PDA

View Full Version : fraud.windowsprotectionsuite and microsoft.windows.redirectedhosts



MFD31
2009-12-17, 04:52
Any help would be appreciated.


Logfile of random's system information tool 1.06 (written by random/random)
Run by Owner at 2009-12-16 21:46:38
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 5 GB (33%) free of 16 GB
Total RAM: 510 MB (12% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job
C:\WINDOWS\tasks\SmartDefrag.job
C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\McAfee\VirusScan\scriptsn.dll [2009-09-16 62784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-02-13 150032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-02-13 150032]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-06-21 155648]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]
"mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2009-10-29 1218008]
"McENUI"=C:\PROGRA~1\McAfee\MHN\McENUI.exe [2009-07-07 1176808]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-12 98304]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\WINDOWS\System32\Macromed\Flash\FlashUtil10c.exe [2009-07-17 257440]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
InterVideo WinCinema Manager.lnk.disabled - E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
InterVideo WinScheduler.lnk.disabled - E:\Program Files\InterVideo\WinDVR\WinScheduler.exe
Microsoft Office.lnk - E:\Program Files\Microsoft Office\Office10\OSA.EXE
MpegTV Station PCITV Remote Control.lnk - E:\Program Files\RemoteCtl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=
:\WINDOW
scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoActiveDesktopChanges"=0
"NoSetActiveDesktop"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoActiveDesktopChanges"=
"NoSetActiveDesktop"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Java\jdk1.5.0_04\jre\bin\java.exe"="C:\Program Files\Java\jdk1.5.0_04\jre\bin\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"E:\Program Files\VUE\jre\bin\javaw.exe"="E:\Program Files\VUE\jre\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"E:\Program Files\LimeWire\LimeWire.exe"="E:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"E:\Program Files\BitDownload\BitDownload.exe"="E:\Program Files\BitDownload\BitDownload.exe:*:Disabled:Warez3"
"C:\Documents and Settings\All Users\Application Data\19b9802\WI19b9.exe"="C:\Documents and Settings\All Users\Application Data\19b9802\WI19b9.exe:*:Enabled:Additional Guard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ecf13dc-b3d3-11dc-9800-cf93dd0d768c}]
shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63e4301f-f413-11dd-9862-000874bdf160}]
shell\AutoRun\command - H:\SLCDMENU.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a4a4066-cf24-11dd-9852-000874bdf160}]
shell\AutoRun\command - I:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2009-12-16 20:31:53 ----D---- C:\Program Files\trend micro
2009-12-16 20:31:52 ----D---- C:\rsit
2009-12-14 15:40:17 ----A---- C:\WINDOWS\system32\32757.exe
2009-12-14 15:20:17 ----A---- C:\WINDOWS\system32\32662.exe
2009-12-14 15:00:17 ----A---- C:\WINDOWS\system32\27644.exe
2009-12-14 14:40:17 ----A---- C:\WINDOWS\system32\25547.exe
2009-12-14 14:20:17 ----A---- C:\WINDOWS\system32\6868.exe
2009-12-14 14:00:17 ----A---- C:\WINDOWS\system32\28253.exe
