab5230.exeDVDFab.Plat.5.2.3.0.Final\DVDFab Platinum 5.2.3.0 - Final GHostHunter\DVDFab5230.exe
And deleted this as well:
E:\Program Files\DVDFab 5-Ghost\DVDFab.Plat.5.2.3.0.Final.rar
Does this accomplish what you intended? Please let me know if i need to take additional action.
Also, I removed the Java and Adobe Reader items you listed and installed the updated versions, per your instructions.
My PC seems to be working normally. No additional issues to report.
Please let me know how to proceed.
Thanks,
Max
Dakeyras
2009-11-30, 12:35
Hi. :)
What you mentioned is fine. One point I will raise though is your current version of Internet Explorer is out of date and deemed a security risk.
I would at least update to the following:-
Windows Internet Explorer 7 for Windows XP (http://www.microsoft.com/downloads/details.aspx?familyid=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=en)
Even if you rarely use the aforementioned browser it is not wise to have out of date applications installed on your machine.
Next:
Congratulations your computer now appears to be malware free!
Now I have some tasks for your good self to carry out as part of a clean up process and some advice about online safety.
Importance of Regular System Maintenance:
I advice you read both of the below listed topics as this will go a long way to keeping your Computer performing well.
Help! My computer is slow! (http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html)
Also so is this:
What to do if your Computer is running slowly (http://www.malwareremoval.com/tutorials/runningslowly.php)
Clean up with OTM:
Double-click OTM to start the program.
Close all other programs apart from OTM as this step will require a reboot
On the OTM main screen, press the CleanUp! button
Say Yes to the prompt and then allow the program to reboot your computer.
The above process should clean up and remove the vast majority of scanners used and logs created etc.
Any left over merely delete yourself and empty the Recycle Bin.
Reset the System Restore points:
Create a new, clean System Restore point which you can use in case of future system problems:
Press Start >> All Programs >> Accessories >>System Tools >> System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
Now remove old, infected System Restore points:
Next click Start >> Run and type cleanmgr in the box and press OK
Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
Press OK and Yes to confirm
Now some advice for on-line safety:
Malwarebyte's Anti-Malware:
This is a excellent application and I advise you keep this installed. Check for updates and run a scan once a week.
Other installed security software:
Your presently installed security application, Norton AntiVirus automatically checks for updates and downloads/installs them with every system reboot and or periodically if the machine is left running providing a internet connection is active.
I advise you also run a complete scan with this also once per week.
Erunt:
Emergency Recovery Utility NT, I advice you keep this installed as a means to keep a complete backup of your registry and restore it when needed.
Myself I would actually create a new back up once per week as this along with System Restore may prove to be invaluable if something unforeseen occurs!
Keep your system updated:
Microsoft releases patches for Windows and other products regularly:
I advise you visit: http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us
Install the Active X
Once installed it will advise set Auto-Updates if not set and you then you will be able to manually check for updates also via:
Start >> All Programs >> Microsoft Updates
Be careful when opening attachments and downloading files:
Never open email attachments, not even if they are from someone you know. If you need to open them, scan them with your antivirus program before opening.
Never open emails from unknown senders.
Beware of emails that warn about viruses that are spreading, especially those from antivirus vendors. These email addresses can be easily spoofed. Check the antivirus vendor websites to be sure.
Be careful of what you download. Only download files from known sources. Also, avoid cracked programs. If you need a particular program that costs too much for you, try finding free alternatives on Sourceforge (http://sourceforge.net/) or Pricelessware (http://www.pricelesswarehome.org/).
Stop malicious scripts:
Windows by default allow scripts (which is VBScript and JavaScript) to run and some of these scripts are malicious. Use Noscript (http://www.symantec.com/avcenter/noscript.exe) by Symantec or Script Defender (http://www.analogx.com/contents/download/system/sdefend.htm) by AnalogX to handle these scripts.
Make your Internet Explorer safer:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.Avoid Peer to Peer software:
P2P may be a great way to get lots of seemingly freeware, but it is a great way to get infected as well. There's no way to tell if the file being shared is infected. Worse still, some worms spread via P2P networks, infecting you as well. My advice avoid these types of software applications.
Hosts File:
A Hosts file is like a phone book. You look up someone's name in the phone book before calling him/her. Similarly, your computer will look up the website's IP address before you can view the website.
Hosts file will replace your current Hosts file with another one containing well-known advertisement sites, spyware sites and other bad sites. This new Hosts file will protect you by re-directing these bad sites to 127.0.0.1.
Here are some Hosts files:
MVPS Hosts File (http://www.mvps.org/winhelp2002/hosts.htm)
Bluetack's Hosts File (http://www.bluetack.co.uk/forums/index.php?showtopic=8406)
Bluetack's Host Manager (http://www.bluetack.co.uk/forums/index.php?autocom=faq&CODE=02&qid=16)
hpHosts (http://hphosts.mysteryfcm.co.uk/?s=Download).
Only use one of the above.
Finally a educational source:
To learn more about how to protect yourself while on the internet read this article by Tony Klein(updated by tashi):
So how did I get infected in the first place? (http://forums.spybot.info/showthread.php?t=279)
Some consider this article outdated, personally I still think it bares relevance and the authors are well respected in the Anti-Malware community and by myself also!
Any questions, feel free to ask? If not stay safe!
Hi.
I've taken all of the actions you recommended and I think I'm all set.
Just wanted to say again... Thank You. I really appreciate all of your help, energy and insight. Not only is my PC clean, protected and running like a champ again, I learned some things along the way.
One last thing: I uninstalled S&D earlier. I'm planning to re-install it and use it more intensively than before. I assume that won't cause any problems. Please let me know if there's some reason I should NOT install S&D.
Best regards,
Max
Dakeyras
2009-12-02, 11:46
Hi. :)
You are very welcome!
Regarding Spybot-S&D, by all means reinstall and enable TeaTimer if you so wish. The latter will provide some further protection for your system.
One point however, if you have opted to install a Host-File no need to use the Immunise feature with Spybot-S&D, as this is a actual Host File also basically. Or visa versa etc.
Dakeyras
2009-12-03, 14:24
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than four days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.