2009-12-14 13:40:17 ----A---- C:\WINDOWS\system32\7711.exe
2009-12-14 13:20:17 ----A---- C:\WINDOWS\system32\15141.exe
2009-12-14 13:00:17 ----A---- C:\WINDOWS\system32\4664.exe
2009-12-14 12:40:17 ----A---- C:\WINDOWS\system32\17673.exe
2009-12-14 12:20:17 ----A---- C:\WINDOWS\system32\30333.exe
2009-12-14 12:00:17 ----A---- C:\WINDOWS\system32\31322.exe
2009-12-14 11:40:17 ----A---- C:\WINDOWS\system32\23811.exe
2009-12-14 11:20:17 ----A---- C:\WINDOWS\system32\28703.exe
2009-12-14 11:00:17 ----A---- C:\WINDOWS\system32\9894.exe
2009-12-14 10:40:17 ----A---- C:\WINDOWS\system32\17035.exe
2009-12-14 10:20:17 ----A---- C:\WINDOWS\system32\26299.exe
2009-12-14 10:00:17 ----A---- C:\WINDOWS\system32\25667.exe
2009-12-14 09:40:17 ----A---- C:\WINDOWS\system32\19912.exe
2009-12-14 09:20:17 ----A---- C:\WINDOWS\system32\1869.exe
2009-12-14 09:00:17 ----A---- C:\WINDOWS\system32\11538.exe
2009-12-14 08:40:17 ----A---- C:\WINDOWS\system32\14771.exe
2009-12-14 08:20:17 ----A---- C:\WINDOWS\system32\21726.exe
2009-12-14 08:00:17 ----A---- C:\WINDOWS\system32\5447.exe
2009-12-14 07:40:17 ----A---- C:\WINDOWS\system32\19895.exe
2009-12-14 07:20:17 ----A---- C:\WINDOWS\system32\19718.exe
2009-12-14 07:00:17 ----A---- C:\WINDOWS\system32\18716.exe
2009-12-14 06:40:17 ----A---- C:\WINDOWS\system32\17421.exe
2009-12-14 06:20:17 ----A---- C:\WINDOWS\system32\12382.exe
2009-12-14 06:00:17 ----A---- C:\WINDOWS\system32\292.exe
2009-12-14 05:40:17 ----A---- C:\WINDOWS\system32\153.exe
2009-12-14 05:20:17 ----A---- C:\WINDOWS\system32\3902.exe
2009-12-14 05:00:17 ----A---- C:\WINDOWS\system32\14604.exe
2009-12-14 04:40:17 ----A---- C:\WINDOWS\system32\32391.exe
2009-12-14 04:20:17 ----A---- C:\WINDOWS\system32\5436.exe
2009-12-14 04:00:17 ----A---- C:\WINDOWS\system32\4827.exe
2009-12-14 03:40:17 ----A---- C:\WINDOWS\system32\11942.exe
2009-12-14 03:20:17 ----A---- C:\WINDOWS\system32\2995.exe
2009-12-14 03:00:17 ----A---- C:\WINDOWS\system32\491.exe
2009-12-14 02:40:17 ----A---- C:\WINDOWS\system32\9961.exe
2009-12-14 02:20:17 ----A---- C:\WINDOWS\system32\16827.exe
2009-12-14 02:00:17 ----A---- C:\WINDOWS\system32\23281.exe
2009-12-14 01:40:17 ----A---- C:\WINDOWS\system32\28145.exe
2009-12-14 01:20:17 ----A---- C:\WINDOWS\system32\5705.exe
2009-12-14 01:00:16 ----A---- C:\WINDOWS\system32\24464.exe
2009-12-14 00:40:16 ----A---- C:\WINDOWS\system32\26962.exe
2009-12-14 00:20:16 ----A---- C:\WINDOWS\system32\29358.exe
2009-12-14 00:00:16 ----A---- C:\WINDOWS\system32\11478.exe
2009-12-13 23:40:16 ----A---- C:\WINDOWS\system32\15724.exe
2009-12-13 23:20:16 ----A---- C:\WINDOWS\system32\19169.exe
2009-12-13 23:00:15 ----A---- C:\WINDOWS\system32\26500.exe
2009-12-13 22:40:15 ----A---- C:\WINDOWS\system32\6334.exe
2009-12-13 22:20:15 ----A---- C:\WINDOWS\system32\18467.exe
2009-12-13 21:43:01 ----D---- C:\Program Files\InternetSecurity2010
2009-12-13 09:48:48 ----D---- C:\Program Files\Enigma Software Group
2009-12-10 19:13:54 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2009-12-10 19:13:47 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-12-08 21:49:28 ----SHD---- C:\Documents and Settings\All Users\Application Data\WIRFOIVZJANAG
2009-12-08 21:48:53 ----SHD---- C:\Documents and Settings\All Users\Application Data\19b9802

======List of files/folders modified in the last 1 months======

2009-12-16 21:46:49 ----D---- C:\WINDOWS\Temp
2009-12-16 20:31:55 ----D---- C:\WINDOWS\Prefetch
2009-12-16 20:31:53 ----RD---- C:\Program Files
2009-12-16 20:21:34 ----D---- C:\WINDOWS\system32\drivers
2009-12-16 08:23:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-12-15 21:20:46 ----D---- C:\WINDOWS
2009-12-15 20:40:41 ----D---- C:\WINDOWS\system32\CatRoot2
2009-12-14 15:45:37 ----D---- C:\WINDOWS\system32
2009-12-13 21:49:24 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-13 10:12:22 ----SD---- C:\WINDOWS\Tasks
2009-12-13 10:06:45 ----SHD---- C:\WINDOWS\Installer
2009-12-13 10:06:23 ----D---- C:\Program Files\Common Files
2009-12-13 10:01:34 ----D---- C:\WINDOWS\Debug
2009-12-10 03:30:14 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-10 03:11:25 ----HD---- C:\WINDOWS\inf
2009-12-10 03:11:24 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-10 03:10:54 ----D---- C:\Program Files\Internet Explorer
2009-12-10 03:10:36 ----HD---- C:\WINDOWS\$hf_mig$
2009-12-03 02:25:54 ----D---- C:\Program Files\Google
2009-12-01 15:06:19 ----A---- C:\WINDOWS\system32\MRT.exe
2009-11-25 08:00:40 ----D---- C:\Documents and Settings\Owner\Application Data\skypePM
2009-11-25 03:20:15 ----D---- C:\Program Files\McAfee
2009-11-25 03:01:09 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2009-09-16 214664]
R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2009-07-16 120136]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-09-03 12032]
R2 BT848;BtCap, WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2002-01-08 266304]
R2 BTTUNER;BtTuner, WDM TvTuner; C:\WINDOWS\system32\drivers\BTTUNER.sys [2001-03-07 18944]
R2 BTXBAR;BtXBar, WDM Crossbar; C:\WINDOWS\system32\drivers\BTXBAR.sys [1999-07-21 13308]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys [2003-06-30 43136]
R3 BCMModem;BCM V.92 56K Modem; C:\WINDOWS\System32\DRIVERS\BCMSM.sys [2003-08-29 1101696]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [2003-03-09 51024]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [2003-03-09 16080]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [2003-03-09 21456]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2005-06-21 807998]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2009-09-16 79816]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2009-09-16 35272]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2009-09-16 40552]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-12-19 539008]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-04-15 113504]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-04-15 78752]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 epmntdrv;epmntdrv; \??\C:\WINDOWS\system32\epmntdrv.sys []
S3 EuGdiDrv;EuGdiDrv; \??\C:\WINDOWS\system32\EuGdiDrv.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2009-09-16 34248]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 QCDonner;Logitech QuickCam Express; C:\WINDOWS\System32\DRIVERS\OVCD.sys [2001-08-17 28032]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\System32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2006-05-03 413696]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-02-23 100032]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2009-07-09 865832]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2009-07-07 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-07-08 359952]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-09-16 144704]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2009-10-27 895696]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2009-09-16 606736]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\HPZipm12.exe [2003-03-09 65795]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S2 gupdate1c99ffc26449a98;Google Update Service (gupdate1c99ffc26449a98); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-08 133104]
S2 OracleOraHome92TNSListener;OracleOraHome92TNSListener; E:\oracle\po92\BIN\TNSLSNR []
S2 OracleServiceORCL;OracleServiceORCL; e:\oracle\po92\bin\ORACLE.EXE [2002-05-14 29475088]
S2 SymWSC;SymWMI Service; C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe [2004-11-02 316544]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-02-23 2045632]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-09-16 365072]
S3 MSCSPTISRV;MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [2006-04-27 53337]
S3 PACSPTISVR;PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [2006-04-27 49241]
S3 SPTISRV;Sony SPTI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [2006-04-27 69718]
S3 SSScsiSV;SonicStage SCSI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe [2006-05-08 69632]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Thanks

tashi
2009-12-17, 07:31
Hello MFD31,

Please see this FAQ, "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Then start a new thread and copy paste the HJT log into it.

Also note: P2P programs http://forums.spybot.info/showpost.php?p=25290&postcount=4 and Sun Microsystems~Java. Security vunerability in older versions left on system (http://forums.spybot.info/showpost.php?p=12880&postcount=2)

Best regards.